Edit tour

Windows Analysis Report
q3na5Mc.exe

Overview

General Information

Sample name:	q3na5Mc.exe
Analysis ID:	1629890
MD5:	e300270e705313fcb5287600e5d94645
SHA1:	7b2a3ea6f9285ee6ad913d1a3519da864b6234c6
SHA256:	c0bb74316b66e8ec4e6e76eed303303026765b247f8adb2a92cc1650e4f8eb08
Tags:	176-113-115-7exeuser-JAMESWT_MHT
Infos:

Detection

Vidar

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Vidar stealer

C2 URLs / IPs found in malware configuration

Hides threads from debuggers

Joe Sandbox ML detected suspicious sample

Monitors registry run keys for changes

PE file contains section with special chars

Potentially malicious time measurement code found

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Abnormal high CPU Usage

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Browser Started with Remote Debugging

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

q3na5Mc.exe (PID: 4324 cmdline: "C:\Users\user\Desktop\q3na5Mc.exe" MD5: E300270E705313FCB5287600E5D94645)

chrome.exe (PID: 3848 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6252 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2496 --field-trial-handle=2128,i,10062375995080605630,17335473394292795222,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

msedge.exe (PID: 2608 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 3236 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2372 --field-trial-handle=2168,i,979304615989707383,5940876946649329924,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8184 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 4268 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=1528,i,5577874075167477756,16733753555390949207,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 4508 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 3032 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2584 --field-trial-handle=2260,i,14492942354235819292,11724797676707326256,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 6752 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 3348 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1992,i,14075413496128955347,14211455807137193995,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7880 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6952 --field-trial-handle=1992,i,14075413496128955347,14211455807137193995,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7888 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7112 --field-trial-handle=1992,i,14075413496128955347,14211455807137193995,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 5508 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 576 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2016 --field-trial-handle=1772,i,9291681872558238668,16876093037937104852,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7936 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=5340 --field-trial-handle=1772,i,9291681872558238668,16876093037937104852,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7940 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=5492 --field-trial-handle=1772,i,9291681872558238668,16876093037937104852,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7792 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6200 --field-trial-handle=1772,i,9291681872558238668,16876093037937104852,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: Vidar

{"C2 url": "https://steamcommunity.com/profiles/76561199829660832", "Botnet": "ir7am"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.2156986213.0000000000A62000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000000.00000003.2230766451.0000000000A62000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000000.00000003.2209213432.0000000000A62000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: q3na5Mc.exe PID: 4324	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: q3na5Mc.exe PID: 4324	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.q3na5Mc.exe.400000.0.unpack	infostealer_win_vidar_strings_nov23	Finds Vidar samples based on the specific strings	Sekoia.io	0x1f0ca:$str01: MachineID: 0x1e353:$str02: Work Dir: In memory 0x1f101:$str03: [Hardware] 0x1f0b3:$str04: VideoCard: 0x1eab5:$str05: [Processes] 0x1eac1:$str06: [Software] 0x1e3d0:$str07: information.txt 0x1ee36:$str08: %s\* 0x1ee83:$str08: %s\* 0x1e606:$str11: Software\Martin Prikryl\WinSCP 2\Configuration 0x1e99f:$str12: UseMasterPassword 0x1f10d:$str13: Soft: WinSCP 0x1ebeb:$str14: <Pass encoding="base64"> 0x1f0f0:$str15: Soft: FileZilla 0x1e3c2:$str16: passwords.txt 0x1e9ca:$str17: build_id 0x1ea79:$str18: file_data

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\q3na5Mc.exe", ParentImage: C:\Users\user\Desktop\q3na5Mc.exe, ParentProcessId: 4324, ParentProcessName: q3na5Mc.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default", ProcessId: 3848, ProcessName: chrome.exe

Suricata Signatures

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-05T09:12:37.763747+0100	2044247	1	Malware Command and Control Activity Detected	95.217.27.252	443	192.168.2.5	49708	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-05T09:12:43.328667+0100	2051831	1	Malware Command and Control Activity Detected	95.217.27.252	443	192.168.2.5	49710	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-05T09:12:37.763204+0100	2049087	1	A Network Trojan was detected	192.168.2.5	49708	95.217.27.252	443	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-05T09:13:12.026691+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.5	49878	95.217.27.252	443	TCP
2025-03-05T09:14:20.213629+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.5	49981	95.217.27.252	443	TCP
2025-03-05T09:14:20.832702+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.5	49982	95.217.27.252	443	TCP
2025-03-05T09:14:21.858426+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.5	49983	95.217.27.252	443	TCP
2025-03-05T09:14:24.209749+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.5	49984	95.217.27.252	443	TCP
2025-03-05T09:14:33.455754+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.5	50006	95.217.27.252	443	TCP
2025-03-05T09:14:34.542625+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.5	50008	95.217.27.252	443	TCP
2025-03-05T09:14:34.870244+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.5	50009	95.217.27.252	443	TCP
2025-03-05T09:14:35.865775+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.5	50010	95.217.27.252	443	TCP
2025-03-05T09:14:38.174161+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.5	50011	95.217.27.252	443	TCP
2025-03-05T09:15:17.767021+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.5	50130	95.217.27.252	443	TCP
2025-03-05T09:15:19.699686+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.5	50158	95.217.27.252	443	TCP
2025-03-05T09:15:21.099307+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.5	50165	95.217.27.252	443	TCP
2025-03-05T09:15:23.169766+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.5	50178	95.217.27.252	443	TCP

ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-05T09:14:20.832702+0100	2859636	1	Malware Command and Control Activity Detected	192.168.2.5	49982	95.217.27.252	443	TCP
2025-03-05T09:14:21.858426+0100	2859636	1	Malware Command and Control Activity Detected	192.168.2.5	49983	95.217.27.252	443	TCP
2025-03-05T09:14:24.209749+0100	2859636	1	Malware Command and Control Activity Detected	192.168.2.5	49984	95.217.27.252	443	TCP
2025-03-05T09:14:34.870244+0100	2859636	1	Malware Command and Control Activity Detected	192.168.2.5	50009	95.217.27.252	443	TCP
2025-03-05T09:14:35.865775+0100	2859636	1	Malware Command and Control Activity Detected	192.168.2.5	50010	95.217.27.252	443	TCP
2025-03-05T09:14:38.174161+0100	2859636	1	Malware Command and Control Activity Detected	192.168.2.5	50011	95.217.27.252	443	TCP
2025-03-05T09:15:19.699686+0100	2859636	1	Malware Command and Control Activity Detected	192.168.2.5	50158	95.217.27.252	443	TCP
2025-03-05T09:15:21.099307+0100	2859636	1	Malware Command and Control Activity Detected	192.168.2.5	50165	95.217.27.252	443	TCP
2025-03-05T09:15:23.169766+0100	2859636	1	Malware Command and Control Activity Detected	192.168.2.5	50178	95.217.27.252	443	TCP

ETPRO MALWARE Win32/Stealc/Vidar Stealer Host Details Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-05T09:12:33.672073+0100	2859378	1	Malware Command and Control Activity Detected	192.168.2.5	49706	95.217.27.252	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: q3na5Mc.exe

Avira: detected

Found malware configuration

Source: 0.2.q3na5Mc.exe.400000.0.unpack

Malware Configuration Extractor: Vidar {"C2 url": "https://steamcommunity.com/profiles/76561199829660832", "Botnet": "ir7am"}

Multi AV Scanner detection for submitted file

Source: q3na5Mc.exe	Virustotal: Detection: 67%			Perma Link
Source: q3na5Mc.exe	ReversingLabs: Detection: 65%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: q3na5Mc.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.27.252:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.27.252:443 -> 192.168.2.5:50202 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.27.252:443 -> 192.168.2.5:50214 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.27.252:443 -> 192.168.2.5:50217 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.27.252:443 -> 192.168.2.5:50218 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.27.252:443 -> 192.168.2.5:50219 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.27.252:443 -> 192.168.2.5:50221 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.27.252:443 -> 192.168.2.5:50223 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.27.252:443 -> 192.168.2.5:50225 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.27.252:443 -> 192.168.2.5:50227 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.27.252:443 -> 192.168.2.5:50229 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.27.252:443 -> 192.168.2.5:50232 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.27.252:443 -> 192.168.2.5:50239 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.27.252:443 -> 192.168.2.5:50241 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.27.252:443 -> 192.168.2.5:50243 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.27.252:443 -> 192.168.2.5:50245 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.27.252:443 -> 192.168.2.5:50247 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.27.252:443 -> 192.168.2.5:50249 version: TLS 1.2

Source: C:\Users\user\Desktop\q3na5Mc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 0MB later: 26MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049087 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M1 : 192.168.2.5:49708 -> 95.217.27.252:443
Source: Network traffic	Suricata IDS: 2859378 - Severity 1 - ETPRO MALWARE Win32/Stealc/Vidar Stealer Host Details Exfil (POST) M2 : 192.168.2.5:49706 -> 95.217.27.252:443
Source: Network traffic	Suricata IDS: 2051831 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 : 95.217.27.252:443 -> 192.168.2.5:49710
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.5:49878 -> 95.217.27.252:443
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 95.217.27.252:443 -> 192.168.2.5:49708
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.5:49983 -> 95.217.27.252:443
Source: Network traffic	Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.5:49983 -> 95.217.27.252:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.5:49984 -> 95.217.27.252:443
Source: Network traffic	Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.5:49984 -> 95.217.27.252:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.5:50006 -> 95.217.27.252:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.5:50008 -> 95.217.27.252:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.5:50011 -> 95.217.27.252:443
Source: Network traffic	Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.5:50011 -> 95.217.27.252:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.5:50009 -> 95.217.27.252:443
Source: Network traffic	Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.5:50009 -> 95.217.27.252:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.5:49981 -> 95.217.27.252:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.5:49982 -> 95.217.27.252:443
Source: Network traffic	Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.5:49982 -> 95.217.27.252:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.5:50010 -> 95.217.27.252:443
Source: Network traffic	Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.5:50010 -> 95.217.27.252:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.5:50130 -> 95.217.27.252:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.5:50158 -> 95.217.27.252:443
Source: Network traffic	Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.5:50158 -> 95.217.27.252:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.5:50165 -> 95.217.27.252:443
Source: Network traffic	Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.5:50165 -> 95.217.27.252:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.5:50178 -> 95.217.27.252:443
Source: Network traffic	Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.5:50178 -> 95.217.27.252:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://steamcommunity.com/profiles/76561199829660832

Source: global traffic

HTTP traffic detected: GET /l793oy HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 23.199.48.23 23.199.48.23
Source: Joe Sandbox View	IP Address: 104.126.116.98 104.126.116.98
Source: Joe Sandbox View	IP Address: 23.219.161.132 23.219.161.132

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 108.139.47.92
Source: unknown	TCP traffic detected without corresponding DNS query: 108.139.47.92
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.73.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.73.26
Source: unknown	TCP traffic detected without corresponding DNS query: 108.139.47.92
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.73.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.231.230.148
Source: unknown	TCP traffic detected without corresponding DNS query: 52.231.230.148
Source: unknown	TCP traffic detected without corresponding DNS query: 52.231.230.148
Source: unknown	TCP traffic detected without corresponding DNS query: 108.139.47.92
Source: unknown	TCP traffic detected without corresponding DNS query: 108.139.47.92
Source: unknown	TCP traffic detected without corresponding DNS query: 108.139.47.92
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.73.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.73.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.73.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.73.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.73.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.73.26
Source: unknown	TCP traffic detected without corresponding DNS query: 108.139.47.92
Source: unknown	TCP traffic detected without corresponding DNS query: 108.139.47.92
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.225
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.225
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.225
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.73.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.73.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.73.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.73.26
Source: unknown	TCP traffic detected without corresponding DNS query: 23.43.85.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.43.85.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.43.85.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.43.85.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.43.85.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.43.85.34
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.219
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.219
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.219
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.219
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.219
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.219
Source: unknown	TCP traffic detected without corresponding DNS query: 52.231.230.148
Source: unknown	TCP traffic detected without corresponding DNS query: 52.231.230.148
Source: unknown	TCP traffic detected without corresponding DNS query: 52.231.230.148

Source: C:\Users\user\Desktop\q3na5Mc.exe

Code function: 0_2_00402690 RtlAllocateHeap,memcpy,memcpy,memcpy,HttpSendRequestA,InternetReadFile,memcpy,memcpy,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,InternetReadFile,InternetReadFile,InternetCloseHandle,

