Windows Analysis Report
94g4KHMj9B.exe

Overview

General Information

Sample name: 94g4KHMj9B.exe
renamed because original name is a hash value
Original sample name: bc9903cd12a6b359c28e16021909ccb3.exe
Analysis ID: 1579683
MD5: bc9903cd12a6b359c28e16021909ccb3
SHA1: 1b444289d8df7755f1d779b9862c8e4995ee6d55
SHA256: 072e228bf10d03818ed7869a52bdc386d0bd437923044fb98e2a29ae2ff4591a
Tags: exeuser-abuse_ch
Infos:

Detection

Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Detected unpacking (changes PE section rights)
Multi AV Scanner detection for submitted file
AI detected suspicious sample
Hides threads from debuggers
Machine Learning detection for sample
PE file contains section with special chars
Potentially malicious time measurement code found
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
AV process strings found (often used to terminate AV products)
Checks for debuggers (devices)
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality for execution timing, often used to detect debuggers
Entry point lies outside standard sections
Found large amount of non-executed APIs
HTTP GET or POST without a user agent
IP address seen in connection with other malware
One or more processes crash
PE file contains an invalid checksum
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Uses 32bit PE files

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: 94g4KHMj9B.exe Avira: detected
Multi AV Scanner detection for submitted file
Source: 94g4KHMj9B.exe Virustotal: Detection: 42% Perma Link
Source: 94g4KHMj9B.exe ReversingLabs: Detection: 68