0_2_00402690

Source: global traffic	HTTP traffic detected: GET /l793oy HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/131.0.0.0 Safari/537.36 OPR/116.0.0.0Host: su.t.goldenloafuae.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCJDKzQEIucrNAQi/0c0BCIrTzQEI0NbNAQio2M0BCPnA1BUYj87NARi60s0BGMLYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCJDKzQEIucrNAQi/0c0BCIrTzQEI0NbNAQio2M0BCPnA1BUYj87NARi60s0BGMLYzQEY642lFw==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.uiLLJjqnhCQ.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo8NP2y291iiPDmfAN0GV3dvCuqlYA/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531 HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7sec-edge-ntp: {"back_block":0,"bg_cur":{},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowPrivateTarget","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"onscroll","layout":1,"quick_links_opt":1,"sel_feed_piv":"","show_greet":true,"vt_opened":false}Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/SSR-extension.b5cf3a02ea9d69064409.js HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-viewport-height: 876sec-ch-ua-arch: "x86"sec-ch-viewport-width: 1232sec-ch-ua-platform-version: "10.0.0"downlink: 1.45sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-prefers-color-scheme: lightsec-ch-ua-platform: "Windows"device-memory: 8rtt: 100sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-full-version: "117.0.2045.47"sec-ch-dpr: 1ect: 4gAccept: /sec-edge-ntp: {"back_block":0,"bg_cur":{},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowPrivateTarget","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"onscroll","layout":1,"quick_links_opt":1,"sel_feed_piv":"","show_greet":true,"vt_opened":false}Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; sptmarket=en-GB\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=B7B797B89127437BB77722528FFA1B81.RefC=2025-03-05T08:14:44Z; USRLOC=; MUID=1C1B0EDD8CD26F20084B1B7B8DB06EB2; MUIDB=1C1B0EDD8CD26F20084B1B7B8DB06EB2; _EDGE_S=F=1&SID=2EE20C34E51564CE276D1992E461658B; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/web-worker.948ffa5ea2d441a35f55.js HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-viewport-height: 876sec-ch-ua-arch: "x86"sec-ch-viewport-width: 1232sec-ch-ua-platform-version: "10.0.0"downlink: 1.45sec-ch-ua-bitness: "64"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-model: ""sec-ch-prefers-color-scheme: lightsec-ch-ua-platform: "Windows"device-memory: 8rtt: 100sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-full-version: "117.0.2045.47"sec-ch-dpr: 1ect: 4gAccept: /sec-edge-ntp: {"back_block":0,"bg_cur":{},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowPrivateTarget","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"onscroll","layout":1,"quick_links_opt":1,"sel_feed_piv":"","show_greet":true,"vt_opened":false}Sec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: workerReferer: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; sptmarket=en-GB\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=B7B797B89127437BB77722528FFA1B81.RefC=2025-03-05T08:14:44Z; USRLOC=; MUID=1C1B0EDD8CD26F20084B1B7B8DB06EB2; MUIDB=1C1B0EDD8CD26F20084B1B7B8DB06EB2; _EDGE_S=F=1&SID=2EE20C34E51564CE276D1992E461658B; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/vendors.5d0f28115e15fcff20c5.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/microsoft.4fa8815283fe3d88a934.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/common.b7874e20c4dce549f270.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/experience.080e6f3d6ab239b3d609.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /statics/icons/favicon_newtabpage.png HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=1C1B0EDD8CD26F20084B1B7B8DB06EB2; _EDGE_S=F=1&SID=2EE20C34E51564CE276D1992E461658B; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1741162488227&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=b7b797b89127437bb77722528ffa1b81&activityId=b7b797b89127437bb77722528ffa1b81&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=1C1B0EDD8CD26F20084B1B7B8DB06EB2; _EDGE_S=F=1&SID=2EE20C34E51564CE276D1992E461658B; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /b?rn=1741162488227&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=1C1B0EDD8CD26F20084B1B7B8DB06EB2&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b2?rn=1741162488227&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=1C1B0EDD8CD26F20084B1B7B8DB06EB2&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=15546772662f838a0be02431741162489; XID=15546772662f838a0be02431741162489
Source: global traffic	HTTP traffic detected: GET /edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true&enableWidgetsRegion=true HTTP/1.1Host: ntp.msn.comConnection: keep-aliveCache-Control: max-age=0Accept: /Service-Worker: scriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-edge-ntp: {"back_block":0,"bg_cur":{"configIndex":49,"imageId":"BB1msySs","provider":"CMSImage","userSelected":false},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowPrivateTarget","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"onscroll","layout":1,"quick_links_opt":1,"sel_feed_piv":"myFeed","show_greet":true,"vt_opened":false,"wpo_nx":{"v":"2","wgt":{"src":"default"}}}Sec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: serviceworkerReferer: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_Auth=; pglt-edgeChromium-dhp=547; sptmarket=en-GB\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=B7B797B89127437BB77722528FFA1B81.RefC=2025-03-05T08:14:44Z; USRLOC=; MUID=1C1B0EDD8CD26F20084B1B7B8DB06EB2; MUIDB=1C1B0EDD8CD26F20084B1B7B8DB06EB2; _EDGE_S=F=1&SID=2EE20C34E51564CE276D1992E461658B; _EDGE_V=1; MicrosoftApplicationsTelemetryDeviceId=4048f51b-765f-4c09-a4f9-a0ad3aad1de9; ai_session=V8xgLUnvd+SGWmf6+T0b6s\|1741162488223\|1741162488223; sptmarket_restored=en-GB\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=B7B797B89127437BB77722528FFA1B81.RefC=2025-03-05T08:14:44Z
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1741162488227&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=b7b797b89127437bb77722528ffa1b81&activityId=b7b797b89127437bb77722528ffa1b81&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=F8E2DEA62DA24B15889F178C2CB593EB&MUID=1C1B0EDD8CD26F20084B1B7B8DB06EB2 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=1C1B0EDD8CD26F20084B1B7B8DB06EB2; _EDGE_S=F=1&SID=2EE20C34E51564CE276D1992E461658B; _EDGE_V=1; SM=T
Source: global traffic	HTTP traffic detected: GET /crx/blobs/ASuc5ohcoRYyASTWkAI21BvR0f-Aos7pzgW3GtD8ImYoX-O9Pl77join3GT-5wpD1vT_nG6xpJ0eds7JOZacv0OYNfBAee3mKSnMDx3-YDnz3J7UxfHM_wfhsyHz9Z8rajAAxlKa5T9frrLlN0KHGfJRu7Y7NseNtZ_M/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_89_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /edge/ntp?locale=en-GB&title=New+tab&enableForceCache=true HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-viewport-height: 876sec-ch-ua-arch: "x86"sec-ch-viewport-width: 1232sec-ch-ua-platform-version: "10.0.0"downlink: 4.2sec-ch-ua-bitness: "64"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-model: ""sec-ch-prefers-color-scheme: lightsec-ch-ua-platform: "Windows"device-memory: 8rtt: 250sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-full-version: "117.0.2045.47"sec-ch-dpr: 1ect: 4gAccept: /sec-edge-ntp: {"back_block":0,"bg_cur":{},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowPrivateTarget","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"onscroll","layout":1,"quick_links_opt":1,"sel_feed_piv":"","show_greet":true,"vt_opened":false}Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_Auth=; pglt-edgeChromium-dhp=547; sptmarket=en-GB\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=B7B797B89127437BB77722528FFA1B81.RefC=2025-03-05T08:14:44Z; USRLOC=; MUID=1C1B0EDD8CD26F20084B1B7B8DB06EB2; MUIDB=1C1B0EDD8CD26F20084B1B7B8DB06EB2; _EDGE_S=F=1&SID=2EE20C34E51564CE276D1992E461658B; _EDGE_V=1; MicrosoftApplicationsTelemetryDeviceId=4048f51b-765f-4c09-a4f9-a0ad3aad1de9; ai_session=V8xgLUnvd+SGWmf6+T0b6s\|1741162488223\|1741162488223; sptmarket_restored=en-GB\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=B7B797B89127437BB77722528FFA1B81.RefC=2025-03-05T08:14:44Z
Source: global traffic	HTTP traffic detected: GET /edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&startpage=1&PC=U531 HTTP/1.1Host: ntp.msn.comConnection: keep-alivedevice-memory: 8sec-ch-dpr: 1rtt: 0downlink: 10ect: 4gsec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-full-version: "117.0.2045.47"sec-ch-ua-arch: "x86"sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-model: ""sec-ch-ua-bitness: "64"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-prefers-color-scheme: lightUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7sec-edge-ntp: {"back_block":0,"bg_cur":{"configIndex":49,"imageId":"BB1msySs","provider":"CMSImage","userSelected":false},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"onscroll","layout":1,"quick_links_opt":1,"sel_feed_piv":"myFeed","show_greet":true,"vt_opened":false,"wpo_nx":{"v":"2","wgt":{"src":"default"}}}Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /crx/blobs/ASuc5ohcoRYyASTWkAI21BvR0f-Aos7pzgW3GtD8ImYoX-O9Pl77join3GT-5wpD1vT_nG6xpJ0eds7JOZacv0OYNfBAee3mKSnMDx3-YDnz3J7UxfHM_wfhsyHz9Z8rajAAxlKa5T9frrLlN0KHGfJRu7Y7NseNtZ_M/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_89_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /resolver/api/resolve/v3/config/?expType=AppConfig&expInstance=default&apptype=edgeChromium&v=20250304.642&targetScope={%22audienceMode%22:%22adult%22,%22browser%22:{%22browserType%22:%22edgeChromium%22,%22version%22:%22117%22,%22ismobile%22:%22false%22},%22deviceFormFactor%22:%22desktop%22,%22domain%22:%22ntp.msn.com%22,%22locale%22:{%22content%22:{%22language%22:%22en%22,%22market%22:%22us%22},%22display%22:{%22language%22:%22en%22,%22market%22:%22us%22}},%22os%22:%22windows%22,%22platform%22:%22web%22,%22pageType%22:%22dhp%22,%22pageExperiments%22:[%22prg-update-hide-hrt%22]} HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1741162513858&udc=true&pg.n=default&pg.t=dhp&pg.c=2083&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=5891a8e8ceb946fc96950bf1fc6cc169&activityId=5891a8e8ceb946fc96950bf1fc6cc169&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=21FF05F070C66AE911FE105671C16B7A; _EDGE_S=F=1&SID=271739502F2961D007112CF62E246090; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /service/msn/user?apikey=1hYoJsIRvPEnSkk0hlnJF2092mHqiz7xFenIFKa9uc&activityId=5891A8E8-CEB9-46FC-9695-0BF1FC6CC169&ocid=pdp-peregrine&cm=en-us&it=app&user=m-21FF05F070C66AE911FE105671C16B7A&scn=APP_ANON&source=market-consolidation HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=21FF05F070C66AE911FE105671C16B7A; _EDGE_S=F=1&SID=271739502F2961D007112CF62E246090; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /b?rn=1741162513859&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26content%3D1%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=21FF05F070C66AE911FE105671C16B7A&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b2?rn=1741162513859&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26content%3D1%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=21FF05F070C66AE911FE105671C16B7A&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=1073c87b7aeefe82c110a051741162515; XID=1073c87b7aeefe82c110a051741162515
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1741162513858&udc=true&pg.n=default&pg.t=dhp&pg.c=2083&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=5891a8e8ceb946fc96950bf1fc6cc169&activityId=5891a8e8ceb946fc96950bf1fc6cc169&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=C23D2B89D3224377BDDAD6C2D933D374&MUID=21FF05F070C66AE911FE105671C16B7A HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=21FF05F070C66AE911FE105671C16B7A; _EDGE_S=F=1&SID=271739502F2961D007112CF62E246090; _EDGE_V=1; SM=T
Source: global traffic	HTTP traffic detected: GET /sg/msn/1/cm?taboola_hm=21FF05F070C66AE911FE105671C16B7A&gdpr=0&gdpr_consent= HTTP/1.1Host: trc.taboola.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/1.1Host: px.ads.linkedin.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /cksync.php?type=nms&cs=3&ovsid=21FF05F070C66AE911FE105671C16B7A&gdpr=0&gdpr_consent= HTTP/1.1Host: hbx.media.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /m?cdsp=516415&c=21FF05F070C66AE911FE105671C16B7A&mode=inverse&msn_src=ntp&&gdpr=0&gdpr_consent= HTTP/1.1Host: cm.mgid.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /uidmappixel?ext_uid=21FF05F070C66AE911FE105671C16B7A&pname=MSN&gdpr=0&gdpr_consent= HTTP/1.1Host: sync.outbrain.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /sync/msn?gdpr=0&gdpr_consent= HTTP/1.1Host: pr-bh.ybp.yahoo.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /mapuid?suid=21FF05F070C66AE911FE105671C16B7A&sid=16&gdpr=0&gdpr_consent= HTTP/1.1Host: eb2.3lift.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /mapuid?member=280&user=21FF05F070C66AE911FE105671C16B7A;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D21FF05F070C66AE911FE105671C16B7A%2526gdpr%253D0%2526gdpr_consent%253D HTTP/1.1Host: m.adnxs.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Edge-Shopping-Flag: 1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /visitor/sync?uid=9871605be8d4b2a982914bf5c9348e7b&name=MSN&visitor=21FF05F070C66AE911FE105671C16B7A&external=true&gdpr=0&gdpr_consent= HTTP/1.1Host: visitor.omnitagjs.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /getuid?ld=1&gdpr=0&cmp_cs=&us_privacy= HTTP/1.1Host: eb2.3lift.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: tluidp=2072027748123093845663
Source: global traffic	HTTP traffic detected: GET /bounce?%2Fmapuid%3Fmember%3D280%26user%3D21FF05F070C66AE911FE105671C16B7A%3B%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D21FF05F070C66AE911FE105671C16B7A%252526gdpr%25253D0%252526gdpr_consent%25253D HTTP/1.1Host: m.adnxs.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Edge-Shopping-Flag: 1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: XANDR_PANID=qmOpPY2qebdm4VHhOz4SXwNQsQ4Mt4rQ38Y21XaBtmBrYwHFYcZ5ar5VrdbjyeKv8SpYN-DpvVv9WnPzp-3N-o0gMWOnbCjhPg719pHG4AI.; receive-cookie-deprecation=1; uuid2=3108803079619861228
Source: global traffic	HTTP traffic detected: GET /oRTB?redirect={PubRedirectUrl}&gdpr=0&gdpr_consent= HTTP/1.1Host: sync.inmobi.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /getuid?https://c.bing.com/c.gif?anx_uid=$UID&Red3=MSAN_pd&gdpr=0&gdpr_consent= HTTP/1.1Host: ib.adnxs.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /cs/msn?id=21FF05F070C66AE911FE105671C16B7A&gdpr=0&gdpr_consent= HTTP/1.1Host: trace.mediago.ioConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /cs/msn?id=21FF05F070C66AE911FE105671C16B7A&gdpr=0&gdpr_consent= HTTP/1.1Host: trace.popin.ccConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D21FF05F070C66AE911FE105671C16B7A%26gdpr%3D0%26gdpr_consent%3D HTTP/1.1Host: m.adnxs.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Edge-Shopping-Flag: 1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: XANDR_PANID=qmOpPY2qebdm4VHhOz4SXwNQsQ4Mt4rQ38Y21XaBtmBrYwHFYcZ5ar5VrdbjyeKv8SpYN-DpvVv9WnPzp-3N-o0gMWOnbCjhPg719pHG4AI.; receive-cookie-deprecation=1; uuid2=3108803079619861228; anj=dTM7k!M4/8CxrEQF']wIg2GU(d4Al8!]tbP6j2F-XstGt!@Da0$n$G`
Source: global traffic	HTTP traffic detected: GET /bounce?%2Fgetuid%3Fhttps%3A%2F%2Fc.bing.com%2Fc.gif%3Fanx_uid%3D%24UID%26Red3%3DMSAN_pd%26gdpr%3D0%26gdpr_consent%3D HTTP/1.1Host: ib.adnxs.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: receive-cookie-deprecation=1; anj=dTM7k!M4/8CxrEQF']wIg2GU(d4Al8!]tbP6j2F-XstGt!@Da0$n$G`; XANDR_PANID=Dn3VrVHZn4mPQAQkHhRIVUx36ODW4AgXNrtYoOIivNOP2kpm9EPTkLPStkT4u68QLBkpB8m1iU2bvGK41oARxxrM3_abJ7pzMn-WTpax9UA.; uuid2=8146925017383873166
Source: global traffic	HTTP traffic detected: GET /sync?ssp=msn&id=21FF05F070C66AE911FE105671C16B7A&gdpr=0&gdpr_consent= HTTP/1.1Host: code.yengo.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /sync?redirect=%7BPubRedirectUrl%7D&gdpr_consent=&gdpr=0&us_privacy=&gdpr_pd=&source=5&google_push=&retry= HTTP/1.1Host: sync.inmobi.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /setuid?entity=483&code=21FF05F070C66AE911FE105671C16B7A&gdpr=0&gdpr_consent= HTTP/1.1Host: ib.adnxs.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Edge-Shopping-Flag: 1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: receive-cookie-deprecation=1; XANDR_PANID=qmOpPY2qebdm4VHhOz4SXwNQsQ4Mt4rQ38Y21XaBtmBrYwHFYcZ5ar5VrdbjyeKv8SpYN-DpvVv9WnPzp-3N-o0gMWOnbCjhPg719pHG4AI.; anj=dTM7k!M4/8D>6NRF']wIg2GU(d4Al8!fst<#/MDsPlZ[C[-kX-f<qaH; uuid2=3108803079619861228
Source: global traffic	HTTP traffic detected: GET /mapuid?member=280&user=21FF05F070C66AE911FE105671C16B7A&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D21FF05F070C66AE911FE105671C16B7A%2526gdpr%253D0%2526gdpr_consent%253D HTTP/1.1Host: m.adnxs.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: receive-cookie-deprecation=1; XANDR_PANID=qmOpPY2qebdm4VHhOz4SXwNQsQ4Mt4rQ38Y21XaBtmBrYwHFYcZ5ar5VrdbjyeKv8SpYN-DpvVv9WnPzp-3N-o0gMWOnbCjhPg719pHG4AI.; anj=dTM7k!M4.FEVNsVF']wIg2GU(d4Al8!fst<#/SB7p?cM9Z<b=AEIe2kD0ZC6H[$BGp60TtFc#WsFSKVjH[psQp'-r13SvySM?FR+!AXTO:4=sB!)FLc]X2B%; uuid2=3108803079619861228
Source: global traffic	HTTP traffic detected: GET /notify/served?rid=5891a8e8ceb946fc96950bf1fc6cc169&r=resriver&i=1&p=edgechrntp&l=en-us&d=bing&b=Edg&a=03ca6b57-aff5-4894-b2da-9587200bd1fa&ii=1&c=18430832436132743354&bid=09ccd223-2448-4ffd-86eb-051e2f0d583e&tid=edgechrntp-resriver-1&ptid=edgechrntp-resriver-1 HTTP/1.1Host: srtb.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=21FF05F070C66AE911FE105671C16B7A; _EDGE_S=F=1&SID=271739502F2961D007112CF62E246090; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D; _C_Auth=; sptmarket=en-gb\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=5787914166F34670AE0180BFE577166A.RefC=2025-03-05T08:15:20Z; MUIDB=21FF05F070C66AE911FE105671C16B7A
Source: global traffic	HTTP traffic detected: GET /notify/served?rid=5891a8e8ceb946fc96950bf1fc6cc169&r=river&i=1&p=edgechrntp&l=en-us&d=bing&b=Edg&a=65cf8cca-501d-46e5-99c3-d6c06d550d06&ii=1&c=15714249271439865308&bid=09ccd223-2448-4ffd-86eb-051e2f0d583e&tid=edgechrntp-river-1&ptid=edgechrntp-peekriver-1 HTTP/1.1Host: srtb.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=21FF05F070C66AE911FE105671C16B7A; _EDGE_S=F=1&SID=271739502F2961D007112CF62E246090; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D; _C_Auth=; sptmarket=en-gb\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=5787914166F34670AE0180BFE577166A.RefC=2025-03-05T08:15:20Z; MUIDB=21FF05F070C66AE911FE105671C16B7A
Source: global traffic	HTTP traffic detected: GET /seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D21FF05F070C66AE911FE105671C16B7A%26gdpr%3D0%26gdpr_consent%3D HTTP/1.1Host: m.adnxs.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: receive-cookie-deprecation=1; XANDR_PANID=qmOpPY2qebdm4VHhOz4SXwNQsQ4Mt4rQ38Y21XaBtmBrYwHFYcZ5ar5VrdbjyeKv8SpYN-DpvVv9WnPzp-3N-o0gMWOnbCjhPg719pHG4AI.; uuid2=3108803079619861228; anj=dTM7k!M4.FEVNsVF']wIg2GU(d4Al8!fst<)<]%Hp?cM9Z<b=AEIe2kD0ZC6H[$BGp60TtFc#WsFSKVjH[psQp'-r13SvySM?FR+!AXTO:4=sB!)Jo3^8jT(
Source: global traffic	HTTP traffic detected: GET /setuid?entity=483&code=21FF05F070C66AE911FE105671C16B7A&gdpr=0&gdpr_consent= HTTP/1.1Host: ib.adnxs.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: receive-cookie-deprecation=1; XANDR_PANID=qmOpPY2qebdm4VHhOz4SXwNQsQ4Mt4rQ38Y21XaBtmBrYwHFYcZ5ar5VrdbjyeKv8SpYN-DpvVv9WnPzp-3N-o0gMWOnbCjhPg719pHG4AI.; uuid2=3108803079619861228; anj=dTM7k!M4.FEVNsVF']wIg2GU(d4Al8!m5LRe#nszZ=f1CByY$Nd<y!Nh.vnVcyhe^gksNgif9Dhjc5.bgmYVzi-3Zj?11Gx#tLuybpRzqF1`b_dn*Y]8G
Source: global traffic	HTTP traffic detected: GET /notify/served?rid=5891a8e8ceb946fc96950bf1fc6cc169&r=infopane&i=3&p=edgechrntp&l=en-us&d=bing&b=Edg&a=c0784c23-5523-4633-9f72-415aee0c7d67&ii=1&c=13759555503180938378&bid=47f0b698-0158-4175-bfdd-70edaca2b7aa&tid=edgechrntp-infopane-3&ptid=edgechrntp-peekinfopane-1&t=type.msft-content-card&dec=1-1 HTTP/1.1Host: srtb.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=21FF05F070C66AE911FE105671C16B7A; _EDGE_S=F=1&SID=271739502F2961D007112CF62E246090; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D; _C_Auth=; sptmarket=en-gb\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=5787914166F34670AE0180BFE577166A.RefC=2025-03-05T08:15:20Z; MUIDB=21FF05F070C66AE911FE105671C16B7A
Source: global traffic	HTTP traffic detected: GET /notify/served?rid=5891a8e8ceb946fc96950bf1fc6cc169&r=infopane&i=11&p=edgechrntp&l=en-us&d=bing&b=Edg&a=76d0def9-3549-4494-b392-538aabf94232&ii=1&c=2416561758472774325&bid=47f0b698-0158-4175-bfdd-70edaca2b7aa&tid=edgechrntp-infopane-11&ptid=edgechrntp-peekInfopane-2&t=type.msft-content-card&dec=1-1 HTTP/1.1Host: srtb.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=21FF05F070C66AE911FE105671C16B7A; _EDGE_S=F=1&SID=271739502F2961D007112CF62E246090; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D; _C_Auth=; sptmarket=en-gb\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=5787914166F34670AE0180BFE577166A.RefC=2025-03-05T08:15:20Z; MUIDB=21FF05F070C66AE911FE105671C16B7A
Source: global traffic	HTTP traffic detected: GET /notify/served?rid=5891a8e8ceb946fc96950bf1fc6cc169&r=infopane&i=15&p=edgechrntp&l=en-us&d=bing&b=Edg&a=5a9340ee-5b1e-4d1e-9730-8bdaa5ab3e5d&ii=1&c=10866167850402640464&bid=47f0b698-0158-4175-bfdd-70edaca2b7aa&tid=edgechrntp-infopane-15&ptid=edgechrntp-peekinfopane-3&t=type.msft-content-card&dec=1-1 HTTP/1.1Host: srtb.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=21FF05F070C66AE911FE105671C16B7A; _EDGE_S=F=1&SID=271739502F2961D007112CF62E246090; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D; _C_Auth=; sptmarket=en-gb\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=5787914166F34670AE0180BFE577166A.RefC=2025-03-05T08:15:20Z; MUIDB=21FF05F070C66AE911FE105671C16B7A
Source: global traffic	HTTP traffic detected: GET /notify/served?rid=5891a8e8ceb946fc96950bf1fc6cc169&r=resinfopane&i=6&p=edgechrntp&l=en-us&d=bing&b=Edg&a=891eeae4-facd-475b-b0cf-96797d7d3c30&ii=1&c=14459568483967945334&bid=47f0b698-0158-4175-bfdd-70edaca2b7aa&tid=edgechrntp-resinfopane-6&ptid=edgechrntp-resinfopane-1&t=type.msft-content-card&dec=1_i1-1_i1 HTTP/1.1Host: srtb.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=21FF05F070C66AE911FE105671C16B7A; _EDGE_S=F=1&SID=271739502F2961D007112CF62E246090; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D; _C_Auth=; sptmarket=en-gb\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=5787914166F34670AE0180BFE577166A.RefC=2025-03-05T08:15:20Z; MUIDB=21FF05F070C66AE911FE105671C16B7A
Source: global traffic	HTTP traffic detected: GET /edge/ntp?locale=en-GB&title=New+tab&enableForceCache=true HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-viewport-height: 839sec-ch-ua-arch: "x86"sec-ch-viewport-width: 986sec-ch-ua-platform-version: "10.0.0"downlink: 1.6sec-ch-ua-bitness: "64"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-model: ""sec-ch-prefers-color-scheme: lightsec-ch-ua-platform: "Windows"device-memory: 8rtt: 200sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-full-version: "117.0.2045.47"sec-ch-dpr: 1ect: 4gAccept: /sec-edge-ntp: {"back_block":0,"bg_cur":{"configIndex":49,"imageId":"BB1msySs","provider":"CMSImage","userSelected":false},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"onscroll","layout":1,"quick_links_opt":1,"sel_feed_piv":"myFeed","show_greet":true,"vt_opened":false,"wpo_nx":{"v":"2","wgt":{"src":"default"}}}Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&startpage=1&PC=U531Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_Auth=; pglt-edgeChromium-dhp=2083; sptmarket=en-GB\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=5891A8E8CEB946FC96950BF1FC6CC169.RefC=2025-03-05T08:15:12Z; USRLOC=; MUID=21FF05F070C66AE911FE105671C16B7A; MUIDB=21FF05F070C66AE911FE105671C16B7A; _EDGE_S=F=1&SID=271739502F2961D007112CF62E246090; _EDGE_V=1; MicrosoftApplicationsTelemetryDeviceId=4080bbf8-f976-4d2c-947b-cfd1c0b797f0; ai_session=h8iJHG2qWr9AfTNmOdiPnq\|1741162513854\|1741162513854; sptmarket_restored=en-GB\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=B7B797B89127437BB77722528FFA1B81.RefC=2025-03-05T08:14:44Z; msnup=%7B%22cnex%22%3A%22no%22%7D; msaoptout=0
Source: global traffic	HTTP traffic detected: GET /edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true&enableWidgetsRegion=true HTTP/1.1Host: ntp.msn.comConnection: keep-aliveCache-Control: max-age=0Accept: /Service-Worker: scriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-edge-ntp: {"back_block":0,"bg_cur":{"configIndex":49,"imageId":"BB1msySs","provider":"CMSImage","userSelected":false},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"onscroll","layout":1,"quick_links_opt":1,"sel_feed_piv":"myFeed","show_greet":true,"vp":{"height":839,"width":986},"vt_opened":false,"wpo_nx":{"v":"2","wgt":{"src":"default"}}}Sec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: serviceworkerReferer: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&startpage=1&PC=U531Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_Auth=; pglt-edgeChromium-dhp=2083; sptmarket=en-GB\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=5891A8E8CEB946FC96950BF1FC6CC169.RefC=2025-03-05T08:15:12Z; USRLOC=; MUID=21FF05F070C66AE911FE105671C16B7A; MUIDB=21FF05F070C66AE911FE105671C16B7A; _EDGE_S=F=1&SID=271739502F2961D007112CF62E246090; _EDGE_V=1; MicrosoftApplicationsTelemetryDeviceId=4080bbf8-f976-4d2c-947b-cfd1c0b797f0; ai_session=h8iJHG2qWr9AfTNmOdiPnq\|1741162513854\|1741162513854; sptmarket_restored=en-GB\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=B7B797B89127437BB77722528FFA1B81.RefC=2025-03-05T08:14:44Z; msnup=%7B%22cnex%22%3A%22no%22%7D; msaoptout=0If-None-Match: 0x8DD5B8989BA626EIf-Modified-Since: Wed, 05 Mar 2025 02:00:43 GMT

Source: e2c7390e-112e-4a39-9b3f-8b86779ae1c2.tmp.19.dr	String found in binary or memory: "url": "https://www.youtube.com" equals www.youtube.com (Youtube)
Source: 000003.log0.19.dr	String found in binary or memory: "www.facebook.com": "{\"Tier1\": [1103, 6061], \"Tier2\": [5445, 1780, 8220]}", equals www.facebook.com (Facebook)
Source: 000003.log0.19.dr	String found in binary or memory: "www.linkedin.com": "{\"Tier1\": [1103, 214, 6061], \"Tier2\": [2771, 9515, 1780, 1303, 1099, 6081, 5581, 9396]}", equals www.linkedin.com (Linkedin)
Source: 000003.log0.19.dr	String found in binary or memory: "www.youtube.com": "{\"Tier1\": [983, 6061, 1103], \"Tier2\": [2413, 8118, 1720, 5007]}", equals www.youtube.com (Youtube)
Source: chrome.exe, 00000004.00000002.3503462580.00003AB0003D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %https://www.youtube.com/?feature=ytca equals www.youtube.com (Youtube)
Source: chrome.exe, 00000004.00000002.3502240241.00003AB00010C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: /www.youtube.com/J equals www.youtube.com (Youtube)
Source: chrome.exe, 00000004.00000002.3502240241.00003AB00010C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3503462580.00003AB0003D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: @https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
Source: chrome.exe, 00000004.00000003.3267807697.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3268980278.00003AB000F68000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3268881551.00003AB000FB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000004.00000003.3267807697.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3268980278.00003AB000F68000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3268881551.00003AB000FB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000004.00000002.3502240241.00003AB00010C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ht/www.youtube.com/J equals www.youtube.com (Youtube)
Source: chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: chrome.exe, 00000004.00000002.3503462580.00003AB0003D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/: equals www.youtube.com (Youtube)
Source: chrome.exe, 00000004.00000002.3582633647.00003AB000EE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3502674319.00003AB0001D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3582340113.00003AB000E38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/?feature=ytca equals www.youtube.com (Youtube)
Source: chrome.exe, 00000004.00000002.3502674319.00003AB0001D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/?feature=ytca: equals www.youtube.com (Youtube)
Source: chrome.exe, 00000004.00000002.3582340113.00003AB000E38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/?feature=ytcaogl: equals www.youtube.com (Youtube)
Source: chrome.exe, 00000004.00000002.3503462580.00003AB0003D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/J equals www.youtube.com (Youtube)
Source: chrome.exe, 00000004.00000002.3581814165.00003AB000D20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
Source: chrome.exe, 00000004.00000002.3581814165.00003AB000D20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.htmllt equals www.youtube.com (Youtube)
Source: Reporting and NEL.21.dr	String found in binary or memory: network-errorshttps://www.linkedin.com/li/rep equals www.linkedin.com (Linkedin)
Source: Reporting and NEL.21.dr	String found in binary or memory: network-errorshttps://www.linkedin.com/li/rep["FAAAAA8AAABodHRwczovL21zbi5jb20A",false] equals www.linkedin.com (Linkedin)
Source: chrome.exe, 00000004.00000002.3581268835.00003AB000BD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)
Source: chrome.exe, 00000004.00000002.3581347083.00003AB000C1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com/ equals www.youtube.com (Youtube)
Source: chrome.exe, 00000004.00000002.3581347083.00003AB000C1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com/<$ equals www.youtube.com (Youtube)
Source: chrome.exe, 00000004.00000002.3581347083.00003AB000C1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com/Qx equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: t.me
Source: global traffic	DNS traffic detected: DNS query: su.t.goldenloafuae.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: browser.events.data.msn.com
Source: global traffic	DNS traffic detected: DNS query: srtb.msn.com

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----r1djw4wbs0r9rq1vs2nyUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/131.0.0.0 Safari/537.36 OPR/116.0.0.0Host: su.t.goldenloafuae.comContent-Length: 256Connection: Keep-AliveCache-Control: no-cache

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: application/json; charset=utf-8Access-Control-Allow-Headers: TicketType,RequestContinuationKey,AuthToken,Content-Type,x-client-activityid,ms-cv,OneSvc-Uni-Feat-Tun,signedInCookieName,muid,appid,User-Location,user-location,userauthtoken,usertickettype,sitename,s2sauthtoken,thumbprint,Authorization,Ent-Authorization,UserIdToken,DDD-TMPL,DDD-ActivityId,DDD-FeatureSet,DDD-Session-ID,Date,date,ads-referer,ads-referer,taboola-sessionId,taboola-sessionid,Akamai-Request-ID,Akamai-Server-IP,X-MSEdge-Ref,DDD-DebugId,s-xbox-token,OneWebServiceLatency,X-FD-Features,DDD-UserType,traceparent,Widgets,Muted,Velocity,DDD-Auth-Features,SoftLanding,PrefMigrated,DDD-TMPL-Removed,deviceFeatures,Server-Timing,DDD-LocationAssignedAccess-Control-Expose-Headers: TicketType,RequestContinuationKey,AuthToken,Content-Type,x-client-activityid,ms-cv,OneSvc-Uni-Feat-Tun,signedInCookieName,muid,appid,User-Location,user-location,userauthtoken,usertickettype,sitename,s2sauthtoken,thumbprint,Authorization,Ent-Authorization,UserIdToken,DDD-TMPL,DDD-ActivityId,DDD-FeatureSet,DDD-Session-ID,Date,date,ads-referer,ads-referer,taboola-sessionId,taboola-sessionid,Akamai-Request-ID,Akamai-Server-IP,X-MSEdge-Ref,DDD-DebugId,s-xbox-token,OneWebServiceLatency,X-FD-Features,DDD-UserType,traceparent,Widgets,Muted,Velocity,DDD-Auth-Features,SoftLanding,PrefMigrated,DDD-TMPL-Removed,deviceFeatures,Server-Timing,DDD-LocationAssignedDDD-AuthenticatedWithJwtFlow: FalseDDD-UserType: AnonymousMuidDDD-StrategyExecutionLatency: 00:00:00.0013710,00:00:00.0015058DDD-ActivityId: 75378e74-88d8-4c35-a398-a2def13ca84cDDD-TMPL-Removed: FalseDDD-DebugId: 75378e74-88d8-4c35-a398-a2def13ca84c|2025-03-05T08:15:15.3525448Z|fabric_msn|NEU-A|News_1734DDD-Auth-Features: AT:NA;DID:m-21FF05F070C66AE911FE105671C16B7A;IT:App;MuidStateOrigin:MuidFromCookieOneWebServiceLatency: 2X-MSEdge-ResponseInfo: 2Accept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UAX-Ceto-ref: 67c80813960248989fbf452887cb6f9b|AFD:67c80813960248989fbf452887cb6f9b|2025-03-05T08:15:15.346ZX-MSEdge-Ref: Ref A: FA3CC70FE3B64993BEAFDA2F15C6DD03 Ref B: FRA31EDGE0715 Ref C: 2025-03-05T08:15:15ZExpires: Wed, 05 Mar 2025 08:15:15 GMTDate: Wed, 05 Mar 2025 08:15:15 GMTContent-Length: 88Connection: closeSet-Cookie: _C_ETH=1; expires=Tue, 04 Mar 2025 08:15:15 GMT; domain=.msn.com; path=/; secure; httponlySet-Cookie: _C_Auth=Set-Cookie: MUIDB=21FF05F070C66AE911FE105671C16B7A; expires=Mon, 30 Mar 2026 08:15:15 GMT; path=/; httponlySet-Cookie: _EDGE_S=F=1&SID=271739502F2961D007112CF62E246090; domain=.msn.com; path=/; httponlyAlt-Svc: h3=":443"; ma=86400Akamai-Request-BC: [a=95.101.182.37,b=113143643,c=g,n=DE_NW_DUSSELDORF,o=20940],[a=204.79.197.203,c=o

Source: chrome.exe, 00000004.00000003.3263997778.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263241547.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3264026038.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3701907429.00006604003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/1423136
Source: chrome.exe, 00000004.00000003.3263997778.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263241547.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3264026038.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3701907429.00006604003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2162
Source: chrome.exe, 00000004.00000003.3263997778.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263241547.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3264026038.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3701907429.00006604003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2517
Source: chrome.exe, 00000004.00000003.3263997778.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263241547.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3264026038.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3701907429.00006604003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2970
Source: chrome.exe, 00000004.00000003.3263997778.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263241547.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3264026038.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3701907429.00006604003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3078
Source: chrome.exe, 00000004.00000003.3263997778.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263241547.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3264026038.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3701907429.00006604003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3205
Source: chrome.exe, 00000004.00000003.3263997778.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263241547.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3264026038.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3701907429.00006604003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3206
Source: chrome.exe, 00000004.00000003.3263997778.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263241547.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3264026038.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3701907429.00006604003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3452
Source: chrome.exe, 00000004.00000003.3263997778.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263241547.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3264026038.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3701907429.00006604003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3498
Source: chrome.exe, 00000004.00000003.3263997778.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263241547.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3264026038.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3701907429.00006604003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3502
Source: chrome.exe, 00000004.00000003.3263997778.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263241547.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3264026038.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3701907429.00006604003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3577
Source: chrome.exe, 00000004.00000003.3263997778.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263241547.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3264026038.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3701907429.00006604003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3584
Source: chrome.exe, 00000004.00000003.3263997778.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263241547.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3264026038.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3701907429.00006604003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3586
Source: msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3623
Source: msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3624
Source: msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3625
Source: chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263241547.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3264026038.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3701907429.00006604003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3832
Source: chrome.exe, 00000004.00000003.3263997778.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263241547.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3264026038.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3701907429.00006604003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3862
Source: chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3862M
Source: chrome.exe, 00000004.00000003.3263997778.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263241547.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3264026038.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3701907429.00006604003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3965
Source: chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3965X
Source: chrome.exe, 00000004.00000003.3263997778.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263241547.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3264026038.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3701907429.00006604003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3970
Source: chrome.exe, 00000004.00000003.3263997778.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263241547.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3264026038.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3701907429.00006604003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4324
Source: chrome.exe, 00000004.00000003.3263997778.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263241547.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3264026038.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3701907429.00006604003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4384
Source: chrome.exe, 00000004.00000003.3263997778.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263241547.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3264026038.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3701907429.00006604003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4405
Source: chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4405R
Source: chrome.exe, 00000004.00000003.3263997778.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263241547.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3264026038.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3701907429.00006604003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4428
Source: chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263241547.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3264026038.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3701907429.00006604003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4551
Source: chrome.exe, 00000004.00000003.3263997778.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263241547.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3264026038.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3701907429.00006604003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4633
Source: chrome.exe, 00000004.00000003.3263997778.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263241547.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3264026038.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3701907429.00006604003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4722
Source: chrome.exe, 00000004.00000003.3263997778.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263241547.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3264026038.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3701907429.00006604003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4836
Source: chrome.exe, 00000004.00000003.3263997778.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263241547.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3264026038.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3701907429.00006604003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4901
Source: chrome.exe, 00000004.00000003.3263997778.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263241547.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3264026038.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3701907429.00006604003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4937
Source: chrome.exe, 00000004.00000003.3263997778.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263241547.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3264026038.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3701907429.00006604003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5007
Source: chrome.exe, 00000004.00000003.3263997778.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263241547.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3264026038.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3701907429.00006604003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5055
Source: chrome.exe, 00000004.00000003.3263997778.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263241547.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3264026038.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3701907429.00006604003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5061
Source: chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/50615
Source: chrome.exe, 00000004.00000003.3263997778.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263241547.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3264026038.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3701907429.00006604003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5281
Source: chrome.exe, 00000004.00000003.3263997778.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263241547.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3264026038.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3701907429.00006604003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5371
Source: chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5371U
Source: chrome.exe, 00000004.00000003.3263997778.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263241547.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3264026038.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3701907429.00006604003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5375
Source: chrome.exe, 00000004.00000003.3263997778.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263241547.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3264026038.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3701907429.00006604003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5421
Source: chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263241547.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3264026038.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3701907429.00006604003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5430
Source: chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5430Y
Source: chrome.exe, 00000004.00000003.3263997778.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263241547.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3264026038.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3701907429.00006604003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5535
Source: chrome.exe, 00000004.00000003.3263997778.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263241547.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3264026038.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3701907429.00006604003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5658
Source: chrome.exe, 00000004.00000003.3263997778.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263241547.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3264026038.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3701907429.00006604003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5750
Source: chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263241547.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3264026038.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3701907429.00006604003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5881
Source: chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/58814
Source: chrome.exe, 00000004.00000003.3263997778.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263241547.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3264026038.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3701907429.00006604003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5901
Source: chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263241547.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3264026038.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3701907429.00006604003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5906
Source: chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5906$
Source: chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5906%
Source: chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5906(
Source: chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5906)
Source: chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/59069
Source: chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5906:
Source: chrome.exe, 00000004.00000003.3263997778.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263241547.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3264026038.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3701907429.00006604003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6041
Source: chrome.exe, 00000004.00000003.3263997778.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263241547.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3264026038.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3701907429.00006604003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6048
Source: chrome.exe, 00000004.00000003.3263997778.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263241547.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3264026038.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3701907429.00006604003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6141
Source: chrome.exe, 00000004.00000003.3263997778.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263241547.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3264026038.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3701907429.00006604003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6248
Source: chrome.exe, 00000004.00000003.3263997778.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263241547.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3264026038.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3701907429.00006604003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6439
Source: chrome.exe, 00000004.00000003.3263997778.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263241547.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3264026038.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3701907429.00006604003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6651
Source: chrome.exe, 00000004.00000003.3263997778.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263241547.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3264026038.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3701907429.00006604003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6692
Source: chrome.exe, 00000004.00000003.3263997778.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263241547.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3264026038.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3701907429.00006604003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6755
Source: chrome.exe, 00000004.00000003.3263997778.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263241547.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3264026038.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3701907429.00006604003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6860
Source: chrome.exe, 00000004.00000003.3263997778.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263241547.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3264026038.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3701907429.00006604003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6876
Source: chrome.exe, 00000004.00000003.3263997778.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263241547.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3264026038.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3701907429.00006604003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6878
Source: chrome.exe, 00000004.00000003.3263997778.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263241547.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3264026038.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3701907429.00006604003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6929
Source: chrome.exe, 00000004.00000003.3263997778.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263241547.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3264026038.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3701907429.00006604003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6953
Source: chrome.exe, 00000004.00000003.3263997778.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3579948014.00003AB00081C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263241547.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3264026038.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3701907429.00006604003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7036
Source: chrome.exe, 00000004.00000003.3263997778.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263241547.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3264026038.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3701907429.00006604003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7047
Source: chrome.exe, 00000004.00000003.3263997778.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263241547.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3264026038.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3701907429.00006604003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7172
Source: chrome.exe, 00000004.00000003.3263997778.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263241547.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3264026038.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3701907429.00006604003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7279
Source: chrome.exe, 00000004.00000003.3263997778.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263241547.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3264026038.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3701907429.00006604003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7370
Source: chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7370)
Source: chrome.exe, 00000004.00000003.3263997778.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263241547.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3264026038.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3701907429.00006604003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7406
Source: chrome.exe, 00000004.00000003.3263997778.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263241547.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3264026038.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3701907429.00006604003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7488
Source: chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/74883
Source: chrome.exe, 00000004.00000003.3263997778.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263241547.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3264026038.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3701907429.00006604003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7553
Source: chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7553T
Source: chrome.exe, 00000004.00000003.3263997778.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263241547.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3264026038.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3701907429.00006604003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7556
Source: chrome.exe, 00000004.00000003.3263997778.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3579948014.00003AB00081C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263241547.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3264026038.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3701907429.00006604003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7724
Source: chrome.exe, 00000004.00000003.3263997778.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263241547.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3264026038.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3701907429.00006604003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7760
Source: chrome.exe, 00000004.00000003.3263997778.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263241547.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3264026038.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3701907429.00006604003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7761
Source: chrome.exe, 00000004.00000003.3263997778.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263241547.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3264026038.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3701907429.00006604003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8162
Source: chrome.exe, 00000004.00000003.3263997778.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263241547.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3264026038.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3701907429.00006604003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8215
Source: chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263241547.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3264026038.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3701907429.00006604003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8229
Source: chrome.exe, 00000004.00000003.3263997778.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263241547.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3264026038.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3701907429.00006604003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8280
Source: chrome.exe, 00000004.00000002.3502750181.00003AB00020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://clients2.google.com/time/1/current
Source: chrome.exe, 00000004.00000002.3579363355.00003AB00065C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
Source: q3na5Mc.exe, 00000000.00000003.4508626707.00000000059BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/
Source: q3na5Mc.exe, 00000000.00000002.4578351064.0000000000A46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: q3na5Mc.exe, 00000000.00000002.4578351064.0000000000A62000.00000004.00000020.00020000.00000000.sdmp, 77EC63BDA74BD0D0E0426DC8F8008506.0.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: q3na5Mc.exe, 00000000.00000002.4578351064.0000000000A62000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?97b156d865385
Source: q3na5Mc.exe, 00000000.00000003.4456036750.0000000000B8F000.00000004.00000020.00020000.00000000.sdmp, q3na5Mc.exe, 00000000.00000002.4579433424.0000000000B8C000.00000004.00000020.00020000.00000000.sdmp, q3na5Mc.exe, 00000000.00000003.4501616241.0000000000B8F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com:80/msdownload/update/v3/static/trustedr/en/authrootstl.cab?0b99d9b7d6
Source: q3na5Mc.exe, 00000000.00000003.4456036750.0000000000B8F000.00000004.00000020.00020000.00000000.sdmp, q3na5Mc.exe, 00000000.00000002.4579433424.0000000000B8C000.00000004.00000020.00020000.00000000.sdmp, q3na5Mc.exe, 00000000.00000003.4501616241.0000000000B8F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com:80/msdownload/update/v3/static/trustedr/en/authrootstl.cab?1c5dde21b3
Source: q3na5Mc.exe, 00000000.00000002.4579433424.0000000000B8C000.00000004.00000020.00020000.00000000.sdmp, q3na5Mc.exe, 00000000.00000003.4501616241.0000000000B8F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com:80/msdownload/update/v3/static/trustedr/en/authrootstl.cab?5fea0ac158
Source: q3na5Mc.exe, 00000000.00000003.4456036750.0000000000B8F000.00000004.00000020.00020000.00000000.sdmp, q3na5Mc.exe, 00000000.00000003.4501616241.0000000000B8F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com:80/msdownload/update/v3/static/trustedr/en/authrootstl.cab?732f405b72
Source: q3na5Mc.exe, 00000000.00000002.4579433424.0000000000B8C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com:80/msdownload/update/v3/static/trustedr/en/authrootstl.cab?88aed74484
Source: q3na5Mc.exe, 00000000.00000002.4579433424.0000000000B8C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com:80/msdownload/update/v3/static/trustedr/en/authrootstl.cab?97b156d865
Source: q3na5Mc.exe, 00000000.00000003.4456036750.0000000000B8F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com:80/msdownload/update/v3/static/trustedr/en/authrootstl.cab?9ce31eef23
Source: q3na5Mc.exe, 00000000.00000003.4456036750.0000000000B8F000.00000004.00000020.00020000.00000000.sdmp, q3na5Mc.exe, 00000000.00000003.4501616241.0000000000B8F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com:80/msdownload/update/v3/static/trustedr/en/authrootstl.cab?9f3261339a
Source: chrome.exe, 00000004.00000002.3502274497.00003AB00011C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://developer.chrome.com/extensions/external_extensions.html)
Source: chrome.exe, 00000004.00000002.3501823366.00003AB00005C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://google.com/
Source: msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://issuetracker.google.com/200067929
Source: chrome.exe, 00000004.00000003.3272183648.00003AB000F68000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3271141156.00003AB00107C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3272309648.00003AB001098000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3270686098.00003AB00106C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://jsbin.com/temexa/4.
Source: chrome.exe, 00000004.00000003.3276543792.00003AB00043C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3276735182.00003AB001174000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3272183648.00003AB000F68000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3271141156.00003AB00107C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3503047591.00003AB0002F7000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3275922043.00003AB000C78000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3275970417.00003AB000FAC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3276119827.00003AB000FB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3271645288.00003AB0010CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3272309648.00003AB001098000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3276004498.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3270686098.00003AB00106C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3286441745.00003AB000EF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3276797484.00003AB00120C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chrome.exe, 00000004.00000003.3276543792.00003AB00043C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3276735182.00003AB001174000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3272183648.00003AB000F68000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3271141156.00003AB00107C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3503047591.00003AB0002F7000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3275922043.00003AB000C78000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3275970417.00003AB000FAC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3276119827.00003AB000FB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3271645288.00003AB0010CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3272309648.00003AB001098000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3276004498.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3270686098.00003AB00106C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3286441745.00003AB000EF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3276797484.00003AB00120C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chrome.exe, 00000004.00000003.3276543792.00003AB00043C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3276735182.00003AB001174000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3272183648.00003AB000F68000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3271141156.00003AB00107C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3503047591.00003AB0002F7000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3275922043.00003AB000C78000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3275970417.00003AB000FAC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3276119827.00003AB000FB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3271645288.00003AB0010CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3272309648.00003AB001098000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3276004498.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3270686098.00003AB00106C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3286441745.00003AB000EF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3276797484.00003AB00120C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chrome.exe, 00000004.00000003.3276543792.00003AB00043C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3276735182.00003AB001174000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3272183648.00003AB000F68000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3271141156.00003AB00107C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3503047591.00003AB0002F7000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3275922043.00003AB000C78000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3275970417.00003AB000FAC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3276119827.00003AB000FB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3271645288.00003AB0010CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3272309648.00003AB001098000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3276004498.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3270686098.00003AB00106C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3286441745.00003AB000EF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3276797484.00003AB00120C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: chrome.exe, 00000004.00000002.3580550646.00003AB00097C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvNzI0QUFXNV9zT2RvdUw
Source: chrome.exe, 00000004.00000002.3580655602.00003AB0009CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://safebrowsing.googleusercontent.com/safebrowsing/clientreport/chrome-certs
Source: chrome.exe, 00000004.00000002.3580581676.00003AB00099C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://unisolated.invalid/
Source: chrome.exe, 00000004.00000002.3580751625.00003AB000A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.gstatic.com/generate_204
Source: q3na5Mc.exe, 00000000.00000002.4597844870.00000000058E1000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3579829103.00003AB0007C0000.00000004.00000800.00020000.00000000.sdmp, hlfctr.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chrome.exe, 00000004.00000002.3502750181.00003AB00020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accountcapabilities-pa.googleapis.com/
Source: chrome.exe, 00000004.00000002.3502165152.00003AB0000E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accountcapabilities-pa.googleapis.com/v1/accountcapabilities:batchGet
Source: chrome.exe, 00000004.00000002.3503844687.00003AB0004AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3504063870.00003AB000524000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3503462580.00003AB0003B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com
Source: chrome.exe, 00000004.00000002.3581268835.00003AB000BD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3501773286.00003AB000020000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/
Source: chrome.exe, 00000004.00000002.3502674319.00003AB0001D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/AddSession
Source: chrome.exe, 00000004.00000002.3502750181.00003AB00020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/GetCheckConnectionInfo
Source: chrome.exe, 00000004.00000002.3502750181.00003AB00020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ListAccounts?json=standard
Source: chrome.exe, 00000004.00000002.3502674319.00003AB0001D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/Logout
Source: chrome.exe, 00000004.00000002.3502674319.00003AB0001D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/MergeSession
Source: chrome.exe, 00000004.00000002.3502674319.00003AB0001D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/OAuthLogin
Source: chrome.exe, 00000004.00000002.3502750181.00003AB00020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/RotateBoundCookies
Source: chrome.exe, 00000004.00000003.3287922417.00003AB0012E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport
Source: chrome.exe, 00000004.00000003.3287922417.00003AB0012E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport/allowlist
Source: chrome.exe, 00000004.00000003.3287922417.00003AB0012E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport/fine-allowlist
Source: chrome.exe, 00000004.00000002.3502750181.00003AB00020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/chrome/blank.html
Source: chrome.exe, 00000004.00000002.3502750181.00003AB00020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/chrome/blank.htmlB
Source: chrome.exe, 00000004.00000002.3502750181.00003AB00020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/reauth/chromeos
Source: chrome.exe, 00000004.00000002.3502029530.00003AB0000A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/chrome/usermenu
Source: chrome.exe, 00000004.00000002.3502029530.00003AB0000A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/kidsignin/chromeos
Source: chrome.exe, 00000004.00000002.3502029530.00003AB0000A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/kidsignup/chromeos
Source: chrome.exe, 00000004.00000002.3502750181.00003AB00020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/v2/chromeos
Source: chrome.exe, 00000004.00000002.3502750181.00003AB00020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/windows
Source: chrome.exe, 00000004.00000002.3502750181.00003AB00020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/xreauth/chrome
Source: chrome.exe, 00000004.00000002.3502750181.00003AB00020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop
Source: chrome.exe, 00000004.00000002.3502165152.00003AB0000E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop?kdi=CAIaDgoKY2hyb21lc3luYxAB
Source: chrome.exe, 00000004.00000002.3502750181.00003AB00020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/o/oauth2/revoke
Source: chrome.exe, 00000004.00000002.3502750181.00003AB00020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/oauth/multilogin
Source: chrome.exe, 00000004.00000002.3502750181.00003AB00020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/signin/chrome/sync?ssp=1
Source: chrome.exe, 00000004.00000002.3502750181.00003AB00020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com:443
Source: chrome.exe, 00000004.00000003.3263997778.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263241547.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3264026038.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3701907429.00006604003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4830
Source: chrome.exe, 00000004.00000003.3263997778.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263241547.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3264026038.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3701907429.00006604003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4966
Source: chrome.exe, 00000004.00000003.3263997778.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263241547.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3264026038.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3701907429.00006604003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/5845
Source: chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/5845_
Source: chrome.exe, 00000004.00000003.3263997778.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263241547.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3264026038.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3701907429.00006604003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/6574
Source: chrome.exe, 00000004.00000003.3263997778.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263241547.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3264026038.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3701907429.00006604003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7161
Source: chrome.exe, 00000004.00000003.3263997778.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263241547.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3264026038.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3701907429.00006604003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7162
Source: chrome.exe, 00000004.00000003.3263997778.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263241547.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3264026038.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3701907429.00006604003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7246
Source: chrome.exe, 00000004.00000003.3263997778.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263241547.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3264026038.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3701907429.00006604003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7308
Source: chrome.exe, 00000004.00000003.3263997778.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263241547.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3264026038.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3701907429.00006604003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7319
Source: chrome.exe, 00000004.00000003.3263997778.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263241547.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3264026038.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3701907429.00006604003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7320
Source: chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7320o
Source: chrome.exe, 00000004.00000003.3263997778.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263241547.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3264026038.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3701907429.00006604003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7369
Source: chrome.exe, 00000004.00000003.3263997778.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263241547.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3264026038.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3701907429.00006604003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7382
Source: chrome.exe, 00000004.00000003.3263997778.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263241547.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3264026038.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3701907429.00006604003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7489
Source: chrome.exe, 00000004.00000003.3263997778.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263241547.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3264026038.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3701907429.00006604003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7604
Source: chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7604S
Source: chrome.exe, 00000004.00000003.3263997778.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263241547.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3264026038.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3701907429.00006604003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7714
Source: chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7714W
Source: chrome.exe, 00000004.00000003.3263997778.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263241547.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3264026038.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3701907429.00006604003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7847
Source: chrome.exe, 00000004.00000003.3263997778.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263241547.00003AB000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3264026038.00003AB000AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3701907429.00006604003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7899
Source: chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7899N
Source: chrome.exe, 00000004.00000003.3289642313.00003AB0013E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3290750715.00003AB001490000.00000004.00000800.00020000.00000000.sdmp, chromecache_485.6.dr, chromecache_483.6.dr	String found in binary or memory: https://apis.google.com
Source: chrome.exe, 00000004.00000002.3502389149.00003AB00015C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.uiLLJjqnhCQ.O/m=gapi_iframes
Source: msedge.exe, 00000007.00000002.3452024583.00000217EC2A9000.00000004.00000020.00020000.00000000.sdmp, msedge.exe, 00000010.00000002.3657526259.000001FE8C98E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.com
Source: msedge.exe, 00000012.00000002.3811536712.000001E98ACAB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.comse
Source: 2cc80dabc69f58b6_1.8.dr, 4cb013792b196a35_1.19.dr	String found in binary or memory: https://assets.msn.cn/resolver/
Source: 2cc80dabc69f58b6_1.8.dr, 4cb013792b196a35_1.19.dr	String found in binary or memory: https://assets.msn.com/resolver/
Source: 2cc80dabc69f58b6_1.8.dr, 4cb013792b196a35_1.19.dr	String found in binary or memory: https://bit.ly/wb-precache
Source: q3na5Mc.exe, 00000000.00000002.4578351064.0000000000A62000.00000004.00000020.00020000.00000000.sdmp, 4wbi5x.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: q3na5Mc.exe, 00000000.00000002.4578351064.0000000000A62000.00000004.00000020.00020000.00000000.sdmp, 4wbi5x.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: 2cc80dabc69f58b6_1.8.dr, 4cb013792b196a35_1.19.dr	String found in binary or memory: https://browser.events.data.msn.cn/
Source: 2cc80dabc69f58b6_1.8.dr, 4cb013792b196a35_1.19.dr	String found in binary or memory: https://browser.events.data.msn.com/
Source: 2cc80dabc69f58b6_1.8.dr, 4cb013792b196a35_1.19.dr	String found in binary or memory: https://c.msn.com/
Source: chrome.exe, 00000004.00000002.3579777365.00003AB000790000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3582733231.00003AB000F28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3504021888.00003AB00050C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://calendar.google.com/calendar/u/0/r/eventedit?usp=chrome_actions
Source: chrome.exe, 00000004.00000002.3581323833.00003AB000C0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.ico
Source: q3na5Mc.exe, 00000000.00000002.4597844870.00000000058E1000.00000004.00000020.00020000.00000000.sdmp, hlfctr.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: chrome.exe, 00000004.00000002.3581347083.00003AB000C1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.ico
Source: chrome.exe, 00000004.00000002.3581347083.00003AB000C1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icofrom_play_api
Source: q3na5Mc.exe, 00000000.00000002.4597844870.00000000058E1000.00000004.00000020.00020000.00000000.sdmp, hlfctr.0.dr, Web Data.8.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: chrome.exe, 00000004.00000002.3581180791.00003AB000B94000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search
Source: chrome.exe, 00000004.00000002.3581180791.00003AB000B94000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=
Source: chrome.exe, 00000004.00000002.3581180791.00003AB000B94000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=searchTerms
Source: q3na5Mc.exe, 00000000.00000002.4597844870.00000000058E1000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3579363355.00003AB00065C000.00000004.00000800.00020000.00000000.sdmp, hlfctr.0.dr, Web Data.8.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chrome.exe, 00000004.00000003.3276436585.00003AB000CE8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000002.3456364000.00001D9400020000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000010.00000002.3659018450.000024FC0018C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000002.3816452018.000066040017C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore
Source: chrome.exe, 00000004.00000002.3579402928.00003AB00069C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore206E5
Source: chrome.exe, 00000004.00000002.3581347083.00003AB000C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3580751625.00003AB000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3580581676.00003AB00099C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581109749.00003AB000B68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: chrome.exe, 00000004.00000002.3581109749.00003AB000B68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en3%
Source: chrome.exe, 00000004.00000003.3264101046.00003AB000CE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3263968062.00003AB000C78000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3266057742.00003AB000C78000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3267047648.00003AB000C78000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3276381539.00003AB000C78000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3580133496.00003AB0008B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581530391.00003AB000C90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3266843532.00003AB000CE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581503822.00003AB000C88000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3268592381.00003AB000CE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3276436585.00003AB000CE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstoreLDDiscover
Source: chrome.exe, 00000004.00000002.3501484661.000018D400920000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/
Source: chrome.exe, 00000004.00000003.3251626376.000018D400728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3250867146.000018D40071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3501652240.000018D400974000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/2%
Source: chrome.exe, 00000004.00000002.3501484661.000018D400920000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/
Source: chrome.exe, 00000004.00000003.3251626376.000018D400728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3250867146.000018D40071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3501652240.000018D400974000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/2$
Source: chrome.exe, 00000004.00000002.3501484661.000018D400920000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/KAnonymityServiceJoinRelayServerhttps://chromekanonym
Source: chrome.exe, 00000004.00000002.3501484661.000018D400920000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/
Source: chrome.exe, 00000004.00000003.3251626376.000018D400728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3250867146.000018D40071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3501652240.000018D400974000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/2O
Source: chrome.exe, 00000004.00000002.3502750181.00003AB00020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromereporting-pa.googleapis.com/v1/events
Source: chrome.exe, 00000004.00000002.3502750181.00003AB00020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromereporting-pa.googleapis.com/v1/record
Source: chrome.exe, 00000004.00000002.3501736494.00003AB00000C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000002.3456364000.00001D9400020000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000010.00000002.3659018450.000024FC0018C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000002.3816452018.000066040017C000.00000004.00000800.00020000.00000000.sdmp, manifest.json0.19.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: chrome.exe, 00000004.00000002.3582446786.00003AB000E78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromium-i18n.appspot.com/ssl-aggregate-address/
Source: chrome.exe, 00000004.00000002.3502674319.00003AB0001D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://classroom.googleapis.com/
Source: chrome.exe, 00000004.00000002.3502674319.00003AB0001D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://classroom.googleapis.com/g
Source: chrome.exe, 00000004.00000003.3244641220.00000260002D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3244654017.00000260002E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/cr/report
Source: chrome.exe, 00000004.00000002.3579334333.00003AB000648000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/c
Source: chrome.exe, 00000004.00000002.3579777365.00003AB000790000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581347083.00003AB000C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3259512403.00003AB0004A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3579432124.00003AB0006B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3579490549.00003AB0006E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3501773286.00003AB000020000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000002.3456364000.00001D9400020000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000010.00000002.3658406741.000024FC00040000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000002.3815621146.0000660400040000.00000004.00000800.00020000.00000000.sdmp, manifest.json.19.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: chrome.exe, 00000004.00000002.3580655602.00003AB0009CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collection-images?rt=b
Source: chrome.exe, 00000004.00000002.3580655602.00003AB0009CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collection-images?rt=b:
Source: chrome.exe, 00000004.00000002.3580655602.00003AB0009CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collections?rt=b
Source: chrome.exe, 00000004.00000002.3579777365.00003AB000790000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/image?rt=b
Source: chrome.exe, 00000004.00000002.3502674319.00003AB0001D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients4.google.com/chrome-sync
Source: chrome.exe, 00000004.00000002.3502674319.00003AB0001D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients4.google.com/chrome-sync/event
Source: chrome.exe, 00000004.00000002.3502133173.00003AB0000DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3579363355.00003AB00065C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
Source: q3na5Mc.exe, 00000000.00000002.4578351064.0000000000A62000.00000004.00000020.00020000.00000000.sdmp, 4wbi5x.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: q3na5Mc.exe, 00000000.00000002.4578351064.0000000000A62000.00000004.00000020.00020000.00000000.sdmp, 4wbi5x.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: chrome.exe, 00000004.00000002.3580865015.00003AB000A64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/gws/none
Source: chrome.exe, 00000004.00000002.3503150363.00003AB00031C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.goog
Source: chrome.exe, 00000004.00000002.3503150363.00003AB00031C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.googl0
Source: chrome.exe, 00000004.00000003.3259512403.00003AB0004A0000.00000004.00000800.00020000.00000000.sdmp, manifest.json.19.dr	String found in binary or memory: https://docs.google.com/
Source: chrome.exe, 00000004.00000002.3579550651.00003AB000708000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/
Source: chrome.exe, 00000004.00000002.3503462580.00003AB0003D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3582682112.00003AB000F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/:
Source: chrome.exe, 00000004.00000002.3503462580.00003AB0003D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3582446786.00003AB000E78000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3582682112.00003AB000F14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3502750181.00003AB00020C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3579912007.00003AB00080C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/?usp=installed_webapp
Source: chrome.exe, 00000004.00000002.3579912007.00003AB00080C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/?usp=installed_webappP
Source: chrome.exe, 00000004.00000002.3503462580.00003AB0003D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3582682112.00003AB000F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/J
Source: chrome.exe, 00000004.00000002.3579550651.00003AB000708000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/dogl
Source: chrome.exe, 00000004.00000002.3503462580.00003AB0003D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3582733231.00003AB000F28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3582682112.00003AB000F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/installwebapp?usp=chrome_default
Source: chrome.exe, 00000004.00000002.3582733231.00003AB000F28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/installwebapp?usp=chrome_defaultlt
Source: chrome.exe, 00000004.00000002.3579550651.00003AB000708000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/njb
Source: chrome.exe, 00000004.00000002.3503920437.00003AB0004DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3582446786.00003AB000E78000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3579829103.00003AB0007C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3579912007.00003AB00080C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000004.00000002.3503920437.00003AB0004DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3582446786.00003AB000E78000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3579829103.00003AB0007C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3579912007.00003AB00080C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000004.00000002.3503920437.00003AB0004DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3582446786.00003AB000E78000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3579829103.00003AB0007C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3579912007.00003AB00080C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actionsy
Source: chrome.exe, 00000004.00000002.3583168851.00003AB0010FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3583281144.00003AB001138000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/
Source: chrome.exe, 00000004.00000002.3503462580.00003AB0003D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3582682112.00003AB000F14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3583281144.00003AB001138000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/:
Source: chrome.exe, 00000004.00000002.3503462580.00003AB0003D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3582446786.00003AB000E78000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3582682112.00003AB000F14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3583113361.00003AB0010D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/?usp=installed_webapp
Source: chrome.exe, 00000004.00000002.3503462580.00003AB0003D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3582682112.00003AB000F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/J
Source: chrome.exe, 00000004.00000002.3583138370.00003AB0010E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3503462580.00003AB0003D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3582682112.00003AB000F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/installwebapp?usp=chrome_default
Source: chrome.exe, 00000004.00000002.3583168851.00003AB0010FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/ogl:
Source: chrome.exe, 00000004.00000002.3579777365.00003AB000790000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3582733231.00003AB000F28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3504021888.00003AB00050C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000004.00000002.3579777365.00003AB000790000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/u/0/create?usp=chrome_actionsRun
Source: chrome.exe, 00000004.00000002.3579334333.00003AB000648000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3583281144.00003AB001138000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/
Source: chrome.exe, 00000004.00000002.3503462580.00003AB0003D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/:
Source: chrome.exe, 00000004.00000002.3503462580.00003AB0003D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3582446786.00003AB000E78000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3583113361.00003AB0010D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/?usp=installed_webapp
Source: chrome.exe, 00000004.00000002.3503462580.00003AB0003D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/J
Source: chrome.exe, 00000004.00000002.3583643172.00003AB00129C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/installwebapp?usp=chrome_default
Source: chrome.exe, 00000004.00000002.3583281144.00003AB001138000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/oglP
Source: chrome.exe, 00000004.00000002.3579334333.00003AB000648000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/pH
Source: chrome.exe, 00000004.00000002.3579777365.00003AB000790000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3582733231.00003AB000F28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3504021888.00003AB00050C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000004.00000003.3259512403.00003AB0004A0000.00000004.00000800.00020000.00000000.sdmp, manifest.json.19.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: chrome.exe, 00000004.00000003.3259512403.00003AB0004A0000.00000004.00000800.00020000.00000000.sdmp, manifest.json.19.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: chrome.exe, 00000004.00000003.3259512403.00003AB0004A0000.00000004.00000800.00020000.00000000.sdmp, manifest.json.19.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: chrome.exe, 00000004.00000002.3503150363.00003AB00031C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-2.corp
Source: chrome.exe, 00000004.00000003.3259512403.00003AB0004A0000.00000004.00000800.00020000.00000000.sdmp, manifest.json.19.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: chrome.exe, 00000004.00000002.3503150363.00003AB00031C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-3.corp.googl
Source: chrome.exe, 00000004.00000003.3259512403.00003AB0004A0000.00000004.00000800.00020000.00000000.sdmp, manifest.json.19.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: chrome.exe, 00000004.00000002.3503150363.00003AB00031C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-4.c
Source: chrome.exe, 00000004.00000003.3259512403.00003AB0004A0000.00000004.00000800.00020000.00000000.sdmp, manifest.json.19.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: chrome.exe, 00000004.00000002.3503150363.00003AB00031C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-5.corp.go
Source: chrome.exe, 00000004.00000003.3259512403.00003AB0004A0000.00000004.00000800.00020000.00000000.sdmp, manifest.json.19.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: chrome.exe, 00000004.00000003.3259512403.00003AB0004A0000.00000004.00000800.00020000.00000000.sdmp, manifest.json.19.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: chrome.exe, 00000004.00000003.3259512403.00003AB0004A0000.00000004.00000800.00020000.00000000.sdmp, manifest.json.19.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: chrome.exe, 00000004.00000003.3259512403.00003AB0004A0000.00000004.00000800.00020000.00000000.sdmp, manifest.json.19.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: chrome.exe, 00000004.00000003.3276797484.00003AB00120C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-thirdparty.googleusercontent.com/32/type/
Source: chrome.exe, 00000004.00000003.3259512403.00003AB0004A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp, manifest.json.19.dr	String found in binary or memory: https://drive.google.com/
Source: chrome.exe, 00000004.00000002.3581268835.00003AB000BD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3503462580.00003AB0003D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/:
Source: chrome.exe, 00000004.00000002.3582633647.00003AB000EE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581268835.00003AB000BD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3503462580.00003AB0003D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3582038478.00003AB000D88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/?lfhs=2
Source: chrome.exe, 00000004.00000002.3582038478.00003AB000D88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/?lfhs=2ation.Result
Source: chrome.exe, 00000004.00000002.3582038478.00003AB000D88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/?lfhs=2d
Source: chrome.exe, 00000004.00000002.3581268835.00003AB000BD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3503462580.00003AB0003D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/J
Source: chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/ces
Source: chrome.exe, 00000004.00000002.3581268835.00003AB000BD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3503462580.00003AB0003D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3583113361.00003AB0010D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/drive/installwebapp?usp=chrome_default
Source: chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/l
Source: chrome.exe, 00000004.00000002.3579550651.00003AB000708000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581347083.00003AB000C1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?q=
Source: chrome.exe, 00000004.00000002.3579550651.00003AB000708000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?q=searchTerms
Source: chrome.exe, 00000004.00000002.3579829103.00003AB0007C0000.00000004.00000800.00020000.00000000.sdmp, hlfctr.0.dr, Web Data.8.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: q3na5Mc.exe, 00000000.00000002.4597844870.00000000058E1000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581347083.00003AB000C1C000.00000004.00000800.00020000.00000000.sdmp, hlfctr.0.dr, Web Data.8.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: chrome.exe, 00000004.00000002.3581347083.00003AB000C1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.ico
Source: q3na5Mc.exe, 00000000.00000002.4597844870.00000000058E1000.00000004.00000020.00020000.00000000.sdmp, hlfctr.0.dr, Web Data.8.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chrome.exe, 00000004.00000002.3581347083.00003AB000C1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icondTripTime
Source: 000003.log6.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: e2c7390e-112e-4a39-9b3f-8b86779ae1c2.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_hc.png/1.2.1/asset
Source: e2c7390e-112e-4a39-9b3f-8b86779ae1c2.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_dark.png/1.2.1/ass
Source: e2c7390e-112e-4a39-9b3f-8b86779ae1c2.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/as
Source: e2c7390e-112e-4a39-9b3f-8b86779ae1c2.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.1.17/asset
Source: e2c7390e-112e-4a39-9b3f-8b86779ae1c2.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.6.8/asset
Source: e2c7390e-112e-4a39-9b3f-8b86779ae1c2.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.1.17/asset
Source: e2c7390e-112e-4a39-9b3f-8b86779ae1c2.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.6.8/asset
Source: e2c7390e-112e-4a39-9b3f-8b86779ae1c2.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.1.17/asset
Source: e2c7390e-112e-4a39-9b3f-8b86779ae1c2.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.6.8/asset
Source: e2c7390e-112e-4a39-9b3f-8b86779ae1c2.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_hc.png/0.1.3/asset
Source: e2c7390e-112e-4a39-9b3f-8b86779ae1c2.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_dark.png/0.1.3/asset
Source: e2c7390e-112e-4a39-9b3f-8b86779ae1c2.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_light.png/0.1.3/asset
Source: e2c7390e-112e-4a39-9b3f-8b86779ae1c2.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_hc.png/1.3.6/asset
Source: e2c7390e-112e-4a39-9b3f-8b86779ae1c2.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_dark.png/1.3.6/asset
Source: e2c7390e-112e-4a39-9b3f-8b86779ae1c2.tmp.19.dr, HubApps Icons.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: e2c7390e-112e-4a39-9b3f-8b86779ae1c2.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.4.0/asset
Source: e2c7390e-112e-4a39-9b3f-8b86779ae1c2.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.5.13/asset
Source: e2c7390e-112e-4a39-9b3f-8b86779ae1c2.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.4.0/asset
Source: e2c7390e-112e-4a39-9b3f-8b86779ae1c2.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.4.0/asset
Source: e2c7390e-112e-4a39-9b3f-8b86779ae1c2.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_hc.png/1.4.0/asset
Source: e2c7390e-112e-4a39-9b3f-8b86779ae1c2.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_dark.png/1.4.0/asset
Source: e2c7390e-112e-4a39-9b3f-8b86779ae1c2.tmp.19.dr, HubApps Icons.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
Source: chrome.exe, 00000004.00000002.3501484661.000018D400920000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/
Source: chrome.exe, 00000004.00000003.3251626376.000018D400728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3250867146.000018D40071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3501652240.000018D400974000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/2J
Source: chrome.exe, 00000004.00000002.3501484661.000018D400920000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/
Source: chrome.exe, 00000004.00000003.3251626376.000018D400728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3250867146.000018D40071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3501652240.000018D400974000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/2P
Source: msedge.exe, 00000012.00000002.3816792873.00006604002D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: chrome.exe, 00000004.00000002.3502674319.00003AB0001D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/googleapis.com
Source: chrome.exe, 00000004.00000002.3579334333.00003AB000648000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://googleusercontent.com/
Source: 2cc80dabc69f58b6_1.8.dr, 4cb013792b196a35_1.19.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/
Source: 2cc80dabc69f58b6_1.8.dr, 4cb013792b196a35_1.19.dr	String found in binary or memory: https://img-s.msn.cn/tenant/amp/entityid/
Source: 4wbi5x.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/161903006
Source: msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/166809097
Source: msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/184850002
Source: msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/187425444
Source: msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/220069903
Source: msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/229267970
Source: msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/250706693
Source: msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/253522366
Source: msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/255411748
Source: msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/258207403
Source: msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/274859104
Source: msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/284462263
Source: msedge.exe, 00000012.00000003.3702422414.000066040040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: chrome.exe, 00000004.00000002.3581323833.00003AB000C0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/issues/166475273B
Source: chrome.exe, 00000004.00000002.3503920437.00003AB0004DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3582446786.00003AB000E78000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3579829103.00003AB0007C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3579912007.00003AB00080C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTE
Source: chrome.exe, 00000004.00000002.3503920437.00003AB0004DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3582446786.00003AB000E78000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3579829103.00003AB0007C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3579912007.00003AB00080C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTEkly
Source: chrome.exe, 00000004.00000003.3285592860.00003AB000F90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/
Source: chrome.exe, 00000004.00000002.3501652240.000018D400974000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2
Source: chrome.exe, 00000004.00000002.3500120177.000018D400237000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3579912007.00003AB00080C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard
Source: chrome.exe, 00000004.00000003.3251626376.000018D400728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3250867146.000018D40071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3501652240.000018D400974000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard2
Source: chrome.exe, 00000004.00000003.3251626376.000018D400728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3250867146.000018D40071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3501652240.000018D400974000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardb
Source: chrome.exe, 00000004.00000002.3501419610.000018D400904000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardhttps://labs.google.com/search/experiments
Source: chrome.exe, 00000004.00000002.3501652240.000018D400974000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiments
Source: chrome.exe, 00000004.00000002.3503675450.00003AB00040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3288256451.00003AB001468000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3290750715.00003AB001490000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search?source=ntp
Source: chrome.exe, 00000004.00000003.3276543792.00003AB00043C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3276735182.00003AB001174000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3276797484.00003AB00120C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/upload
Source: chrome.exe, 00000004.00000003.3276543792.00003AB00043C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3276735182.00003AB001174000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3276797484.00003AB00120C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/uploadbyurl
Source: chrome.exe, 00000004.00000003.3251626376.000018D400728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3250867146.000018D40071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3501652240.000018D400974000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/2
Source: chrome.exe, 00000004.00000003.3255081140.000018D400878000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3501385854.000018D4008D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3276797484.00003AB00120C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload
Source: chrome.exe, 00000004.00000002.3501652240.000018D400974000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload2
Source: chrome.exe, 00000004.00000002.3501484661.000018D400920000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116Plus
Source: chrome.exe, 00000004.00000002.3501484661.000018D400920000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116PlusEnabled_UnPinned_NewTab_20230918=
Source: chrome.exe, 00000004.00000002.3501385854.000018D4008D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/uploadcompanion-iph-blocklisted-page-urlsexps-registration-success-page-u
Source: chrome.exe, 00000004.00000003.3258612701.00003AB0001E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3502674319.00003AB0001D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://m.google.com/devicemanagement/data/api
Source: chrome.exe, 00000004.00000003.3258612701.00003AB0001E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://m.google.com/devicemanagement/data/api:
Source: chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/
Source: chrome.exe, 00000004.00000002.3503462580.00003AB0003D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3582682112.00003AB000F14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3502580131.00003AB0001AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/:
Source: chrome.exe, 00000004.00000003.3285592860.00003AB000F90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?tab
Source: chrome.exe, 00000004.00000002.3503675450.00003AB00040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3288256451.00003AB001468000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3290750715.00003AB001490000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?tab=rm&ogbl
Source: chrome.exe, 00000004.00000002.3503462580.00003AB0003D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3582446786.00003AB000E78000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3582682112.00003AB000F14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3583113361.00003AB0010D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3579912007.00003AB00080C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?usp=installed_webapp
Source: chrome.exe, 00000004.00000002.3579912007.00003AB00080C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?usp=installed_webappP
Source: chrome.exe, 00000004.00000002.3503462580.00003AB0003D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3582682112.00003AB000F14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3502580131.00003AB0001AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/J
Source: chrome.exe, 00000004.00000002.3503462580.00003AB0003D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3582682112.00003AB000F14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3583113361.00003AB0010D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3502580131.00003AB0001AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/installwebapp?usp=chrome_default
Source: msedge.exe, 00000012.00000002.3816792873.00006604002D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://msn.cn/
Source: q3na5Mc.exe, 00000000.00000002.4596210527.000000000534F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://msn.com
Source: msedge.exe, 00000012.00000002.3816792873.00006604002D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://msn.com/
Source: msedge.exe, 00000010.00000002.3659328497.000024FC00310000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://msn.com/Y
Source: chrome.exe, 00000004.00000002.3579777365.00003AB000790000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3582733231.00003AB000F28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3504021888.00003AB00050C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/?utm_source=ga-chrome-actions&utm_medium=manageGA
Source: chrome.exe, 00000004.00000002.3503881432.00003AB0004C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3580550646.00003AB00097C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3579749580.00003AB000778000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3501889604.00003AB000064000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacy
Source: chrome.exe, 00000004.00000002.3503881432.00003AB0004C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3579749580.00003AB000778000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhone
Source: chrome.exe, 00000004.00000002.3579749580.00003AB000778000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhonece
Source: chrome.exe, 00000004.00000002.3580550646.00003AB00097C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3579749580.00003AB000778000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/signinoptions/password?utm_source=ga-chrome-actions&utm_medium=changePW
Source: chrome.exe, 00000004.00000002.3580581676.00003AB0009AB000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3580839622.00003AB000A54000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3270513570.00003AB000EF8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myactivity.google.com/
Source: 2cc80dabc69f58b6_1.8.dr, 4cb013792b196a35_1.19.dr	String found in binary or memory: https://ntp.msn.cn/edge/ntp
Source: 000003.log.8.dr, 2cc80dabc69f58b6_0.8.dr, 4cb013792b196a35_0.19.dr	String found in binary or memory: https://ntp.msn.com
Source: 000003.log0.8.dr, 000003.log5.8.dr	String found in binary or memory: https://ntp.msn.com/
Source: 2cc80dabc69f58b6_1.8.dr, 4cb013792b196a35_1.19.dr, 000003.log5.8.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp
Source: 2cc80dabc69f58b6_1.8.dr, 4cb013792b196a35_1.19.dr, 000003.log5.8.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288
Source: Session_13385636111859796.19.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&startpage=1&PC=U531
Source: chrome.exe, 00000004.00000002.3502674319.00003AB0001D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oauthaccountmanager.googleapis.com/
Source: chrome.exe, 00000004.00000002.3502750181.00003AB00020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oauthaccountmanager.googleapis.com/v1/issuetoken
Source: msedge.exe, 00000012.00000002.3816792873.00006604002D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://office.net/
Source: chrome.exe, 00000004.00000003.3289642313.00003AB0013E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3290750715.00003AB001490000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogads-pa.googleapis.com
Source: chrome.exe, 00000004.00000002.3501773286.00003AB000020000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com
Source: chrome.exe, 00000004.00000003.3289642313.00003AB0013E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3290750715.00003AB001490000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com/widget/app/so?eom=1
Source: chrome.exe, 00000004.00000003.3289642313.00003AB0013E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3290750715.00003AB001490000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com/widget/callout?eom=1
Source: chrome.exe, 00000004.00000002.3582923202.00003AB000FDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3268421635.00003AB0006EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3582984825.00003AB000FE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3276119827.00003AB000FDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3582108781.00003AB000DC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1&target=OPTIMIZATION_TARGET_PAGE_TOPICS_
Source: chrome.exe, 00000004.00000002.3582923202.00003AB000FDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3268421635.00003AB0006EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3582984825.00003AB000FE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3276119827.00003AB000FDC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1673999601&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000004.00000002.3582923202.00003AB000FDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3268421635.00003AB0006EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3582984825.00003AB000FE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3276119827.00003AB000FDC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1678906374&target=OPTIMIZATION_TARGET_OMN
Source: chrome.exe, 00000004.00000002.3582923202.00003AB000FDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3276119827.00003AB000FDC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1679317318&target=OPTIMIZATION_TARGET_LAN
Source: chrome.exe, 00000004.00000002.3582923202.00003AB000FDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3268421635.00003AB0006EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3582984825.00003AB000FE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3276119827.00003AB000FDC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049402&target=OPTIMIZATION_TARGET_GEO
Source: chrome.exe, 00000004.00000002.3582923202.00003AB000FDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3268421635.00003AB0006EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3582984825.00003AB000FE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3276119827.00003AB000FDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3503005351.00003AB0002D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049414&target=OPTIMIZATION_TARGET_NOT
Source: chrome.exe, 00000004.00000002.3582923202.00003AB000FDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3268421635.00003AB0006EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3582984825.00003AB000FE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3276119827.00003AB000FDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3582108781.00003AB000DC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695051229&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000004.00000002.3582923202.00003AB000FDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3268421635.00003AB0006EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3582984825.00003AB000FE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3276119827.00003AB000FDC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=210230727&target=OPTIMIZATION_TARGET_CLIE
Source: chrome.exe, 00000004.00000002.3503920437.00003AB0004DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/v1:GetHints
Source: msedge.exe, 00000007.00000003.3419225900.00001D9400270000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.3419311581.00001D9400278000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000010.00000003.3601306311.000024FC0027C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000010.00000003.3601000119.000024FC00278000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3700497393.000066040026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3700312229.0000660400268000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/AddSession
Source: msedge.exe, 00000007.00000003.3419225900.00001D9400270000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.3419311581.00001D9400278000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000010.00000003.3601306311.000024FC0027C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000010.00000003.3601000119.000024FC00278000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3700497393.000066040026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3700312229.0000660400268000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/Logout
Source: msedge.exe, 00000010.00000003.3601306311.000024FC0027C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000010.00000003.3601000119.000024FC00278000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3700497393.000066040026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3700312229.0000660400268000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/LogoutYxAB
Source: msedge.exe, 00000007.00000003.3419225900.00001D9400270000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.3419311581.00001D9400278000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/LogoutYxABzen
Source: msedge.exe, 00000007.00000003.3419225900.00001D9400270000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.3419311581.00001D9400278000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000010.00000003.3601306311.000024FC0027C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000010.00000003.3601000119.000024FC00278000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3700497393.000066040026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3700312229.0000660400268000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/MergeSession
Source: msedge.exe, 00000007.00000003.3419225900.00001D9400270000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.3419311581.00001D9400278000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000010.00000003.3601306311.000024FC0027C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000010.00000003.3601000119.000024FC00278000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3700497393.000066040026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3700312229.0000660400268000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/OAuthLogin
Source: msedge.exe, 00000007.00000003.3419225900.00001D9400270000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.3419311581.00001D9400278000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000010.00000003.3601306311.000024FC0027C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000010.00000003.3601000119.000024FC00278000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3700497393.000066040026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3700312229.0000660400268000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/RotateBoundCookies
Source: msedge.exe, 00000007.00000003.3419225900.00001D9400270000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.3419311581.00001D9400278000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000010.00000003.3601306311.000024FC0027C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000010.00000003.3601000119.000024FC00278000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3700497393.000066040026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3700312229.0000660400268000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/chrome/blank.html
Source: msedge.exe, 00000010.00000003.3601306311.000024FC0027C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000010.00000003.3601000119.000024FC00278000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/chrome/blank.html$
Source: msedge.exe, 00000007.00000003.3419225900.00001D9400270000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.3419311581.00001D9400278000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000010.00000003.3601306311.000024FC0027C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000010.00000003.3601000119.000024FC00278000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3700497393.000066040026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3700312229.0000660400268000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/o/oauth2/revoke
Source: msedge.exe, 00000007.00000003.3419225900.00001D9400270000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.3419311581.00001D9400278000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000010.00000003.3601306311.000024FC0027C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000010.00000003.3601000119.000024FC00278000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3700497393.000066040026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3700312229.0000660400268000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth/multilogin
Source: msedge.exe, 00000007.00000003.3419225900.00001D9400270000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.3419311581.00001D9400278000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000010.00000003.3601306311.000024FC0027C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000010.00000003.3601000119.000024FC00278000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3700497393.000066040026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3700312229.0000660400268000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v1/userinfo
Source: msedge.exe, 00000007.00000003.3419225900.00001D9400270000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.3419311581.00001D9400278000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000010.00000003.3601306311.000024FC0027C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000010.00000003.3601000119.000024FC00278000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3700497393.000066040026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3700312229.0000660400268000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v2/tokeninfo
Source: msedge.exe, 00000007.00000003.3419225900.00001D9400270000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.3419311581.00001D9400278000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000010.00000003.3601306311.000024FC0027C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000010.00000003.3601000119.000024FC00278000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3700497393.000066040026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3700312229.0000660400268000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v4/token
Source: msedge.exe, 00000007.00000003.3419225900.00001D9400270000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.3419311581.00001D9400278000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000010.00000003.3601306311.000024FC0027C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000010.00000003.3601000119.000024FC00278000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3700497393.000066040026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3700312229.0000660400268000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/reauth/v1beta/users/
Source: msedge.exe, 00000007.00000003.3419225900.00001D9400270000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.3419311581.00001D9400278000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000010.00000003.3601306311.000024FC0027C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000010.00000003.3601000119.000024FC00278000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3700497393.000066040026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000012.00000003.3700312229.0000660400268000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/v1/issuetoken
Source: chrome.exe, 00000004.00000002.3580581676.00003AB0009AB000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3580839622.00003AB000A54000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3270513570.00003AB000EF8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.google.com/settings?referrer=CHROME_NTP
Source: chrome.exe, 00000004.00000003.3276543792.00003AB00043C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3276735182.00003AB001174000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3276198376.00003AB000E1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3276797484.00003AB00120C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.google.com?referrer=CHROME_NTP
Source: chrome.exe, 00000004.00000002.3582108781.00003AB000DC6000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3579912007.00003AB00080C000.00000004.00000800.00020000.00000000.sdmp, chromecache_485.6.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chrome.exe, 00000004.00000002.3501889604.00003AB000064000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3579912007.00003AB00080C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true:
Source: chrome.exe, 00000004.00000002.3580839622.00003AB000A54000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3270513570.00003AB000EF8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://policies.google.com/
Source: chrome.exe, 00000004.00000002.3580897182.00003AB000A8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditing
Source: 2cc80dabc69f58b6_1.8.dr, 4cb013792b196a35_1.19.dr	String found in binary or memory: https://sb.scorecardresearch.com/
Source: chrome.exe, 00000004.00000002.3580897182.00003AB000A8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sctauditing-pa.googleapis.com/v1/knownscts/length/$1/prefix/$2?key=AIzaSyBOti4mM-6x9WDnZIjIe
Source: chrome.exe, 00000004.00000002.3502674319.00003AB0001D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://securitydomain-pa.googleapis.com/v1/
Source: chrome.exe, 00000004.00000002.3503920437.00003AB0004DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3582446786.00003AB000E78000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3579829103.00003AB0007C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3579912007.00003AB00080C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000004.00000002.3503920437.00003AB0004DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3582446786.00003AB000E78000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3579829103.00003AB0007C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3579912007.00003AB00080C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actionsactions
Source: 2cc80dabc69f58b6_1.8.dr, 4cb013792b196a35_1.19.dr	String found in binary or memory: https://srtb.msn.cn/
Source: 2cc80dabc69f58b6_1.8.dr, 4cb013792b196a35_1.19.dr	String found in binary or memory: https://srtb.msn.com/
Source: chrome.exe, 00000004.00000003.3287922417.00003AB0012E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: chrome.exe, 00000004.00000002.3503675450.00003AB00040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3288256451.00003AB001468000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3290750715.00003AB001490000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com/gb/images/bar/al-icon.png
Source: q3na5Mc.exe, q3na5Mc.exe, 00000000.00000002.4576871792.0000000000401000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199829660832
Source: q3na5Mc.exe, 00000000.00000002.4576871792.0000000000401000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199829660832ir7amMozilla/5.0
Source: q3na5Mc.exe, 00000000.00000003.2209213432.0000000000A62000.00000004.00000020.00020000.00000000.sdmp, q3na5Mc.exe, 00000000.00000003.2517792878.0000000000AB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://su.t.goldenloafuae.com
Source: q3na5Mc.exe, 00000000.00000003.2517792878.0000000000AB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://su.t.goldenloafuae.com&
Source: q3na5Mc.exe, 00000000.00000003.2517806861.0000000000A96000.00000004.00000020.00020000.00000000.sdmp, q3na5Mc.exe, 00000000.00000003.2209213432.0000000000A62000.00000004.00000020.00020000.00000000.sdmp, q3na5Mc.exe, 00000000.00000002.4578351064.0000000000A46000.00000004.00000020.00020000.00000000.sdmp, q3na5Mc.exe, 00000000.00000002.4597844870.00000000059BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://su.t.goldenloafuae.com/
Source: q3na5Mc.exe, 00000000.00000003.2230766451.0000000000A62000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://su.t.goldenloafuae.com/0
Source: q3na5Mc.exe, 00000000.00000003.2118251227.0000000000A72000.00000004.00000020.00020000.00000000.sdmp, q3na5Mc.exe, 00000000.00000003.2156986213.0000000000A62000.00000004.00000020.00020000.00000000.sdmp, q3na5Mc.exe, 00000000.00000003.2134288874.0000000000A75000.00000004.00000020.00020000.00000000.sdmp, q3na5Mc.exe, 00000000.00000003.2230766451.0000000000A62000.00000004.00000020.00020000.00000000.sdmp, q3na5Mc.exe, 00000000.00000003.2209213432.0000000000A62000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://su.t.goldenloafuae.com/?
Source: q3na5Mc.exe, 00000000.00000003.2118251227.0000000000A72000.00000004.00000020.00020000.00000000.sdmp, q3na5Mc.exe, 00000000.00000003.2134288874.0000000000A75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://su.t.goldenloafuae.com/K
Source: q3na5Mc.exe, 00000000.00000003.2230766451.0000000000A62000.00000004.00000020.00020000.00000000.sdmp, q3na5Mc.exe, 00000000.00000003.2517806861.0000000000A96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://su.t.goldenloafuae.com/Y
Source: q3na5Mc.exe, 00000000.00000002.4578351064.0000000000A62000.00000004.00000020.00020000.00000000.sdmp, q3na5Mc.exe, 00000000.00000003.2517806861.0000000000A96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://su.t.goldenloafuae.com/ft
Source: q3na5Mc.exe, 00000000.00000002.4578351064.0000000000A62000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://su.t.goldenloafuae.com/t
Source: q3na5Mc.exe, 00000000.00000003.2156986213.0000000000A62000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://su.t.goldenloafuae.com/v
Source: q3na5Mc.exe, 00000000.00000003.2517806861.0000000000A96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://su.t.goldenloafuae.com0
Source: q3na5Mc.exe, 00000000.00000003.2517806861.0000000000A96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://su.t.goldenloafuae.com5
Source: q3na5Mc.exe, 00000000.00000003.2118251227.0000000000A72000.00000004.00000020.00020000.00000000.sdmp, q3na5Mc.exe, 00000000.00000003.2134288874.0000000000A75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://su.t.goldenloafuae.comv
Source: q3na5Mc.exe, 00000000.00000002.4602143361.0000000005E21000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: q3na5Mc.exe, 00000000.00000002.4602143361.0000000005E21000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: q3na5Mc.exe, 00000000.00000002.4578351064.0000000000A2F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/
Source: q3na5Mc.exe, 00000000.00000002.4578351064.0000000000A2F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/kK
Source: q3na5Mc.exe, 00000000.00000003.2090186319.0000000000A76000.00000004.00000020.00020000.00000000.sdmp, q3na5Mc.exe, 00000000.00000003.2118251227.0000000000A72000.00000004.00000020.00020000.00000000.sdmp, q3na5Mc.exe, 00000000.00000002.4576871792.0000000000401000.00000040.00000001.01000000.00000003.sdmp, q3na5Mc.exe, 00000000.00000002.4578351064.0000000000A62000.00000004.00000020.00020000.00000000.sdmp, q3na5Mc.exe, 00000000.00000003.2118289142.0000000000A62000.00000004.00000020.00020000.00000000.sdmp, q3na5Mc.exe, 00000000.00000003.2156986213.0000000000A62000.00000004.00000020.00020000.00000000.sdmp, q3na5Mc.exe, 00000000.00000003.2230766451.0000000000A62000.00000004.00000020.00020000.00000000.sdmp, q3na5Mc.exe, 00000000.00000003.2134344430.0000000000A62000.00000004.00000020.00020000.00000000.sdmp, q3na5Mc.exe, 00000000.00000003.2156986213.0000000000A4E000.00000004.00000020.00020000.00000000.sdmp, q3na5Mc.exe, 00000000.00000003.2118289142.0000000000A4E000.00000004.00000020.00020000.00000000.sdmp, q3na5Mc.exe, 00000000.00000003.2230766451.0000000000A4E000.00000004.00000020.00020000.00000000.sdmp, q3na5Mc.exe, 00000000.00000003.2090161371.0000000000AB1000.00000004.00000020.00020000.00000000.sdmp, q3na5Mc.exe, 00000000.00000003.2134344430.0000000000A4E000.00000004.00000020.00020000.00000000.sdmp, q3na5Mc.exe, 00000000.00000003.2209213432.0000000000A62000.00000004.00000020.00020000.00000000.sdmp, q3na5Mc.exe, 00000000.00000002.4578351064.0000000000A46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/l793oy
Source: q3na5Mc.exe, 00000000.00000003.2209213432.0000000000A4E000.00000004.00000020.00020000.00000000.sdmp, q3na5Mc.exe, 00000000.00000003.2156986213.0000000000A4E000.00000004.00000020.00020000.00000000.sdmp, q3na5Mc.exe, 00000000.00000003.2118289142.0000000000A4E000.00000004.00000020.00020000.00000000.sdmp, q3na5Mc.exe, 00000000.00000003.2230766451.0000000000A4E000.00000004.00000020.00020000.00000000.sdmp, q3na5Mc.exe, 00000000.00000003.2134344430.0000000000A4E000.00000004.00000020.00020000.00000000.sdmp, q3na5Mc.exe, 00000000.00000002.4578351064.0000000000A46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/l793oyOab
Source: q3na5Mc.exe, 00000000.00000002.4576871792.0000000000401000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://t.me/l793oyir7amMozilla/5.0
Source: chrome.exe, 00000004.00000002.3580751625.00003AB000A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://t0.gstatic.com/faviconV2
Source: chrome.exe, 00000004.00000002.3502674319.00003AB0001D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tasks.googleapis.com/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.8.dr	String found in binary or memory: https://unitedstates1.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.8.dr	String found in binary or memory: https://unitedstates2.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.8.dr	String found in binary or memory: https://unitedstates4.ss.wd.microsoft.us/
Source: q3na5Mc.exe, 00000000.00000003.2090186319.0000000000A76000.00000004.00000020.00020000.00000000.sdmp, q3na5Mc.exe, 00000000.00000002.4578351064.0000000000A62000.00000004.00000020.00020000.00000000.sdmp, q3na5Mc.exe, 00000000.00000003.2118289142.0000000000A62000.00000004.00000020.00020000.00000000.sdmp, q3na5Mc.exe, 00000000.00000003.2156986213.0000000000A62000.00000004.00000020.00020000.00000000.sdmp, q3na5Mc.exe, 00000000.00000003.2230766451.0000000000A62000.00000004.00000020.00020000.00000000.sdmp, q3na5Mc.exe, 00000000.00000003.2134344430.0000000000A62000.00000004.00000020.00020000.00000000.sdmp, q3na5Mc.exe, 00000000.00000003.2090161371.0000000000AB1000.00000004.00000020.00020000.00000000.sdmp, q3na5Mc.exe, 00000000.00000003.2209213432.0000000000A62000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://web.telegram.org
Source: q3na5Mc.exe, 00000000.00000002.4578351064.0000000000A62000.00000004.00000020.00020000.00000000.sdmp, 4wbi5x.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: q3na5Mc.exe, 00000000.00000002.4578351064.0000000000A62000.00000004.00000020.00020000.00000000.sdmp, 4wbi5x.0.dr	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: q3na5Mc.exe, 00000000.00000002.4597844870.00000000058E1000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581268835.00003AB000BD0000.00000004.00000800.00020000.00000000.sdmp, hlfctr.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: chrome.exe, 00000004.00000002.3581323833.00003AB000C0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=
Source: chrome.exe, 00000004.00000002.3581323833.00003AB000C0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearch
Source: chrome.exe, 00000004.00000002.3581323833.00003AB000C0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearchn=opensearch
Source: chrome.exe, 00000004.00000003.3277983527.00003AB0002A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3287922417.00003AB0012E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com
Source: chrome.exe, 00000004.00000003.3277983527.00003AB0002A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3287922417.00003AB0012E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: chrome.exe, 00000004.00000003.3287922417.00003AB0012E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: chrome.exe, 00000004.00000003.3276436585.00003AB000CE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3580811175.00003AB000A40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3270513570.00003AB000EF8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: chrome.exe, 00000004.00000002.3581268835.00003AB000BD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/Char
Source: chrome.exe, 00000004.00000002.3579948014.00003AB00081C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/Char(l3
Source: chrome.exe, 00000004.00000002.3582446786.00003AB000E78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/async/ddljson?async=ntp:2
Source: chrome.exe, 00000004.00000002.3583358123.00003AB001164000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/async/newtab_promos
Source: chrome.exe, 00000004.00000002.3579402928.00003AB00069C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3580550646.00003AB00097C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3502674319.00003AB0001D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3579948014.00003AB00081C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/tips/
Source: chrome.exe, 00000004.00000002.3580550646.00003AB00097C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3502674319.00003AB0001D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3579948014.00003AB00081C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/tips/gs
Source: chrome.exe, 00000004.00000002.3579402928.00003AB00069C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/tips/gs8~b
Source: q3na5Mc.exe, 00000000.00000002.4597844870.00000000058E1000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3579166261.00003AB0005D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3579777365.00003AB000790000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581156256.00003AB000B80000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3504021888.00003AB00050C000.00000004.00000800.00020000.00000000.sdmp, hlfctr.0.dr, Web Data.8.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chrome.exe, 00000004.00000003.3285592860.00003AB000F90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/imghp?hl
Source: chrome.exe, 00000004.00000002.3503675450.00003AB00040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3288256451.00003AB001468000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3290750715.00003AB001490000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/imghp?hl=en&tab=ri&ogbl
Source: chrome.exe, 00000004.00000003.3290750715.00003AB001490000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/intl/en/about/products?tab=rh
Source: chrome.exe, 00000004.00000003.3276797484.00003AB00120C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?q=$
Source: chrome.exe, 00000004.00000002.3503920437.00003AB0004DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/tools/feedback/chrome/__submit
Source: chrome.exe, 00000004.00000002.3580811175.00003AB000A40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/undo
Source: chrome.exe, 00000004.00000003.3277983527.00003AB0002A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.comAccess-Control-Allow-Credentials:
Source: chrome.exe, 00000004.00000002.3501773286.00003AB000020000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/
Source: chrome.exe, 00000004.00000002.3502750181.00003AB00020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v1/userinfo
Source: chrome.exe, 00000004.00000002.3502750181.00003AB00020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v2/tokeninfo
Source: chrome.exe, 00000004.00000002.3502750181.00003AB00020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v4/token
Source: chrome.exe, 00000004.00000002.3502750181.00003AB00020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/reauth/v1beta/users/
Source: chrome.exe, 00000004.00000003.3287922417.00003AB0012E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: chrome.exe, 00000004.00000003.3287922417.00003AB0012E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com
Source: chrome.exe, 00000004.00000002.3503920437.00003AB0004DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/chrome/intelligence/assist/ranker/models/translate/2017/03/translate_ranker_
Source: chrome.exe, 00000004.00000003.3290750715.00003AB001490000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/1x/broken_image_grey600_18dp.png
Source: chrome.exe, 00000004.00000003.3288827294.00003AB001450000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3583841365.00003AB00140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3290584710.00003AB0013B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3290283437.00003AB00139C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3290750715.00003AB001490000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/2x/broken_image_grey600_18dp.png
Source: chrome.exe, 00000004.00000002.3502274497.00003AB00011C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/og/_/js/k=og.qtm.en_US.WcyoQrvsWY0.2019.O/rt=j/m=q_dnp
Source: chrome.exe, 00000004.00000003.3289642313.00003AB0013E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.3290750715.00003AB001490000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/og/_/ss/k=og.qtm.L8bgMGq1rcI.L.W.O/m=qmd
Source: q3na5Mc.exe, 00000000.00000002.4602143361.0000000005E21000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: q3na5Mc.exe, 00000000.00000002.4602143361.0000000005E21000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: q3na5Mc.exe, 00000000.00000002.4602143361.0000000005E21000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: q3na5Mc.exe, 00000000.00000002.4602143361.0000000005E21000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: q3na5Mc.exe, 00000000.00000002.4602143361.0000000005E21000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: q3na5Mc.exe, 00000000.00000002.4602143361.0000000005E21000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: 2cc80dabc69f58b6_1.8.dr, 4cb013792b196a35_1.19.dr	String found in binary or memory: https://www.msn.com/web-notification-icon-light.png
Source: chrome.exe, 00000004.00000002.3581428750.00003AB000C50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: chrome.exe, 00000004.00000002.3503462580.00003AB0003D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/:
Source: chrome.exe, 00000004.00000002.3582633647.00003AB000EE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3503462580.00003AB0003D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3502674319.00003AB0001D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3582340113.00003AB000E38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/?feature=ytca
Source: chrome.exe, 00000004.00000002.3502674319.00003AB0001D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/?feature=ytca:
Source: chrome.exe, 00000004.00000002.3582340113.00003AB000E38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/?feature=ytcaogl:
Source: chrome.exe, 00000004.00000002.3503462580.00003AB0003D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/J
Source: chrome.exe, 00000004.00000002.3502240241.00003AB00010C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3503462580.00003AB0003D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.3581814165.00003AB000D20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html
Source: chrome.exe, 00000004.00000002.3581814165.00003AB000D20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.htmllt

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50175
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50174
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50179
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50178
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50131 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50154 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50182
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50181
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50184
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50183
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50234 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50125 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50194 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50148 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50165 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50186
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50185
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50188
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50187
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50189
Source: unknown	Network traffic detected: HTTP traffic on port 50205 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50183 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50191
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50190
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50193
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 50159 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50192
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50195
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50194
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50120 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50227 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50195 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50147 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50172 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50196
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 50189 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50130 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 50119 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50142 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50241 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50136 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50178 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50153 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50139
Source: unknown	Network traffic detected: HTTP traffic on port 50170 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50138
Source: unknown	Network traffic detected: HTTP traffic on port 50193 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50149 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50131
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50130
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50133
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50132
Source: unknown	Network traffic detected: HTTP traffic on port 50187 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50137
Source: unknown	Network traffic detected: HTTP traffic on port 50221 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50136
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50161 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50140
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 50144 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50149
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50142
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50141
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50144
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50143
Source: unknown	Network traffic detected: HTTP traffic on port 50247 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50146
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50145
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50148
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50147
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50151
Source: unknown	Network traffic detected: HTTP traffic on port 50138 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50150
Source: unknown	Network traffic detected: HTTP traffic on port 50155 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50103 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50166 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50143 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50153
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50152
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50155
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50154
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50157
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50156
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50159
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50158
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50182 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50160
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 50137 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50162
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50161
Source: unknown	Network traffic detected: HTTP traffic on port 50236 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 50121 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50203 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50164
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50163
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50166
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 50115 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50165
Source: unknown	Network traffic detected: HTTP traffic on port 50188 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50168
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50046
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50049
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50169
Source: unknown	Network traffic detected: HTTP traffic on port 50109 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50132 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50050
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50160 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50170
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50173
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50051
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50172
Source: unknown	Network traffic detected: HTTP traffic on port 50044 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50126 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 50214 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50145 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50168 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50218
Source: unknown	Network traffic detected: HTTP traffic on port 50122 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50217
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50219
Source: unknown	Network traffic detected: HTTP traffic on port 50042 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50174 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50139 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50151 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50212
Source: unknown	Network traffic detected: HTTP traffic on port 50225 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50202 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50214
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50213
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50219 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50227
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50229
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 50186 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50221
Source: unknown	Network traffic detected: HTTP traffic on port 50077 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50223
Source: unknown	Network traffic detected: HTTP traffic on port 50243 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50225
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50053 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50162 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50237 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50238
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50237
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50119
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50118
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50239
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50232
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50234
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50233
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50115
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50236
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 50133 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50156 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50043 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50175 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50213 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50232 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50249
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 50249 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50192 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50120
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50241
Source: unknown	Network traffic detected: HTTP traffic on port 50054 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50122
Source: unknown	Network traffic detected: HTTP traffic on port 50150 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50243
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50121
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50124
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50245
Source: unknown	Network traffic detected: HTTP traffic on port 50111 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50123
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50126
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50247
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50125
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50181 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50218 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50229 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50164 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50097
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50112 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50075 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50158 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50238 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50052 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50184 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50169 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50064 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50123 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50173 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50190 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50152 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50029 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50141 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50212 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50233 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50124 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50191 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50200 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50223 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50217 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50179 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49982 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50163 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50140 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50205
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50196 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50041 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50146 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50245 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50200
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50203
Source: unknown	Network traffic detected: HTTP traffic on port 50097 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50202
Source: unknown	Network traffic detected: HTTP traffic on port 50157 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50239 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50185 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49993 -> 443

Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.27.252:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.27.252:443 -> 192.168.2.5:50202 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.27.252:443 -> 192.168.2.5:50214 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.27.252:443 -> 192.168.2.5:50217 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.27.252:443 -> 192.168.2.5:50218 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.27.252:443 -> 192.168.2.5:50219 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.27.252:443 -> 192.168.2.5:50221 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.27.252:443 -> 192.168.2.5:50223 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.27.252:443 -> 192.168.2.5:50225 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.27.252:443 -> 192.168.2.5:50227 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.27.252:443 -> 192.168.2.5:50229 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.27.252:443 -> 192.168.2.5:50232 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.27.252:443 -> 192.168.2.5:50239 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.27.252:443 -> 192.168.2.5:50241 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.27.252:443 -> 192.168.2.5:50243 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.27.252:443 -> 192.168.2.5:50245 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.27.252:443 -> 192.168.2.5:50247 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.27.252:443 -> 192.168.2.5:50249 version: TLS 1.2

Source: C:\Users\user\Desktop\q3na5Mc.exe

Code function: 0_2_04A10060 CreateDesktopExA,

0_2_04A10060

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.q3na5Mc.exe.400000.0.unpack, type: UNPACKEDPE

Matched rule: Finds Vidar samples based on the specific strings Author: Sekoia.io

PE file contains section with special chars

Source: q3na5Mc.exe	Static PE information: section name:
Source: q3na5Mc.exe	Static PE information: section name: .idata
Source: q3na5Mc.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\q3na5Mc.exe

Process Stats: CPU usage > 49%

Source: q3na5Mc.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.q3na5Mc.exe.400000.0.unpack, type: UNPACKEDPE

Matched rule: infostealer_win_vidar_strings_nov23 author = Sekoia.io, description = Finds Vidar samples based on the specific strings, creation_date = 2023-11-10, classification = TLP:CLEAR, version = 1.0, reference = https://twitter.com/crep1x/status/1722652451319202242, id = b2c17627-f9b8-4401-b657-1cce560edc76

Source: q3na5Mc.exe

Static PE information: Section: ytbfgtdr ZLIB complexity 0.9946536075367647

Source: q3na5Mc.exe

Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@83/222@48/46

Source: C:\Users\user\Desktop\q3na5Mc.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\BJ5VX74X.htm

Jump to behavior

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\7653c42d-eba3-4069-b581-0990fa99d41a.tmp

Jump to behavior

Source: C:\Users\user\Desktop\q3na5Mc.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: chrome.exe, 00000004.00000002.3579777365.00003AB000790000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE psl_extensions (domain VARCHAR NOT NULL, UNIQUE (domain));
Source: kx4opzcbi.0.dr, cjeuk6xb1.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: q3na5Mc.exe	Virustotal: Detection: 67%
Source: q3na5Mc.exe	ReversingLabs: Detection: 65%

Source: q3na5Mc.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\q3na5Mc.exe "C:\Users\user\Desktop\q3na5Mc.exe"
Source: C:\Users\user\Desktop\q3na5Mc.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2496 --field-trial-handle=2128,i,10062375995080605630,17335473394292795222,262144 /prefetch:8
Source: C:\Users\user\Desktop\q3na5Mc.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2372 --field-trial-handle=2168,i,979304615989707383,5940876946649329924,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1992,i,14075413496128955347,14211455807137193995,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6952 --field-trial-handle=1992,i,14075413496128955347,14211455807137193995,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7112 --field-trial-handle=1992,i,14075413496128955347,14211455807137193995,262144 /prefetch:8
Source: C:\Users\user\Desktop\q3na5Mc.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=1528,i,5577874075167477756,16733753555390949207,262144 /prefetch:3
Source: C:\Users\user\Desktop\q3na5Mc.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2584 --field-trial-handle=2260,i,14492942354235819292,11724797676707326256,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2016 --field-trial-handle=1772,i,9291681872558238668,16876093037937104852,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=5340 --field-trial-handle=1772,i,9291681872558238668,16876093037937104852,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=5492 --field-trial-handle=1772,i,9291681872558238668,16876093037937104852,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6200 --field-trial-handle=1772,i,9291681872558238668,16876093037937104852,262144 /prefetch:8
Source: C:\Users\user\Desktop\q3na5Mc.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2496 --field-trial-handle=2128,i,10062375995080605630,17335473394292795222,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2372 --field-trial-handle=2168,i,979304615989707383,5940876946649329924,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1992,i,14075413496128955347,14211455807137193995,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6952 --field-trial-handle=1992,i,14075413496128955347,14211455807137193995,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7112 --field-trial-handle=1992,i,14075413496128955347,14211455807137193995,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=1528,i,5577874075167477756,16733753555390949207,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2584 --field-trial-handle=2260,i,14492942354235819292,11724797676707326256,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2016 --field-trial-handle=1772,i,9291681872558238668,16876093037937104852,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=5340 --field-trial-handle=1772,i,9291681872558238668,16876093037937104852,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=5492 --field-trial-handle=1772,i,9291681872558238668,16876093037937104852,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6200 --field-trial-handle=1772,i,9291681872558238668,16876093037937104852,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\q3na5Mc.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	Section loaded: cabinet.dll	Jump to behavior

Source: C:\Users\user\Desktop\q3na5Mc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Google Drive.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: q3na5Mc.exe

Static file information: File size 1911808 > 1048576

Source: q3na5Mc.exe

Static PE information: Raw size of ytbfgtdr is bigger than: 0x100000 < 0x1a9000

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\q3na5Mc.exe

Unpacked PE file: 0.2.q3na5Mc.exe.400000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ytbfgtdr:EW;dkialhek:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ytbfgtdr:EW;dkialhek:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: q3na5Mc.exe

Static PE information: real checksum: 0x1df964 should be: 0x1dba7c

Source: q3na5Mc.exe	Static PE information: section name:
Source: q3na5Mc.exe	Static PE information: section name: .idata
Source: q3na5Mc.exe	Static PE information: section name:
Source: q3na5Mc.exe	Static PE information: section name: ytbfgtdr
Source: q3na5Mc.exe	Static PE information: section name: dkialhek
Source: q3na5Mc.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\q3na5Mc.exe	Code function: 0_3_0493B3B7 pushad ; ret	0_3_0493B3C9
Source: C:\Users\user\Desktop\q3na5Mc.exe	Code function: 0_3_0493B3B7 pushad ; ret	0_3_0493B3C9
Source: C:\Users\user\Desktop\q3na5Mc.exe	Code function: 0_3_04939024 pushad ; ret	0_3_04939039
Source: C:\Users\user\Desktop\q3na5Mc.exe	Code function: 0_3_04939024 pushad ; ret	0_3_04939039
Source: C:\Users\user\Desktop\q3na5Mc.exe	Code function: 0_3_0493B3B7 pushad ; ret	0_3_0493B3C9
Source: C:\Users\user\Desktop\q3na5Mc.exe	Code function: 0_3_0493B3B7 pushad ; ret	0_3_0493B3C9
Source: C:\Users\user\Desktop\q3na5Mc.exe	Code function: 0_3_04939024 pushad ; ret	0_3_04939039
Source: C:\Users\user\Desktop\q3na5Mc.exe	Code function: 0_3_04939024 pushad ; ret	0_3_04939039

Source: q3na5Mc.exe

Static PE information: section name: ytbfgtdr entropy: 7.953701887559156

Boot Survival

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\q3na5Mc.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	Window searched: window name: Regmonclass	Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Users\user\Desktop\q3na5Mc.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\q3na5Mc.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5B01A0 second address: 5B01E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB4C550E359h 0x00000009 pop esi 0x0000000a pushad 0x0000000b push eax 0x0000000c jnp 00007FB4C550E346h 0x00000012 pushad 0x00000013 popad 0x00000014 pop eax 0x00000015 push edx 0x00000016 jmp 00007FB4C550E359h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5B7188 second address: 5B718E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5B718E second address: 5B71B0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4C550E354h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d jbe 00007FB4C550E346h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5B71B0 second address: 5B71DA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jne 00007FB4C4737E06h 0x00000010 push eax 0x00000011 push edx 0x00000012 jbe 00007FB4C4737DB6h 0x00000018 jmp 00007FB4C4737DC2h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5B71DA second address: 5B7200 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a je 00007FB4C550E346h 0x00000010 jmp 00007FB4C550E356h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5B7200 second address: 5B7204 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5B769D second address: 5B76A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5B76A1 second address: 5B76A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5B9A71 second address: 5B9A77 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5B9A77 second address: 5B9A7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5B9A7B second address: 5B9AB3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a pushad 0x0000000b pushad 0x0000000c jmp 00007FB4C550E34Fh 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 jmp 00007FB4C550E34Fh 0x00000019 popad 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e push eax 0x0000001f push edx 0x00000020 push ecx 0x00000021 pushad 0x00000022 popad 0x00000023 pop ecx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5B9AB3 second address: 5B9AB8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5B9B6B second address: 5B9BAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 jmp 00007FB4C550E34Ah 0x0000000b nop 0x0000000c movzx edi, dx 0x0000000f push 00000000h 0x00000011 or edx, 200C2DDFh 0x00000017 call 00007FB4C550E349h 0x0000001c jne 00007FB4C550E34Ah 0x00000022 push eax 0x00000023 push ebx 0x00000024 jnc 00007FB4C550E348h 0x0000002a pop ebx 0x0000002b mov eax, dword ptr [esp+04h] 0x0000002f push eax 0x00000030 push edx 0x00000031 push eax 0x00000032 push edx 0x00000033 push ebx 0x00000034 pop ebx 0x00000035 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5B9BAF second address: 5B9BB3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5B9BB3 second address: 5B9BB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5B9BB9 second address: 5B9BE5 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FB4C4737DB8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c ja 00007FB4C4737DC4h 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b pop eax 0x0000001c rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5B9BE5 second address: 5B9BF6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4C550E34Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5B9BF6 second address: 5B9BFC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5B9BFC second address: 5B9C00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5B9C00 second address: 5B9C04 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5B9D04 second address: 5B9DC3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4C550E34Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push edx 0x0000000f call 00007FB4C550E348h 0x00000014 pop edx 0x00000015 mov dword ptr [esp+04h], edx 0x00000019 add dword ptr [esp+04h], 00000014h 0x00000021 inc edx 0x00000022 push edx 0x00000023 ret 0x00000024 pop edx 0x00000025 ret 0x00000026 push edx 0x00000027 mov esi, dword ptr [ebp+156D2C31h] 0x0000002d pop ecx 0x0000002e push 00000000h 0x00000030 mov ecx, dword ptr [ebp+156D1A46h] 0x00000036 call 00007FB4C550E349h 0x0000003b pushad 0x0000003c pushad 0x0000003d jmp 00007FB4C550E34Bh 0x00000042 jnl 00007FB4C550E346h 0x00000048 popad 0x00000049 jp 00007FB4C550E356h 0x0000004f jmp 00007FB4C550E350h 0x00000054 popad 0x00000055 push eax 0x00000056 jng 00007FB4C550E350h 0x0000005c pushad 0x0000005d jg 00007FB4C550E346h 0x00000063 pushad 0x00000064 popad 0x00000065 popad 0x00000066 mov eax, dword ptr [esp+04h] 0x0000006a jmp 00007FB4C550E356h 0x0000006f mov eax, dword ptr [eax] 0x00000071 push eax 0x00000072 push eax 0x00000073 push edx 0x00000074 jmp 00007FB4C550E359h 0x00000079 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5B9DC3 second address: 5B9DC7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5B9DC7 second address: 5B9DEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b pushad 0x0000000c jnc 00007FB4C550E348h 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FB4C550E34Eh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5B9DEB second address: 5B9DEF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5D9254 second address: 5D9276 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4C550E358h 0x00000007 jne 00007FB4C550E346h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5D99D9 second address: 5D99E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FB4C4737DB6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5D99E3 second address: 5D9A1A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4C550E359h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a push edx 0x0000000b jmp 00007FB4C550E355h 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5D9B8D second address: 5D9B99 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edi 0x0000000a pop edi 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5D9B99 second address: 5D9BAE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007FB4C550E346h 0x0000000a jmp 00007FB4C550E34Bh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5DA2B7 second address: 5DA2BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5DA2BB second address: 5DA2C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5DA2C1 second address: 5DA2D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007FB4C4737DBAh 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5DA2D3 second address: 5DA2EB instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007FB4C550E353h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5DAF6D second address: 5DAF73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5DE944 second address: 5DE949 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5DD6F2 second address: 5DD6F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5E58EC second address: 5E58F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jnc 00007FB4C550E346h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5E4E6B second address: 5E4E71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5E4E71 second address: 5E4ED4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FB4C550E352h 0x0000000a jmp 00007FB4C550E352h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 jmp 00007FB4C550E352h 0x0000001a jmp 00007FB4C550E34Fh 0x0000001f popad 0x00000020 jmp 00007FB4C550E353h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5E5025 second address: 5E5056 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FB4C4737DB6h 0x0000000a jmp 00007FB4C4737DC4h 0x0000000f jnc 00007FB4C4737DB6h 0x00000015 popad 0x00000016 push ecx 0x00000017 pushad 0x00000018 popad 0x00000019 pushad 0x0000001a popad 0x0000001b pop ecx 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5E5056 second address: 5E5070 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FB4C550E353h 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5E5760 second address: 5E577B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 pop ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FB4C4737DC0h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5E7614 second address: 5E7667 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FB4C550E346h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push edi 0x0000000c pop edi 0x0000000d jno 00007FB4C550E346h 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 jmp 00007FB4C550E34Eh 0x0000001b push ebx 0x0000001c jmp 00007FB4C550E34Fh 0x00000021 pop ebx 0x00000022 popad 0x00000023 push eax 0x00000024 push edx 0x00000025 jg 00007FB4C550E352h 0x0000002b pushad 0x0000002c jbe 00007FB4C550E346h 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5E7667 second address: 5E766E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5E766E second address: 5E7675 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5E8B4E second address: 5E8B97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 jmp 00007FB4C4737DC4h 0x0000000b pop ecx 0x0000000c popad 0x0000000d push eax 0x0000000e jnl 00007FB4C4737DCFh 0x00000014 mov eax, dword ptr [esp+04h] 0x00000018 pushad 0x00000019 push eax 0x0000001a pushad 0x0000001b popad 0x0000001c pop eax 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5E8B97 second address: 5E8B9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5E8B9B second address: 5E8B9F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5E8B9F second address: 5E8BBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FB4C550E350h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5E8BBB second address: 5E8BD7 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FB4C4737DC3h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5E8F1B second address: 5E8F20 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5E9250 second address: 5E9254 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5E99F3 second address: 5E99FD instructions: 0x00000000 rdtsc 0x00000002 jp 00007FB4C550E346h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5E9AA3 second address: 5E9AA9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5E9AA9 second address: 5E9AC1 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007FB4C550E34Bh 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5E9AC1 second address: 5E9AC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5E9AC5 second address: 5E9ACF instructions: 0x00000000 rdtsc 0x00000002 jo 00007FB4C550E346h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5E9ACF second address: 5E9AD4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5E9BD2 second address: 5E9BD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5E9BD7 second address: 5E9BDE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5E9C8A second address: 5E9C90 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5E9C90 second address: 5E9CB4 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FB4C4737DC9h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5E9D77 second address: 5E9D9C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4C550E34Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FB4C550E350h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5E9D9C second address: 5E9DA2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5EAB44 second address: 5EAB49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5EAB49 second address: 5EAB62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b jmp 00007FB4C4737DBDh 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5ED4AE second address: 5ED4B4 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5EF101 second address: 5EF110 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jnp 00007FB4C4737DB6h 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5A9658 second address: 5A965E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5A965E second address: 5A9662 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5A9662 second address: 5A9687 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4C550E357h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d jc 00007FB4C550E346h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5EF76E second address: 5EF774 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5EF774 second address: 5EF77E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007FB4C550E346h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5EF77E second address: 5EF808 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FB4C4737DB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push edx 0x00000012 call 00007FB4C4737DB8h 0x00000017 pop edx 0x00000018 mov dword ptr [esp+04h], edx 0x0000001c add dword ptr [esp+04h], 00000017h 0x00000024 inc edx 0x00000025 push edx 0x00000026 ret 0x00000027 pop edx 0x00000028 ret 0x00000029 mov dword ptr [ebp+156D1843h], ebx 0x0000002f call 00007FB4C4737DBCh 0x00000034 jo 00007FB4C4737DBCh 0x0000003a mov edi, dword ptr [ebp+156D2B8Dh] 0x00000040 pop edi 0x00000041 push 00000000h 0x00000043 add dword ptr [ebp+156D3086h], ecx 0x00000049 push 00000000h 0x0000004b push 00000000h 0x0000004d push eax 0x0000004e call 00007FB4C4737DB8h 0x00000053 pop eax 0x00000054 mov dword ptr [esp+04h], eax 0x00000058 add dword ptr [esp+04h], 0000001Ah 0x00000060 inc eax 0x00000061 push eax 0x00000062 ret 0x00000063 pop eax 0x00000064 ret 0x00000065 mov si, 29BEh 0x00000069 mov dword ptr [ebp+156D38BFh], esi 0x0000006f xchg eax, ebx 0x00000070 push eax 0x00000071 push edx 0x00000072 push eax 0x00000073 push edx 0x00000074 pushad 0x00000075 popad 0x00000076 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5EF808 second address: 5EF80C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5EF80C second address: 5EF812 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5F02E1 second address: 5F02E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5F02E7 second address: 5F0337 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4C4737DBAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c or edi, 5B729EB7h 0x00000012 push 00000000h 0x00000014 push edx 0x00000015 pop edi 0x00000016 push 00000000h 0x00000018 push 00000000h 0x0000001a push esi 0x0000001b call 00007FB4C4737DB8h 0x00000020 pop esi 0x00000021 mov dword ptr [esp+04h], esi 0x00000025 add dword ptr [esp+04h], 00000017h 0x0000002d inc esi 0x0000002e push esi 0x0000002f ret 0x00000030 pop esi 0x00000031 ret 0x00000032 xchg eax, ebx 0x00000033 push ecx 0x00000034 jnl 00007FB4C4737DBCh 0x0000003a pop ecx 0x0000003b push eax 0x0000003c pushad 0x0000003d push eax 0x0000003e push eax 0x0000003f push edx 0x00000040 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5F0E3F second address: 5F0ED2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 mov dword ptr [esp], eax 0x00000008 push 00000000h 0x0000000a push ebp 0x0000000b call 00007FB4C550E348h 0x00000010 pop ebp 0x00000011 mov dword ptr [esp+04h], ebp 0x00000015 add dword ptr [esp+04h], 0000001Ah 0x0000001d inc ebp 0x0000001e push ebp 0x0000001f ret 0x00000020 pop ebp 0x00000021 ret 0x00000022 push edx 0x00000023 jmp 00007FB4C550E359h 0x00000028 pop edi 0x00000029 xor dword ptr [ebp+156D1811h], esi 0x0000002f call 00007FB4C550E34Fh 0x00000034 pop edi 0x00000035 push 00000000h 0x00000037 push 00000000h 0x00000039 push edi 0x0000003a call 00007FB4C550E348h 0x0000003f pop edi 0x00000040 mov dword ptr [esp+04h], edi 0x00000044 add dword ptr [esp+04h], 0000001Ah 0x0000004c inc edi 0x0000004d push edi 0x0000004e ret 0x0000004f pop edi 0x00000050 ret 0x00000051 sub dword ptr [ebp+1588E54Fh], esi 0x00000057 push 00000000h 0x00000059 mov dword ptr [ebp+156D3895h], edi 0x0000005f xchg eax, ebx 0x00000060 push ebx 0x00000061 push eax 0x00000062 push edx 0x00000063 push eax 0x00000064 push edx 0x00000065 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5F0ED2 second address: 5F0ED6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5F0ED6 second address: 5F0EDA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5F6007 second address: 5F600D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5F600D second address: 5F6063 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 sub ebx, dword ptr [ebp+1585F32Ah] 0x0000000f add dword ptr [ebp+156D30EEh], edi 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push esi 0x0000001a call 00007FB4C550E348h 0x0000001f pop esi 0x00000020 mov dword ptr [esp+04h], esi 0x00000024 add dword ptr [esp+04h], 00000019h 0x0000002c inc esi 0x0000002d push esi 0x0000002e ret 0x0000002f pop esi 0x00000030 ret 0x00000031 push 00000000h 0x00000033 cmc 0x00000034 ja 00007FB4C550E34Ch 0x0000003a add edi, 0C23F681h 0x00000040 push eax 0x00000041 jl 00007FB4C550E354h 0x00000047 push eax 0x00000048 push edx 0x00000049 jnc 00007FB4C550E346h 0x0000004f rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5F6248 second address: 5F6259 instructions: 0x00000000 rdtsc 0x00000002 je 00007FB4C4737DB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5F8088 second address: 5F8092 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FB4C550E346h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5F7207 second address: 5F720B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5F720B second address: 5F7211 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5F7211 second address: 5F722F instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FB4C4737DB8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FB4C4737DBFh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5F902F second address: 5F9034 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5F722F second address: 5F7246 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB4C4737DC3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5F9034 second address: 5F9042 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5F9042 second address: 5F904C instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FB4C4737DB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5F904C second address: 5F9063 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB4C550E353h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5F91A1 second address: 5F91A8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5FA23D second address: 5FA258 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB4C550E357h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5FBF3F second address: 5FBF4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB4C4737DBBh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5FB240 second address: 5FB244 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5FBF4F second address: 5FBF55 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5FE0AD second address: 5FE0B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5FF157 second address: 5FF15D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 600015 second address: 60001B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5FF15D second address: 5FF179 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB4C4737DC8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 60001B second address: 600021 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5FF179 second address: 5FF213 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FB4C4737DB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push eax 0x00000012 call 00007FB4C4737DB8h 0x00000017 pop eax 0x00000018 mov dword ptr [esp+04h], eax 0x0000001c add dword ptr [esp+04h], 00000016h 0x00000024 inc eax 0x00000025 push eax 0x00000026 ret 0x00000027 pop eax 0x00000028 ret 0x00000029 cmc 0x0000002a push dword ptr fs:[00000000h] 0x00000031 stc 0x00000032 mov dword ptr fs:[00000000h], esp 0x00000039 jmp 00007FB4C4737DBBh 0x0000003e mov eax, dword ptr [ebp+156D0CB9h] 0x00000044 push 00000000h 0x00000046 push ecx 0x00000047 call 00007FB4C4737DB8h 0x0000004c pop ecx 0x0000004d mov dword ptr [esp+04h], ecx 0x00000051 add dword ptr [esp+04h], 0000001Ah 0x00000059 inc ecx 0x0000005a push ecx 0x0000005b ret 0x0000005c pop ecx 0x0000005d ret 0x0000005e add dword ptr [ebp+156D1DFEh], esi 0x00000064 push FFFFFFFFh 0x00000066 mov dword ptr [ebp+1585BA0Bh], ecx 0x0000006c nop 0x0000006d jmp 00007FB4C4737DC5h 0x00000072 push eax 0x00000073 pushad 0x00000074 push eax 0x00000075 push edx 0x00000076 push ebx 0x00000077 pop ebx 0x00000078 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 6010DC second address: 6010E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 6010E0 second address: 601104 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jno 00007FB4C4737DB6h 0x00000011 jmp 00007FB4C4737DC2h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 600193 second address: 600197 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 601104 second address: 60115D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 mov dword ptr [ebp+156D1811h], ebx 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push esi 0x00000014 call 00007FB4C4737DB8h 0x00000019 pop esi 0x0000001a mov dword ptr [esp+04h], esi 0x0000001e add dword ptr [esp+04h], 0000001Ch 0x00000026 inc esi 0x00000027 push esi 0x00000028 ret 0x00000029 pop esi 0x0000002a ret 0x0000002b mov dword ptr [ebp+156D1800h], eax 0x00000031 jg 00007FB4C4737DBBh 0x00000037 push 00000000h 0x00000039 mov ebx, dword ptr [ebp+156D5799h] 0x0000003f xchg eax, esi 0x00000040 push eax 0x00000041 push edx 0x00000042 je 00007FB4C4737DBCh 0x00000048 push eax 0x00000049 push edx 0x0000004a rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 60115D second address: 601161 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 601161 second address: 601167 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 602140 second address: 602192 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push edi 0x0000000b call 00007FB4C550E348h 0x00000010 pop edi 0x00000011 mov dword ptr [esp+04h], edi 0x00000015 add dword ptr [esp+04h], 0000001Ah 0x0000001d inc edi 0x0000001e push edi 0x0000001f ret 0x00000020 pop edi 0x00000021 ret 0x00000022 mov edi, dword ptr [ebp+1586F8F7h] 0x00000028 push 00000000h 0x0000002a jmp 00007FB4C550E351h 0x0000002f push 00000000h 0x00000031 pushad 0x00000032 mov dword ptr [ebp+156D3490h], edi 0x00000038 popad 0x00000039 xchg eax, esi 0x0000003a push esi 0x0000003b pushad 0x0000003c push eax 0x0000003d push edx 0x0000003e rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 602192 second address: 6021A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop esi 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b js 00007FB4C4737DBCh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 6021A5 second address: 6021A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 6031EF second address: 603204 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e jc 00007FB4C4737DB6h 0x00000014 pop edi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 60420D second address: 604211 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 60332A second address: 60332F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 604211 second address: 604217 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 6033E1 second address: 6033E6 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5A450C second address: 5A4511 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5A4511 second address: 5A4535 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007FB4C4737DB6h 0x00000009 jmp 00007FB4C4737DC9h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5AB0C8 second address: 5AB0D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5AB0D1 second address: 5AB0DC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jg 00007FB4C4737DB6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 613BBF second address: 613BC5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 613BC5 second address: 613BC9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 613D1F second address: 613D23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 613D23 second address: 613D32 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4C4737DBBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 6198C6 second address: 6198D9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4C550E34Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 6198D9 second address: 6198DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 6198DD second address: 6198E3 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 6198E3 second address: 6198FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a jng 00007FB4C4737DB6h 0x00000010 pop ebx 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 6198FB second address: 619900 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 61A133 second address: 61A139 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 61A139 second address: 61A13E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 61A533 second address: 61A542 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jg 00007FB4C4737DB6h 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 61A68E second address: 61A695 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 62046A second address: 620475 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 620475 second address: 620479 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 61EEFB second address: 61EF07 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pushad 0x00000006 popad 0x00000007 pop edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 61EF07 second address: 61EF0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 61F072 second address: 61F07E instructions: 0x00000000 rdtsc 0x00000002 jg 00007FB4C4737DB6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 61F07E second address: 61F088 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FB4C550E352h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 61F088 second address: 61F08E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 61F08E second address: 61F0B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007FB4C550E352h 0x0000000b jmp 00007FB4C550E353h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 61F0B9 second address: 61F0E8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4C4737DC9h 0x00000007 jns 00007FB4C4737DB6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop edx 0x00000010 pop eax 0x00000011 jo 00007FB4C4737DD4h 0x00000017 push eax 0x00000018 push edx 0x00000019 push edi 0x0000001a pop edi 0x0000001b rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 61F0E8 second address: 61F0F4 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 61F0F4 second address: 61F0F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 61F69D second address: 61F6A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 61F6A3 second address: 61F6A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 61F7EC second address: 61F824 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB4C550E357h 0x00000009 popad 0x0000000a jmp 00007FB4C550E359h 0x0000000f push esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 61FC0E second address: 61FC22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB4C4737DBFh 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 61FC22 second address: 61FC27 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 61FC27 second address: 61FC2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 61FD7C second address: 61FD96 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB4C550E354h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 61FD96 second address: 61FD9A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 61EBD5 second address: 61EBDF instructions: 0x00000000 rdtsc 0x00000002 jl 00007FB4C550E34Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 629080 second address: 6290B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 pushad 0x00000008 jo 00007FB4C4737DBCh 0x0000000e jnp 00007FB4C4737DB6h 0x00000014 push edx 0x00000015 jmp 00007FB4C4737DC6h 0x0000001a pushad 0x0000001b popad 0x0000001c pop edx 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 59A694 second address: 59A698 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 59A698 second address: 59A6D8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4C4737DC5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e pop edi 0x0000000f pushad 0x00000010 je 00007FB4C4737DBCh 0x00000016 jnp 00007FB4C4737DB6h 0x0000001c pushad 0x0000001d push edx 0x0000001e pop edx 0x0000001f push ecx 0x00000020 pop ecx 0x00000021 jc 00007FB4C4737DB6h 0x00000027 popad 0x00000028 jo 00007FB4C4737DBCh 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 627F0B second address: 627F43 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FB4C550E34Ah 0x00000008 push eax 0x00000009 pop eax 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007FB4C550E356h 0x00000011 pop edx 0x00000012 pop eax 0x00000013 pushad 0x00000014 jmp 00007FB4C550E34Fh 0x00000019 push eax 0x0000001a push edx 0x0000001b push edi 0x0000001c pop edi 0x0000001d rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5F2147 second address: 5F2163 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4C4737DC8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5F2604 second address: 42CA33 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FB4C550E35Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b mov dword ptr [ebp+156D244Dh], edx 0x00000011 jp 00007FB4C550E347h 0x00000017 push dword ptr [ebp+156D02A1h] 0x0000001d jmp 00007FB4C550E34Dh 0x00000022 call dword ptr [ebp+156D1A2Dh] 0x00000028 pushad 0x00000029 jng 00007FB4C550E347h 0x0000002f cld 0x00000030 mov dword ptr [ebp+156D1923h], edx 0x00000036 xor eax, eax 0x00000038 pushad 0x00000039 cmc 0x0000003a popad 0x0000003b mov edx, dword ptr [esp+28h] 0x0000003f je 00007FB4C550E34Fh 0x00000045 mov dword ptr [ebp+156D2BADh], eax 0x0000004b jng 00007FB4C550E364h 0x00000051 mov esi, 0000003Ch 0x00000056 js 00007FB4C550E34Eh 0x0000005c jl 00007FB4C550E348h 0x00000062 pushad 0x00000063 popad 0x00000064 add esi, dword ptr [esp+24h] 0x00000068 mov dword ptr [ebp+156D1A25h], edx 0x0000006e lodsw 0x00000070 jmp 00007FB4C550E34Dh 0x00000075 add eax, dword ptr [esp+24h] 0x00000079 jmp 00007FB4C550E34Bh 0x0000007e mov ebx, dword ptr [esp+24h] 0x00000082 cmc 0x00000083 push eax 0x00000084 pushad 0x00000085 push edx 0x00000086 push eax 0x00000087 push edx 0x00000088 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5F2715 second address: 5F272B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB4C4737DC1h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5F272B second address: 42CA33 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FB4C550E34Dh 0x00000008 push esi 0x00000009 pop esi 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esp], eax 0x00000010 or ecx, dword ptr [ebp+156D29E1h] 0x00000016 push dword ptr [ebp+156D02A1h] 0x0000001c call dword ptr [ebp+156D1A2Dh] 0x00000022 pushad 0x00000023 jng 00007FB4C550E347h 0x00000029 cld 0x0000002a mov dword ptr [ebp+156D1923h], edx 0x00000030 xor eax, eax 0x00000032 pushad 0x00000033 cmc 0x00000034 popad 0x00000035 mov edx, dword ptr [esp+28h] 0x00000039 je 00007FB4C550E34Fh 0x0000003f mov dword ptr [ebp+156D2BADh], eax 0x00000045 jng 00007FB4C550E364h 0x0000004b mov esi, 0000003Ch 0x00000050 js 00007FB4C550E34Eh 0x00000056 jl 00007FB4C550E348h 0x0000005c pushad 0x0000005d popad 0x0000005e add esi, dword ptr [esp+24h] 0x00000062 mov dword ptr [ebp+156D1A25h], edx 0x00000068 lodsw 0x0000006a jmp 00007FB4C550E34Dh 0x0000006f add eax, dword ptr [esp+24h] 0x00000073 jmp 00007FB4C550E34Bh 0x00000078 mov ebx, dword ptr [esp+24h] 0x0000007c cmc 0x0000007d push eax 0x0000007e pushad 0x0000007f push edx 0x00000080 push eax 0x00000081 push edx 0x00000082 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5F296B second address: 5F2970 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5F2970 second address: 5F29C2 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007FB4C550E357h 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], esi 0x0000000e push 00000000h 0x00000010 push ebp 0x00000011 call 00007FB4C550E348h 0x00000016 pop ebp 0x00000017 mov dword ptr [esp+04h], ebp 0x0000001b add dword ptr [esp+04h], 00000018h 0x00000023 inc ebp 0x00000024 push ebp 0x00000025 ret 0x00000026 pop ebp 0x00000027 ret 0x00000028 push eax 0x00000029 pushad 0x0000002a jns 00007FB4C550E34Ch 0x00000030 push eax 0x00000031 push edx 0x00000032 push esi 0x00000033 pop esi 0x00000034 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5F2AB5 second address: 5F2AB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5F2AB9 second address: 5F2AC3 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FB4C550E346h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5F2AC3 second address: 5F2AC9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5F2AC9 second address: 5F2B32 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 js 00007FB4C550E34Eh 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 pushad 0x00000014 jmp 00007FB4C550E34Eh 0x00000019 push edi 0x0000001a jmp 00007FB4C550E34Ch 0x0000001f pop edi 0x00000020 popad 0x00000021 mov eax, dword ptr [eax] 0x00000023 push edi 0x00000024 jmp 00007FB4C550E355h 0x00000029 pop edi 0x0000002a mov dword ptr [esp+04h], eax 0x0000002e pushad 0x0000002f push eax 0x00000030 push edx 0x00000031 jmp 00007FB4C550E350h 0x00000036 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5F34D6 second address: 5F34E9 instructions: 0x00000000 rdtsc 0x00000002 je 00007FB4C4737DB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e push ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 push esi 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5F35E1 second address: 5F35E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5F35E7 second address: 5F360A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp], eax 0x00000008 jmp 00007FB4C4737DBAh 0x0000000d lea eax, dword ptr [ebp+15898ECAh] 0x00000013 sbb edx, 0B9C6E2Dh 0x00000019 push eax 0x0000001a pushad 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5F360A second address: 5F3619 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 jp 00007FB4C550E34Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5F3619 second address: 5F369E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp], eax 0x00000008 push 00000000h 0x0000000a push ebp 0x0000000b call 00007FB4C4737DB8h 0x00000010 pop ebp 0x00000011 mov dword ptr [esp+04h], ebp 0x00000015 add dword ptr [esp+04h], 0000001Ch 0x0000001d inc ebp 0x0000001e push ebp 0x0000001f ret 0x00000020 pop ebp 0x00000021 ret 0x00000022 lea eax, dword ptr [ebp+15898E86h] 0x00000028 push 00000000h 0x0000002a push edx 0x0000002b call 00007FB4C4737DB8h 0x00000030 pop edx 0x00000031 mov dword ptr [esp+04h], edx 0x00000035 add dword ptr [esp+04h], 00000017h 0x0000003d inc edx 0x0000003e push edx 0x0000003f ret 0x00000040 pop edx 0x00000041 ret 0x00000042 jmp 00007FB4C4737DBFh 0x00000047 nop 0x00000048 jmp 00007FB4C4737DBAh 0x0000004d push eax 0x0000004e jl 00007FB4C4737DCFh 0x00000054 push eax 0x00000055 push edx 0x00000056 jmp 00007FB4C4737DC1h 0x0000005b rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 62839E second address: 6283DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB4C550E356h 0x00000009 pop edi 0x0000000a pushad 0x0000000b push ebx 0x0000000c jns 00007FB4C550E346h 0x00000012 pop ebx 0x00000013 jmp 00007FB4C550E353h 0x00000018 pushad 0x00000019 push eax 0x0000001a pop eax 0x0000001b pushad 0x0000001c popad 0x0000001d push ebx 0x0000001e pop ebx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 628519 second address: 628538 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4C4737DC2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push edx 0x0000000d pop edx 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 628538 second address: 62853D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 62853D second address: 628543 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 628543 second address: 628547 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 628660 second address: 628664 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 628664 second address: 628693 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FB4C550E346h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FB4C550E358h 0x00000011 jp 00007FB4C550E350h 0x00000017 push esi 0x00000018 push ecx 0x00000019 pop ecx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 628AB2 second address: 628AB6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 628AB6 second address: 628ABC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 628C42 second address: 628C48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 62D66B second address: 62D67E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007FB4C550E34Eh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 62D67E second address: 62D685 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 62D7CC second address: 62D7F6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4C550E34Eh 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FB4C550E352h 0x0000000e ja 00007FB4C550E346h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 62DAED second address: 62DAF7 instructions: 0x00000000 rdtsc 0x00000002 js 00007FB4C4737DB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 62D269 second address: 62D272 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 62D272 second address: 62D276 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 62E4A9 second address: 62E4E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007FB4C550E34Eh 0x0000000d popad 0x0000000e jno 00007FB4C550E34Eh 0x00000014 popad 0x00000015 js 00007FB4C550E37Dh 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FB4C550E34Ah 0x00000022 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 62E4E1 second address: 62E507 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007FB4C4737DC1h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ecx 0x0000000c jmp 00007FB4C4737DBCh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 634127 second address: 63415F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jc 00007FB4C550E370h 0x0000000b jmp 00007FB4C550E354h 0x00000010 jmp 00007FB4C550E356h 0x00000015 push edi 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 63415F second address: 63416A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 63416A second address: 63417F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB4C550E351h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 637123 second address: 637127 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 637127 second address: 63712B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 63C250 second address: 63C264 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 pop edi 0x00000008 popad 0x00000009 push esi 0x0000000a ja 00007FB4C4737DBEh 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 63BC73 second address: 63BC99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB4C550E354h 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f js 00007FB4C550E346h 0x00000015 push edx 0x00000016 pop edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 63BC99 second address: 63BCA5 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FB4C4737DB6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 63BCA5 second address: 63BCAF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FB4C550E346h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 63BCAF second address: 63BCB3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 63BF2C second address: 63BF4E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4C550E358h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 63BF4E second address: 63BF54 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 63BF54 second address: 63BF8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007FB4C550E35Bh 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FB4C550E357h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 63F898 second address: 63F8A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 63F8A4 second address: 63F8D0 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FB4C550E346h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push edx 0x0000000c pop edx 0x0000000d jne 00007FB4C550E346h 0x00000013 jmp 00007FB4C550E356h 0x00000018 pushad 0x00000019 popad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 63FD0F second address: 63FD13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 63FD13 second address: 63FD3A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4C550E359h 0x00000007 jnp 00007FB4C550E346h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push edi 0x00000012 pop edi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 63FD3A second address: 63FD40 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 63FE98 second address: 63FEA7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB4C550E34Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 63FEA7 second address: 63FEB8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 je 00007FB4C4737DB6h 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 645E79 second address: 645E97 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007FB4C550E346h 0x00000009 jnc 00007FB4C550E346h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push ecx 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 jno 00007FB4C550E346h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5ACC1C second address: 5ACC2F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4C4737DBBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5ACC2F second address: 5ACC35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 644C03 second address: 644C09 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 644C09 second address: 644C0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5F2FBE second address: 5F2FC8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007FB4C4737DB6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5F2FC8 second address: 5F3036 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a jmp 00007FB4C550E34Eh 0x0000000f jmp 00007FB4C550E34Fh 0x00000014 popad 0x00000015 nop 0x00000016 add dword ptr [ebp+156D19D0h], ecx 0x0000001c mov ebx, dword ptr [ebp+15898EC5h] 0x00000022 movzx edi, ax 0x00000025 add eax, ebx 0x00000027 mov ecx, dword ptr [ebp+1586F66Ch] 0x0000002d push eax 0x0000002e jc 00007FB4C550E354h 0x00000034 pushad 0x00000035 jc 00007FB4C550E346h 0x0000003b jng 00007FB4C550E346h 0x00000041 popad 0x00000042 mov dword ptr [esp], eax 0x00000045 or dword ptr [ebp+15864977h], ebx 0x0000004b push 00000004h 0x0000004d mov cl, B1h 0x0000004f mov ecx, 0D344DDDh 0x00000054 nop 0x00000055 push eax 0x00000056 push edx 0x00000057 push edi 0x00000058 push edi 0x00000059 pop edi 0x0000005a pop edi 0x0000005b rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5F3036 second address: 5F3064 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FB4C4737DC1h 0x00000008 jmp 00007FB4C4737DC1h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5F3064 second address: 5F306D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 644ED3 second address: 644ED9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 644ED9 second address: 644EE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 644EE4 second address: 644EE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 645B3E second address: 645B4F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB4C550E34Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 645B4F second address: 645B71 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4C4737DC7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 64C531 second address: 64C53B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FB4C550E346h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 64C53B second address: 64C53F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 64C53F second address: 64C556 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007FB4C550E34Eh 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 64C556 second address: 64C55C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 64C55C second address: 64C564 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 64C863 second address: 64C885 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FB4C4737DC9h 0x0000000c push edx 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 64C885 second address: 64C8AB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FB4C550E34Fh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 jmp 00007FB4C550E34Ah 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 64CE27 second address: 64CE2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 64D455 second address: 64D47D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4C550E350h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007FB4C550E34Bh 0x0000000f jne 00007FB4C550E346h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 64D770 second address: 64D77A instructions: 0x00000000 rdtsc 0x00000002 js 00007FB4C4737DB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 64D77A second address: 64D77F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 64D77F second address: 64D7DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB4C4737DBEh 0x00000009 pop edi 0x0000000a push esi 0x0000000b jmp 00007FB4C4737DC0h 0x00000010 pop esi 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FB4C4737DC6h 0x0000001a ja 00007FB4C4737DCCh 0x00000020 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 64DDB5 second address: 64DDBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FB4C550E346h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 64DDBF second address: 64DDEC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 ja 00007FB4C4737DB6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jno 00007FB4C4737DC2h 0x00000012 popad 0x00000013 pushad 0x00000014 jnl 00007FB4C4737DB8h 0x0000001a pushad 0x0000001b push ebx 0x0000001c pop ebx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 652B83 second address: 652BD0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007FB4C550E346h 0x00000009 jnc 00007FB4C550E346h 0x0000000f popad 0x00000010 jne 00007FB4C550E365h 0x00000016 pop edx 0x00000017 pop eax 0x00000018 pushad 0x00000019 jp 00007FB4C550E352h 0x0000001f push eax 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 652BD0 second address: 652BD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 656A23 second address: 656A27 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 655CC2 second address: 655CCC instructions: 0x00000000 rdtsc 0x00000002 jno 00007FB4C4737DB6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 655CCC second address: 655CD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 656327 second address: 656331 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FB4C4737DB6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 65647B second address: 656488 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FB4C550E346h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 6565C0 second address: 6565CA instructions: 0x00000000 rdtsc 0x00000002 jns 00007FB4C4737DB6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 65C9B3 second address: 65C9DA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007FB4C550E35Fh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 65C9DA second address: 65C9E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 65C9E0 second address: 65C9E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 65CE7D second address: 65CE98 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FB4C4737DBFh 0x0000000f push eax 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 65CE98 second address: 65CE9C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 65CFEB second address: 65CFF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 65CFF7 second address: 65CFFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 65CFFB second address: 65D001 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 65D15C second address: 65D165 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 65D165 second address: 65D169 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 65D169 second address: 65D16D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 65D32D second address: 65D336 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 65E5CB second address: 65E5DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007FB4C550E34Ah 0x0000000c pushad 0x0000000d popad 0x0000000e push edi 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 665E81 second address: 665E8B instructions: 0x00000000 rdtsc 0x00000002 jne 00007FB4C4737DB6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 665E8B second address: 665E91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 665A75 second address: 665A7D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 6674B7 second address: 6674CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007FB4C550E351h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 6674CD second address: 6674E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB4C4737DC5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5B1BFB second address: 5B1C01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 5B1C01 second address: 5B1C05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 675499 second address: 67549F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 67549F second address: 6754C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FB4C4737DBFh 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FB4C4737DBCh 0x00000012 jo 00007FB4C4737DB6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 6754C8 second address: 6754CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 6754CC second address: 6754D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 6778C5 second address: 6778D2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 jng 00007FB4C550E346h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 6778D2 second address: 6778D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 6778D8 second address: 677903 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jc 00007FB4C550E36Ch 0x00000011 jmp 00007FB4C550E356h 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 6790B7 second address: 6790BC instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 6790BC second address: 6790C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push edx 0x00000007 pop edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 6790C6 second address: 6790CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 67A820 second address: 67A829 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 67A829 second address: 67A856 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007FB4C4737DB6h 0x00000009 push edi 0x0000000a pop edi 0x0000000b jg 00007FB4C4737DB6h 0x00000011 popad 0x00000012 jl 00007FB4C4737DBAh 0x00000018 push edx 0x00000019 pop edx 0x0000001a push esi 0x0000001b pop esi 0x0000001c pop edx 0x0000001d pop eax 0x0000001e pushad 0x0000001f jmp 00007FB4C4737DBBh 0x00000024 push ecx 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 6825A0 second address: 6825A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 6825A4 second address: 6825A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 6825A8 second address: 6825CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB4C550E34Ch 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FB4C550E34Eh 0x00000010 popad 0x00000011 push esi 0x00000012 push esi 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 689D5E second address: 689D68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FB4C4737DB6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 689D68 second address: 689D6D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 68E4FA second address: 68E4FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 68E4FE second address: 68E50C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jg 00007FB4C550E34Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 68FDFD second address: 68FE03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 68FE03 second address: 68FE07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 68FE07 second address: 68FE46 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007FB4C4737DBFh 0x0000000e pushad 0x0000000f popad 0x00000010 jno 00007FB4C4737DB6h 0x00000016 popad 0x00000017 jg 00007FB4C4737DBCh 0x0000001d popad 0x0000001e push eax 0x0000001f pushad 0x00000020 push eax 0x00000021 pop eax 0x00000022 ja 00007FB4C4737DB6h 0x00000028 pushad 0x00000029 popad 0x0000002a popad 0x0000002b push eax 0x0000002c push edx 0x0000002d push ebx 0x0000002e pop ebx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 68FE46 second address: 68FE4A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 68FC1F second address: 68FC35 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FB4C4737DB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a ja 00007FB4C4737DB8h 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 68FC35 second address: 68FC45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB4C550E34Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 68FC45 second address: 68FC49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 68FC49 second address: 68FC7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FB4C550E351h 0x0000000b popad 0x0000000c pushad 0x0000000d pushad 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 jl 00007FB4C550E346h 0x00000016 popad 0x00000017 jo 00007FB4C550E352h 0x0000001d jnl 00007FB4C550E346h 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 695CC9 second address: 695CD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 695CD0 second address: 695D1E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FB4C550E34Bh 0x00000008 jmp 00007FB4C550E34Eh 0x0000000d jmp 00007FB4C550E358h 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 jng 00007FB4C550E374h 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FB4C550E34Dh 0x00000022 pushad 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 695D1E second address: 695D22 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 695ED0 second address: 695ED8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 696002 second address: 69601A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007FB4C4737DC3h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 69601A second address: 696052 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FB4C550E34Dh 0x0000000a pop esi 0x0000000b jnc 00007FB4C550E35Dh 0x00000011 pop edx 0x00000012 pop eax 0x00000013 pushad 0x00000014 pushad 0x00000015 push edi 0x00000016 pop edi 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 69675F second address: 696763 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 699F1E second address: 699F22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 699F22 second address: 699F3E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FB4C4737DBEh 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 699F3E second address: 699F42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 69F26F second address: 69F283 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007FB4C4737DBBh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 69F283 second address: 69F28F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 pushad 0x00000007 popad 0x00000008 pop eax 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 6A0899 second address: 6A089F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 6A089F second address: 6A08A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 6A08A5 second address: 6A08BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB4C4737DC4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 6A08BD second address: 6A08D4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4C550E353h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 6A407F second address: 6A4089 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FB4C4737DB6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 6A4089 second address: 6A408D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 6B4AF1 second address: 6B4B02 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jc 00007FB4C4737DB6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 6B4B02 second address: 6B4B08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 6B4B08 second address: 6B4B0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 6B9B15 second address: 6B9B39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB4C550E351h 0x00000009 push esi 0x0000000a pop esi 0x0000000b jmp 00007FB4C550E34Ch 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 6B9B39 second address: 6B9B4C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007FB4C4737DBEh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 6B9727 second address: 6B9767 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jo 00007FB4C550E346h 0x0000000c jne 00007FB4C550E346h 0x00000012 popad 0x00000013 pop ecx 0x00000014 pushad 0x00000015 ja 00007FB4C550E361h 0x0000001b jg 00007FB4C550E34Eh 0x00000021 pushad 0x00000022 popad 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 6C5AD4 second address: 6C5AED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4C4737DC1h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 6C5AED second address: 6C5AF1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 6C5AF1 second address: 6C5AF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 6C49A6 second address: 6C49BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 popad 0x00000008 pushad 0x00000009 push edi 0x0000000a pushad 0x0000000b popad 0x0000000c jne 00007FB4C550E346h 0x00000012 pop edi 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 6C49BF second address: 6C49C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 6C521D second address: 6C5221 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 6C5221 second address: 6C5227 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 6C5227 second address: 6C522D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 6C522D second address: 6C5256 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop ebx 0x00000006 jng 00007FB4C4737DBAh 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e pushad 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 pushad 0x00000016 popad 0x00000017 jmp 00007FB4C4737DBFh 0x0000001c push ecx 0x0000001d pop ecx 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 6C5508 second address: 6C5521 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FB4C550E346h 0x0000000a je 00007FB4C550E346h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jnc 00007FB4C550E346h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 6C5521 second address: 6C5527 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 6C5527 second address: 6C554B instructions: 0x00000000 rdtsc 0x00000002 jng 00007FB4C550E34Ah 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a push esi 0x0000000b pop esi 0x0000000c push edi 0x0000000d jc 00007FB4C550E346h 0x00000013 jl 00007FB4C550E346h 0x00000019 pop edi 0x0000001a pop edx 0x0000001b pop eax 0x0000001c pushad 0x0000001d push ecx 0x0000001e push ebx 0x0000001f pop ebx 0x00000020 pop ecx 0x00000021 push ecx 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 6C56A2 second address: 6C56B9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4C4737DC3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 6C56B9 second address: 6C56C4 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jnp 00007FB4C550E346h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 6C57F6 second address: 6C57FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 6C8A0B second address: 6C8A19 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4C550E34Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 6C8A19 second address: 6C8A3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FB4C4737DBEh 0x00000013 jmp 00007FB4C4737DBAh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 6CB980 second address: 6CB998 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB4C550E354h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 6CB998 second address: 6CB9CC instructions: 0x00000000 rdtsc 0x00000002 jl 00007FB4C4737DB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d ja 00007FB4C4737DBAh 0x00000013 mov eax, dword ptr [esp+04h] 0x00000017 pushad 0x00000018 push ecx 0x00000019 push ebx 0x0000001a pop ebx 0x0000001b pop ecx 0x0000001c ja 00007FB4C4737DB8h 0x00000022 popad 0x00000023 mov eax, dword ptr [eax] 0x00000025 push eax 0x00000026 jo 00007FB4C4737DBCh 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 6CEEF6 second address: 6CEEFC instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 6CEEFC second address: 6CEF14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c ja 00007FB4C4737DB6h 0x00000012 jc 00007FB4C4737DB6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 6CEF14 second address: 6CEF18 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 6CEF18 second address: 6CEF70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB4C4737DBFh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jns 00007FB4C4737DBEh 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 push edi 0x00000016 pop edi 0x00000017 jmp 00007FB4C4737DC8h 0x0000001c jmp 00007FB4C4737DBCh 0x00000021 popad 0x00000022 push eax 0x00000023 push edx 0x00000024 push edx 0x00000025 pop edx 0x00000026 js 00007FB4C4737DB6h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 6CEF70 second address: 6CEF74 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 6CEF74 second address: 6CEF7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 49F0B98 second address: 49F0BAA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, ax 0x00000006 mov dl, al 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 49F0BAA second address: 49F0BAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 49F0BAE second address: 49F0BB4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 49F0BB4 second address: 49F0BE2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4C4737DC9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FB4C4737DBDh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 49F0BE2 second address: 49F0BE8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 49F0BE8 second address: 49F0BEC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 499073B second address: 499073F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 499073F second address: 499075C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4C4737DC9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 499075C second address: 49907A5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, 6BD2h 0x00000007 call 00007FB4C550E353h 0x0000000c pop esi 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 movsx edi, cx 0x00000017 pushfd 0x00000018 jmp 00007FB4C550E34Ch 0x0000001d jmp 00007FB4C550E355h 0x00000022 popfd 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 49907A5 second address: 49907BD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, 3A92h 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FB4C4737DBBh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 49907BD second address: 49907D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB4C550E354h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 49907D5 second address: 49907D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 49907D9 second address: 499082A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b call 00007FB4C550E34Dh 0x00000010 pop edi 0x00000011 movzx ecx, bx 0x00000014 popad 0x00000015 and esp, FFFFFFF8h 0x00000018 pushad 0x00000019 movsx edi, cx 0x0000001c call 00007FB4C550E34Eh 0x00000021 jmp 00007FB4C550E352h 0x00000026 pop esi 0x00000027 popad 0x00000028 sub esp, 34h 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e mov edx, eax 0x00000030 push ecx 0x00000031 pop edx 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 499082A second address: 4990851 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4C4737DBBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FB4C4737DC5h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 4990851 second address: 4990857 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 4990857 second address: 49908C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FB4C4737DC6h 0x0000000e xchg eax, ebx 0x0000000f jmp 00007FB4C4737DC0h 0x00000014 mov ebx, dword ptr [ebp+08h] 0x00000017 pushad 0x00000018 pushfd 0x00000019 jmp 00007FB4C4737DBEh 0x0000001e sbb esi, 47CDA0E8h 0x00000024 jmp 00007FB4C4737DBBh 0x00000029 popfd 0x0000002a popad 0x0000002b push ebx 0x0000002c pushad 0x0000002d mov ah, FCh 0x0000002f movsx edi, si 0x00000032 popad 0x00000033 mov dword ptr [esp], esi 0x00000036 push eax 0x00000037 push edx 0x00000038 jmp 00007FB4C4737DBBh 0x0000003d rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 49908C5 second address: 499095B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4C550E359h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, edi 0x0000000a pushad 0x0000000b pushad 0x0000000c jmp 00007FB4C550E34Ah 0x00000011 pushfd 0x00000012 jmp 00007FB4C550E352h 0x00000017 add cl, 00000008h 0x0000001a jmp 00007FB4C550E34Bh 0x0000001f popfd 0x00000020 popad 0x00000021 pushfd 0x00000022 jmp 00007FB4C550E358h 0x00000027 jmp 00007FB4C550E355h 0x0000002c popfd 0x0000002d popad 0x0000002e push eax 0x0000002f jmp 00007FB4C550E351h 0x00000034 xchg eax, edi 0x00000035 pushad 0x00000036 push eax 0x00000037 push edx 0x00000038 movzx esi, bx 0x0000003b rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 499095B second address: 49909DE instructions: 0x00000000 rdtsc 0x00000002 call 00007FB4C4737DBFh 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d pop ecx 0x0000000e popad 0x0000000f mov edi, dword ptr [ebp+0Ch] 0x00000012 pushad 0x00000013 call 00007FB4C4737DC7h 0x00000018 pushfd 0x00000019 jmp 00007FB4C4737DC8h 0x0000001e xor cx, 6CB8h 0x00000023 jmp 00007FB4C4737DBBh 0x00000028 popfd 0x00000029 pop ecx 0x0000002a mov bx, 13FCh 0x0000002e popad 0x0000002f mov esi, 00000000h 0x00000034 jmp 00007FB4C4737DC0h 0x00000039 mov dword ptr [esp+10h], esi 0x0000003d push eax 0x0000003e push edx 0x0000003f push eax 0x00000040 push edx 0x00000041 push eax 0x00000042 push edx 0x00000043 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 49909DE second address: 49909E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 49909E2 second address: 49909FF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4C4737DC9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 49909FF second address: 4990A3D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4C550E351h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+14h], esi 0x0000000d jmp 00007FB4C550E34Eh 0x00000012 push dword ptr [edi] 0x00000014 pushad 0x00000015 mov edi, 11A89DF0h 0x0000001a popad 0x0000001b push esp 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007FB4C550E34Bh 0x00000023 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 4990A3D second address: 4990A43 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 4990A43 second address: 4990A47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 4990AB2 second address: 4990AB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 4990AB6 second address: 4990ABA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 4990ABA second address: 4990AC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 4990AC0 second address: 4990B41 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4C550E354h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test eax, eax 0x0000000b jmp 00007FB4C550E350h 0x00000010 jne 00007FB5364AD37Ch 0x00000016 jmp 00007FB4C550E350h 0x0000001b call dword ptr [75980B60h] 0x00000021 mov eax, 75F3E5E0h 0x00000026 ret 0x00000027 pushad 0x00000028 push esi 0x00000029 mov edx, 7F140B00h 0x0000002e pop ebx 0x0000002f movzx ecx, dx 0x00000032 popad 0x00000033 mov eax, dword ptr [eax+54h] 0x00000036 jmp 00007FB4C550E351h 0x0000003b test eax, eax 0x0000003d push eax 0x0000003e push edx 0x0000003f pushad 0x00000040 mov edi, 27CCAEDEh 0x00000045 call 00007FB4C550E34Fh 0x0000004a pop esi 0x0000004b popad 0x0000004c rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 4990B41 second address: 4990B47 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 4990B47 second address: 4990B4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 4990B4B second address: 4990B4F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 4A00842 second address: 4A00848 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 4A00848 second address: 4A0084C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 4A0084C second address: 4A0085D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push dword ptr [ebp+0Ch] 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 4A0085D second address: 4A00861 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 4A00861 second address: 4A00867 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 4A008C4 second address: 4A008F3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4C4737DC9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 movzx eax, al 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FB4C4737DBDh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 49A0C70 second address: 49A0C7F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4C550E34Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 49A0C7F second address: 49A0C85 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 49A0C85 second address: 49A0CAB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a jmp 00007FB4C550E357h 0x0000000f pop ebp 0x00000010 pushad 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 4990FA9 second address: 4990FE1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, di 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebx 0x0000000c jmp 00007FB4C4737DC4h 0x00000011 mov dword ptr [esp], ebp 0x00000014 pushad 0x00000015 movzx eax, bx 0x00000018 push edi 0x00000019 mov si, 7D85h 0x0000001d pop eax 0x0000001e popad 0x0000001f mov ebp, esp 0x00000021 pushad 0x00000022 push eax 0x00000023 push edx 0x00000024 mov ebx, 3528D700h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 49F0778 second address: 49F0812 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FB4C550E34Fh 0x00000009 xor al, FFFFFFAEh 0x0000000c jmp 00007FB4C550E359h 0x00000011 popfd 0x00000012 pushfd 0x00000013 jmp 00007FB4C550E350h 0x00000018 add ax, F228h 0x0000001d jmp 00007FB4C550E34Bh 0x00000022 popfd 0x00000023 popad 0x00000024 pop edx 0x00000025 pop eax 0x00000026 and dword ptr [ebp-04h], 00000000h 0x0000002a jmp 00007FB4C550E356h 0x0000002f mov edx, dword ptr [ebp+0Ch] 0x00000032 pushad 0x00000033 mov eax, 45190B5Dh 0x00000038 mov edi, esi 0x0000003a popad 0x0000003b mov eax, dword ptr [ebp+08h] 0x0000003e jmp 00007FB4C550E354h 0x00000043 mov esi, eax 0x00000045 push eax 0x00000046 push edx 0x00000047 push eax 0x00000048 push edx 0x00000049 pushad 0x0000004a popad 0x0000004b rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 49F0812 second address: 49F0816 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 49F0816 second address: 49F081C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 49F081C second address: 49F089A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4C4737DC4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub esi, edx 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007FB4C4737DC7h 0x00000012 add esi, 7DFB4B8Eh 0x00000018 jmp 00007FB4C4737DC9h 0x0000001d popfd 0x0000001e pushfd 0x0000001f jmp 00007FB4C4737DC0h 0x00000024 add cx, 4E08h 0x00000029 jmp 00007FB4C4737DBBh 0x0000002e popfd 0x0000002f popad 0x00000030 mov cl, byte ptr [edx] 0x00000032 push eax 0x00000033 push edx 0x00000034 push eax 0x00000035 push edx 0x00000036 pushad 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 49F089A second address: 49F08A0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 49F08A0 second address: 49F08BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB4C4737DC9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 49F08BD second address: 49F08F3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4C550E351h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov byte ptr [esi+edx], cl 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FB4C550E358h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 49F08F3 second address: 49F0902 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4C4737DBBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 49F0902 second address: 49F0926 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4C550E359h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 inc edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 49F0926 second address: 49F092A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 49F092A second address: 49F092E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 49F092E second address: 49F0934 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 49F0934 second address: 49F098E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4C550E352h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test cl, cl 0x0000000b pushad 0x0000000c mov cl, C3h 0x0000000e mov bx, 447Eh 0x00000012 popad 0x00000013 jne 00007FB4C550E27Eh 0x00000019 jmp 00007FB4C550E355h 0x0000001e mov dword ptr [ebp-04h], FFFFFFFEh 0x00000025 jmp 00007FB4C550E34Eh 0x0000002a mov ecx, dword ptr [ebp-10h] 0x0000002d push eax 0x0000002e push edx 0x0000002f pushad 0x00000030 push edi 0x00000031 pop eax 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 49F098E second address: 49F0993 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 49F0993 second address: 49F09DC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4C550E354h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr fs:[00000000h], ecx 0x00000010 jmp 00007FB4C550E350h 0x00000015 pop ecx 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FB4C550E357h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 49F09DC second address: 49F0A16 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4C4737DC9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FB4C4737DC8h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 49F0A16 second address: 49F0A1C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 49F0A1C second address: 49F0A42 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx esi, bx 0x00000006 mov dh, 74h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop esi 0x0000000c pushad 0x0000000d push ecx 0x0000000e mov bx, 4440h 0x00000012 pop ebx 0x00000013 movzx ecx, di 0x00000016 popad 0x00000017 pop ebx 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FB4C4737DBCh 0x0000001f rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 49F019E second address: 49F01A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 49F01A2 second address: 49F01EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xor dword ptr [esp], 3987B174h 0x0000000e jmp 00007FB4C4737DBAh 0x00000013 call 00007FB53566BBEEh 0x00000018 push 759227D0h 0x0000001d push dword ptr fs:[00000000h] 0x00000024 mov eax, dword ptr [esp+10h] 0x00000028 mov dword ptr [esp+10h], ebp 0x0000002c lea ebp, dword ptr [esp+10h] 0x00000030 sub esp, eax 0x00000032 push ebx 0x00000033 push esi 0x00000034 push edi 0x00000035 mov eax, dword ptr [759B0140h] 0x0000003a xor dword ptr [ebp-04h], eax 0x0000003d xor eax, ebp 0x0000003f push eax 0x00000040 mov dword ptr [ebp-18h], esp 0x00000043 push dword ptr [ebp-08h] 0x00000046 mov eax, dword ptr [ebp-04h] 0x00000049 mov dword ptr [ebp-04h], FFFFFFFEh 0x00000050 mov dword ptr [ebp-08h], eax 0x00000053 lea eax, dword ptr [ebp-10h] 0x00000056 mov dword ptr fs:[00000000h], eax 0x0000005c ret 0x0000005d jmp 00007FB4C4737DC0h 0x00000062 and dword ptr [ebp-04h], 00000000h 0x00000066 push eax 0x00000067 push edx 0x00000068 jmp 00007FB4C4737DC7h 0x0000006d rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 49F01EC second address: 49F021B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4C550E359h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edx, dword ptr [ebp+0Ch] 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FB4C550E34Dh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 49F021B second address: 49F0225 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, 165E9EE2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 49F0225 second address: 49F02B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov esi, edx 0x00000009 jmp 00007FB4C550E34Fh 0x0000000e mov al, byte ptr [edx] 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007FB4C550E354h 0x00000017 sub eax, 6B72BCA8h 0x0000001d jmp 00007FB4C550E34Bh 0x00000022 popfd 0x00000023 pushfd 0x00000024 jmp 00007FB4C550E358h 0x00000029 add cx, AF08h 0x0000002e jmp 00007FB4C550E34Bh 0x00000033 popfd 0x00000034 popad 0x00000035 inc edx 0x00000036 pushad 0x00000037 mov dx, ax 0x0000003a popad 0x0000003b test al, al 0x0000003d push eax 0x0000003e push edx 0x0000003f jmp 00007FB4C550E358h 0x00000044 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 49F02B4 second address: 49F02C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB4C4737DBEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 49F02C6 second address: 49F02CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 49F02CA second address: 49F02B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007FB4C4737D1Bh 0x0000000e mov al, byte ptr [edx] 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007FB4C4737DC4h 0x00000017 sub eax, 6B72BCA8h 0x0000001d jmp 00007FB4C4737DBBh 0x00000022 popfd 0x00000023 pushfd 0x00000024 jmp 00007FB4C4737DC8h 0x00000029 add cx, AF08h 0x0000002e jmp 00007FB4C4737DBBh 0x00000033 popfd 0x00000034 popad 0x00000035 inc edx 0x00000036 pushad 0x00000037 mov dx, ax 0x0000003a popad 0x0000003b test al, al 0x0000003d push eax 0x0000003e push edx 0x0000003f jmp 00007FB4C4737DC8h 0x00000044 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 49F02F4 second address: 49F035F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FB4C550E351h 0x00000008 pop ecx 0x00000009 mov si, bx 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f sub edx, esi 0x00000011 pushad 0x00000012 mov bx, cx 0x00000015 mov edx, eax 0x00000017 popad 0x00000018 mov edi, dword ptr [ebp+08h] 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e jmp 00007FB4C550E359h 0x00000023 pushfd 0x00000024 jmp 00007FB4C550E350h 0x00000029 jmp 00007FB4C550E355h 0x0000002e popfd 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 49F035F second address: 49F0391 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4C4737DC1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 dec edi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FB4C4737DC8h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 49F0391 second address: 49F03A0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4C550E34Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 49F03A0 second address: 49F03A5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 49F03A5 second address: 49F0423 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007FB4C550E355h 0x0000000a or cl, 00000076h 0x0000000d jmp 00007FB4C550E351h 0x00000012 popfd 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 lea ebx, dword ptr [edi+01h] 0x00000019 jmp 00007FB4C550E34Eh 0x0000001e mov al, byte ptr [edi+01h] 0x00000021 pushad 0x00000022 pushfd 0x00000023 jmp 00007FB4C550E34Eh 0x00000028 xor ch, FFFFFFC8h 0x0000002b jmp 00007FB4C550E34Bh 0x00000030 popfd 0x00000031 push eax 0x00000032 push edx 0x00000033 call 00007FB4C550E356h 0x00000038 pop eax 0x00000039 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 49F0423 second address: 49F0489 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4C4737DBBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a inc edi 0x0000000b pushad 0x0000000c mov eax, edi 0x0000000e popad 0x0000000f test al, al 0x00000011 pushad 0x00000012 call 00007FB4C4737DC3h 0x00000017 pushad 0x00000018 popad 0x00000019 pop esi 0x0000001a call 00007FB4C4737DBFh 0x0000001f jmp 00007FB4C4737DC8h 0x00000024 pop esi 0x00000025 popad 0x00000026 jne 00007FB5356603BBh 0x0000002c push eax 0x0000002d push edx 0x0000002e pushad 0x0000002f movzx ecx, bx 0x00000032 mov ah, bl 0x00000034 popad 0x00000035 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 49F0489 second address: 49F048F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 49F048F second address: 49F0493 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 49F0493 second address: 49F0497 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 49F0497 second address: 49F04B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ecx, edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FB4C4737DC1h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 49F04B6 second address: 49F04BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 49F04BA second address: 49F04C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 49F04C0 second address: 49F0552 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4C550E34Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 shr ecx, 02h 0x0000000c jmp 00007FB4C550E350h 0x00000011 rep movsd 0x00000013 rep movsd 0x00000015 rep movsd 0x00000017 rep movsd 0x00000019 pushad 0x0000001a pushfd 0x0000001b jmp 00007FB4C550E34Eh 0x00000020 sbb ecx, 002D1038h 0x00000026 jmp 00007FB4C550E34Bh 0x0000002b popfd 0x0000002c call 00007FB4C550E358h 0x00000031 jmp 00007FB4C550E352h 0x00000036 pop eax 0x00000037 popad 0x00000038 mov ecx, edx 0x0000003a pushad 0x0000003b push eax 0x0000003c push edx 0x0000003d pushfd 0x0000003e jmp 00007FB4C550E34Dh 0x00000043 jmp 00007FB4C550E34Bh 0x00000048 popfd 0x00000049 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 49F0552 second address: 49F05BA instructions: 0x00000000 rdtsc 0x00000002 call 00007FB4C4737DC8h 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushfd 0x0000000b jmp 00007FB4C4737DBBh 0x00000010 adc ax, FD6Eh 0x00000015 jmp 00007FB4C4737DC9h 0x0000001a popfd 0x0000001b popad 0x0000001c and ecx, 03h 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007FB4C4737DC8h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 49F05BA second address: 49F05C0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 49F05C0 second address: 49F05FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FB4C4737DBCh 0x00000009 sbb esi, 11E07348h 0x0000000f jmp 00007FB4C4737DBBh 0x00000014 popfd 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a rep movsb 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007FB4C4737DBEh 0x00000025 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 49F05FB second address: 49F05FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 49F05FF second address: 49F0605 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 49F0605 second address: 49F061C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, esi 0x00000005 mov ebx, ecx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [ebp-04h], FFFFFFFEh 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 49F061C second address: 49F0622 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 49F0622 second address: 49F06C9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4C550E356h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, ebx 0x0000000b jmp 00007FB4C550E350h 0x00000010 mov ecx, dword ptr [ebp-10h] 0x00000013 jmp 00007FB4C550E350h 0x00000018 mov dword ptr fs:[00000000h], ecx 0x0000001f pushad 0x00000020 mov dl, ch 0x00000022 popad 0x00000023 pop ecx 0x00000024 pushad 0x00000025 push edi 0x00000026 pop eax 0x00000027 call 00007FB4C550E353h 0x0000002c pushfd 0x0000002d jmp 00007FB4C550E358h 0x00000032 or ecx, 4DF6A258h 0x00000038 jmp 00007FB4C550E34Bh 0x0000003d popfd 0x0000003e pop eax 0x0000003f popad 0x00000040 pop edi 0x00000041 jmp 00007FB4C550E34Fh 0x00000046 pop esi 0x00000047 push eax 0x00000048 push edx 0x00000049 pushad 0x0000004a pushad 0x0000004b popad 0x0000004c mov bh, 5Ch 0x0000004e popad 0x0000004f rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 49C08DF second address: 49C092B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4C4737DC1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FB4C4737DC1h 0x0000000f xchg eax, ebp 0x00000010 pushad 0x00000011 mov dx, si 0x00000014 mov ebx, ecx 0x00000016 popad 0x00000017 mov ebp, esp 0x00000019 jmp 00007FB4C4737DC2h 0x0000001e pop ebp 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 mov ah, dl 0x00000024 push eax 0x00000025 pop edi 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 49B0041 second address: 49B0047 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 49B0047 second address: 49B004B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 49B004B second address: 49B005F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e mov eax, 6056AB77h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 49B005F second address: 49B0065 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 49B0065 second address: 49B0069 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 4A00018 second address: 4A0001C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 4A0001C second address: 4A00022 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 4A00022 second address: 4A00028 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 4A00028 second address: 4A0002C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 4A0002C second address: 4A000F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 call 00007FB4C4737DB9h 0x0000000d pushad 0x0000000e mov di, 6226h 0x00000012 pushfd 0x00000013 jmp 00007FB4C4737DC7h 0x00000018 xor si, F4AEh 0x0000001d jmp 00007FB4C4737DC9h 0x00000022 popfd 0x00000023 popad 0x00000024 push eax 0x00000025 pushad 0x00000026 mov bx, 4BC2h 0x0000002a popad 0x0000002b mov eax, dword ptr [esp+04h] 0x0000002f pushad 0x00000030 call 00007FB4C4737DC5h 0x00000035 push esi 0x00000036 pop edi 0x00000037 pop ecx 0x00000038 mov bx, 2370h 0x0000003c popad 0x0000003d mov eax, dword ptr [eax] 0x0000003f jmp 00007FB4C4737DC6h 0x00000044 mov dword ptr [esp+04h], eax 0x00000048 pushad 0x00000049 pushfd 0x0000004a jmp 00007FB4C4737DC1h 0x0000004f add ecx, 6522A7A6h 0x00000055 jmp 00007FB4C4737DC1h 0x0000005a popfd 0x0000005b mov dx, cx 0x0000005e popad 0x0000005f pop eax 0x00000060 push eax 0x00000061 push edx 0x00000062 push eax 0x00000063 push edx 0x00000064 push eax 0x00000065 push edx 0x00000066 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 4A000F5 second address: 4A000F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 4A000F9 second address: 4A000FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 4A000FD second address: 4A00103 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 4A00103 second address: 4A00121 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4C4737DBEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 call 00007FB534DCE62Bh 0x0000000e push 75094FB0h 0x00000013 push dword ptr fs:[00000000h] 0x0000001a mov eax, dword ptr [esp+10h] 0x0000001e mov dword ptr [esp+10h], ebp 0x00000022 lea ebp, dword ptr [esp+10h] 0x00000026 sub esp, eax 0x00000028 push ebx 0x00000029 push esi 0x0000002a push edi 0x0000002b mov eax, dword ptr [750DA500h] 0x00000030 xor dword ptr [ebp-04h], eax 0x00000033 xor eax, ebp 0x00000035 mov dword ptr [ebp-1Ch], eax 0x00000038 push eax 0x00000039 mov dword ptr [ebp-18h], esp 0x0000003c push dword ptr [ebp-08h] 0x0000003f mov eax, dword ptr [ebp-04h] 0x00000042 mov dword ptr [ebp-04h], FFFFFFFEh 0x00000049 mov dword ptr [ebp-08h], eax 0x0000004c lea eax, dword ptr [ebp-10h] 0x0000004f mov dword ptr fs:[00000000h], eax 0x00000055 ret 0x00000056 push eax 0x00000057 push edx 0x00000058 pushad 0x00000059 mov esi, ebx 0x0000005b push eax 0x0000005c push edx 0x0000005d rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 4A00121 second address: 4A00126 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 4A00126 second address: 4A001A0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4C4737DC4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebx, dword ptr [ebp+08h] 0x0000000c pushad 0x0000000d mov edx, eax 0x0000000f mov ecx, 062BA269h 0x00000014 popad 0x00000015 sub edi, edi 0x00000017 pushad 0x00000018 pushad 0x00000019 mov esi, edi 0x0000001b pushfd 0x0000001c jmp 00007FB4C4737DBDh 0x00000021 jmp 00007FB4C4737DBBh 0x00000026 popfd 0x00000027 popad 0x00000028 pushfd 0x00000029 jmp 00007FB4C4737DC8h 0x0000002e or cx, 0F98h 0x00000033 jmp 00007FB4C4737DBBh 0x00000038 popfd 0x00000039 popad 0x0000003a inc edi 0x0000003b push eax 0x0000003c push edx 0x0000003d pushad 0x0000003e movsx ebx, ax 0x00000041 mov cl, 04h 0x00000043 popad 0x00000044 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 4A001A0 second address: 4A001B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB4C550E355h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 4A001B9 second address: 4A001F0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 and dword ptr [ebp-04h], 00000000h 0x0000000c jmp 00007FB4C4737DBDh 0x00000011 test ebx, ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007FB4C4737DC8h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 4A001F0 second address: 4A001FF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4C550E34Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 4A002BD second address: 4A002C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 4A002C3 second address: 4A002C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 4A002C7 second address: 4A002E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [ebp-00000110h] 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FB4C4737DBEh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 4A002E5 second address: 4A002F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB4C550E34Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 4A002F7 second address: 4A002FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 4A002FB second address: 4A0030F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [ebx], eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov ch, 14h 0x0000000f mov dx, 9688h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 4A0030F second address: 4A00315 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 4A00315 second address: 4A00319 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 4A00319 second address: 4A00334 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 lea ecx, dword ptr [ebp-0000010Ch] 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FB4C4737DBBh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 4A00334 second address: 4A0033B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov al, dl 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 4A00361 second address: 4A00365 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 4A00365 second address: 4A0036B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 4A0036B second address: 4A00371 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 4A00371 second address: 4A00375 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 4A00375 second address: 4A0039F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4C4737DC8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [ebp-00000118h], eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 4A0039F second address: 4A003A5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 4A003A5 second address: 4A003AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 4A003AB second address: 4A003AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 4A003AF second address: 4A00427 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4C4737DBEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test eax, eax 0x0000000d jmp 00007FB4C4737DC0h 0x00000012 je 00007FB534DDAAA4h 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b pushfd 0x0000001c jmp 00007FB4C4737DBDh 0x00000021 sub ecx, 795C0326h 0x00000027 jmp 00007FB4C4737DC1h 0x0000002c popfd 0x0000002d pushfd 0x0000002e jmp 00007FB4C4737DC0h 0x00000033 adc ax, 34C8h 0x00000038 jmp 00007FB4C4737DBBh 0x0000003d popfd 0x0000003e popad 0x0000003f rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 4A00427 second address: 4A0049B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4C550E359h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007FB4C550E34Ch 0x00000011 jmp 00007FB4C550E355h 0x00000016 popfd 0x00000017 pushfd 0x00000018 jmp 00007FB4C550E350h 0x0000001d sbb si, C4B8h 0x00000022 jmp 00007FB4C550E34Bh 0x00000027 popfd 0x00000028 popad 0x00000029 push eax 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d mov esi, 29CBB201h 0x00000032 mov eax, 44406D3Dh 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 4A0049B second address: 4A004D7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4C4737DC3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a jmp 00007FB4C4737DC6h 0x0000000f lea ecx, dword ptr [ebx+04h] 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 pushad 0x00000016 popad 0x00000017 mov ebx, 67F8788Eh 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 4A00563 second address: 4A0057F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, esi 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push dword ptr [ebp-00000118h] 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FB4C550E34Ch 0x00000015 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 4A00BB0 second address: 4A00BF5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push ebp 0x00000008 jmp 00007FB4C4737DC2h 0x0000000d mov dword ptr [esp], ebp 0x00000010 jmp 00007FB4C4737DC0h 0x00000015 mov ebp, esp 0x00000017 pushad 0x00000018 pushad 0x00000019 mov ecx, 59831453h 0x0000001e pushad 0x0000001f popad 0x00000020 popad 0x00000021 mov cx, 1645h 0x00000025 popad 0x00000026 pop ebp 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 4A00BF5 second address: 4A00BF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 4A00BF9 second address: 4A00BFF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 4A00C53 second address: 4A00C62 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4C550E34Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 4A00C62 second address: 4A00C68 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 4A00C68 second address: 4A00C6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 4A00C6C second address: 4A00CD5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4C4737DBBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007FB4C4737DC9h 0x00000011 xchg eax, ebp 0x00000012 pushad 0x00000013 mov al, C7h 0x00000015 pushfd 0x00000016 jmp 00007FB4C4737DC9h 0x0000001b and ecx, 54D6FC46h 0x00000021 jmp 00007FB4C4737DC1h 0x00000026 popfd 0x00000027 popad 0x00000028 mov ebp, esp 0x0000002a pushad 0x0000002b mov bl, ah 0x0000002d push eax 0x0000002e push edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 4A0098A second address: 4A009D5 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FB4C550E34Bh 0x00000008 sub cx, 01EEh 0x0000000d jmp 00007FB4C550E359h 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 popad 0x00000016 mov ebp, esp 0x00000018 jmp 00007FB4C550E34Eh 0x0000001d pop ebp 0x0000001e pushad 0x0000001f mov cl, ACh 0x00000021 push eax 0x00000022 push edx 0x00000023 mov ebx, 42E709ACh 0x00000028 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 49C0A9F second address: 49C0AB6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4C4737DC3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 49C0AB6 second address: 49C0ACE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB4C550E354h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 49C0ACE second address: 49C0AF4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4C4737DBBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FB4C4737DC0h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 49C0AF4 second address: 49C0AF8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 49C0AF8 second address: 49C0AFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 49C079D second address: 49C07C6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dl, ah 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, ebp 0x0000000b jmp 00007FB4C550E359h 0x00000010 mov ebp, esp 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 499001B second address: 4990021 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 4990021 second address: 49900CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov ch, 58h 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c mov ecx, edi 0x0000000e popad 0x0000000f xchg eax, ebp 0x00000010 jmp 00007FB4C550E351h 0x00000015 mov ebp, esp 0x00000017 pushad 0x00000018 pushad 0x00000019 pushad 0x0000001a popad 0x0000001b movzx eax, di 0x0000001e popad 0x0000001f pushfd 0x00000020 jmp 00007FB4C550E355h 0x00000025 sub ah, 00000056h 0x00000028 jmp 00007FB4C550E351h 0x0000002d popfd 0x0000002e popad 0x0000002f and esp, FFFFFFF8h 0x00000032 pushad 0x00000033 pushfd 0x00000034 jmp 00007FB4C550E34Ch 0x00000039 jmp 00007FB4C550E355h 0x0000003e popfd 0x0000003f jmp 00007FB4C550E350h 0x00000044 popad 0x00000045 sub esp, 2Ch 0x00000048 push eax 0x00000049 push edx 0x0000004a jmp 00007FB4C550E357h 0x0000004f rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 49900CC second address: 49900D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 49900D2 second address: 49900D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 49900D6 second address: 4990103 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4C4737DBBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [759B0140h] 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FB4C4737DC5h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 4990103 second address: 4990179 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4C550E351h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor eax, esp 0x0000000b pushad 0x0000000c call 00007FB4C550E34Dh 0x00000011 call 00007FB4C550E350h 0x00000016 pop eax 0x00000017 pop edi 0x00000018 jmp 00007FB4C550E350h 0x0000001d popad 0x0000001e mov dword ptr [esp+28h], eax 0x00000022 jmp 00007FB4C550E350h 0x00000027 xchg eax, ebx 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007FB4C550E357h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 4990179 second address: 49901C8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4C4737DC9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FB4C4737DC1h 0x0000000f xchg eax, ebx 0x00000010 jmp 00007FB4C4737DBEh 0x00000015 mov ebx, dword ptr [ebp+0Ch] 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007FB4C4737DBAh 0x00000021 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 49901C8 second address: 49901CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 49901CC second address: 49901D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 49901D2 second address: 49901D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 49901D8 second address: 49901DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 49901DC second address: 4990232 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4C550E358h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b lea eax, dword ptr [esp+08h] 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 jmp 00007FB4C550E34Dh 0x00000017 pushfd 0x00000018 jmp 00007FB4C550E350h 0x0000001d adc esi, 563B1868h 0x00000023 jmp 00007FB4C550E34Bh 0x00000028 popfd 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\q3na5Mc.exe	RDTSC instruction interceptor: First address: 4990232 second address: 4990238 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\q3na5Mc.exe	Special instruction interceptor: First address: 42CA89 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\q3na5Mc.exe	Special instruction interceptor: First address: 5DD8D8 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\q3na5Mc.exe	Special instruction interceptor: First address: 42A6E2 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\q3na5Mc.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\q3na5Mc.exe

Code function: 0_2_04980C9C rdtsc

0_2_04980C9C

Source: C:\Users\user\Desktop\q3na5Mc.exe	Window / User API: threadDelayed 1334	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	Window / User API: threadDelayed 1609	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	Window / User API: threadDelayed 1314	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	Window / User API: threadDelayed 1196	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	Window / User API: threadDelayed 1522	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	Window / User API: threadDelayed 1342	Jump to behavior

Source: C:\Users\user\Desktop\q3na5Mc.exe TID: 2788	Thread sleep count: 42 > 30	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe TID: 2788	Thread sleep time: -84042s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe TID: 6476	Thread sleep count: 1334 > 30	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe TID: 6476	Thread sleep time: -2669334s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe TID: 5604	Thread sleep time: -36000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe TID: 1088	Thread sleep count: 1609 > 30	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe TID: 1088	Thread sleep time: -3219609s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe TID: 5960	Thread sleep count: 1314 > 30	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe TID: 5960	Thread sleep time: -2629314s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe TID: 5352	Thread sleep count: 1196 > 30	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe TID: 5352	Thread sleep time: -2393196s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe TID: 360	Thread sleep count: 1522 > 30	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe TID: 360	Thread sleep time: -3045522s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe TID: 940	Thread sleep count: 1342 > 30	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe TID: 940	Thread sleep time: -2685342s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\q3na5Mc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: q3na5Mc.exe, q3na5Mc.exe, 00000000.00000002.4576941757.00000000005C1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: chrome.exe, 00000004.00000002.3579640321.00003AB00073C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware
Source: Web Data.8.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: chrome.exe, 00000004.00000002.3583113361.00003AB0010D4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware Virtual USB Mouse
Source: chrome.exe, 00000004.00000002.3579595888.00003AB00072C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: USB device added: path=\\?\usb#vid_0e0f&pid_0003#5&2dda038&0&5#{a5dcbf10-6530-11d2-901f-00c04fb951ed} vendor=3599 "VMware", product=3 "VMware Virtual USB Mouse", serial="", driver="usbccgp", guid=49b9b97e-0f4d-42db-8234-f21ba2e9dc18
Source: chrome.exe, 00000004.00000002.3432242594.0000017437ED0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}&
Source: Web Data.8.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: Web Data.8.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: Web Data.8.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: Web Data.8.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: q3na5Mc.exe, 00000000.00000002.4578351064.0000000000A62000.00000004.00000020.00020000.00000000.sdmp, q3na5Mc.exe, 00000000.00000003.2118289142.0000000000A62000.00000004.00000020.00020000.00000000.sdmp, q3na5Mc.exe, 00000000.00000003.2156986213.0000000000A62000.00000004.00000020.00020000.00000000.sdmp, q3na5Mc.exe, 00000000.00000003.2230766451.0000000000A62000.00000004.00000020.00020000.00000000.sdmp, q3na5Mc.exe, 00000000.00000003.2134344430.0000000000A62000.00000004.00000020.00020000.00000000.sdmp, q3na5Mc.exe, 00000000.00000003.2209213432.0000000000A62000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: msedge.exe, 00000007.00000003.3416308476.00001D9400314000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware20,1(
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: Web Data.8.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: Web Data.8.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: Web Data.8.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: Web Data.8.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: Web Data.8.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: Web Data.8.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: chrome.exe, 00000004.00000002.3428897728.00000174343F8000.00000004.00000020.00020000.00000000.sdmp, msedge.exe, 00000007.00000002.3451705100.00000217EC245000.00000004.00000020.00020000.00000000.sdmp, msedge.exe, 00000010.00000002.3655623222.000001FE8AA43000.00000004.00000020.00020000.00000000.sdmp, msedge.exe, 00000012.00000002.3811272605.000001E98AC44000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Web Data.8.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: Web Data.8.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: Web Data.8.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: Web Data.8.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: Web Data.8.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: q3na5Mc.exe, 00000000.00000002.4578351064.0000000000A2F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`{
Source: Web Data.8.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: Web Data.8.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: Web Data.8.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: Web Data.8.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: Web Data.8.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: chrome.exe, 00000004.00000002.3432242594.0000017437F79000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: War&Prod_VMware_@
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: chrome.exe, 00000004.00000002.3432242594.0000017437ED0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}8b}/
Source: Web Data.8.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: q3na5Mc.exe, 00000000.00000002.4576941757.00000000005C1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: Web Data.8.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: chrome.exe, 00000004.00000002.3432242594.0000017437ED0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\@
Source: Web Data.8.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\q3na5Mc.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\q3na5Mc.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\q3na5Mc.exe

Thread information set: HideFromDebugger

Jump to behavior

Potentially malicious time measurement code found

Source: C:\Users\user\Desktop\q3na5Mc.exe	Code function: 0_2_049801BB Start: 04980996 End: 04980276	0_2_049801BB
Source: C:\Users\user\Desktop\q3na5Mc.exe	Code function: 0_2_04980CAD Start: 04980D6D End: 04980CC6	0_2_04980CAD
Source: C:\Users\user\Desktop\q3na5Mc.exe	Code function: 0_2_049D0ACF Start: 049D0C79 End: 049D0B90	0_2_049D0ACF
Source: C:\Users\user\Desktop\q3na5Mc.exe	Code function: 0_2_049D087C Start: 049D0C79 End: 049D088B	0_2_049D087C
Source: C:\Users\user\Desktop\q3na5Mc.exe	Code function: 0_2_049E01F7 Start: 049E058C End: 049E0213	0_2_049E01F7

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\q3na5Mc.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\q3na5Mc.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\q3na5Mc.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\q3na5Mc.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\q3na5Mc.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\q3na5Mc.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\q3na5Mc.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\q3na5Mc.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\q3na5Mc.exe	File opened: NTICE
Source: C:\Users\user\Desktop\q3na5Mc.exe	File opened: SICE
Source: C:\Users\user\Desktop\q3na5Mc.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\q3na5Mc.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\q3na5Mc.exe

Code function: 0_2_04980C9C rdtsc

0_2_04980C9C

Source: q3na5Mc.exe, q3na5Mc.exe, 00000000.00000002.4576941757.00000000005C1000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: X9Program Manager

Source: C:\Users\user\Desktop\q3na5Mc.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\q3na5Mc.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\q3na5Mc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Vidar stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: 00000000.00000003.2156986213.0000000000A62000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2230766451.0000000000A62000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2209213432.0000000000A62000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: q3na5Mc.exe PID: 4324, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\q3na5Mc.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\temporary\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore-backups\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\bookmarkbackups\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\to-be-removed\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\db\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\events\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\security_state\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2918063365piupsah.files\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\crashes\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\pending_pings\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\saved-telemetry-pings\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\minidumps\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\crashes\events\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\default\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\tmp\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\q3na5Mc.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\key4.db	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\q3na5Mc.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Source: Yara match

File source: Process Memory Space: q3na5Mc.exe PID: 4324, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\q3na5Mc.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"

Yara detected Vidar stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: 00000000.00000003.2156986213.0000000000A62000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2230766451.0000000000A62000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2209213432.0000000000A62000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: q3na5Mc.exe PID: 4324, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 Create Account	2 Process Injection	1 Masquerading	2 OS Credential Dumping	11 Query Registry	Remote Services	2 Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	24 Virtualization/Sandbox Evasion	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Remote Access Software	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 DLL Side-Loading	2 Process Injection	Security Account Manager	24 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Extra Window Memory Injection	3 Obfuscated Files or Information	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	4 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Software Packing	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	15 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Extra Window Memory Injection	DCSync	223 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report q3na5Mc.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Protection of GUI

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
q3na5Mc.exe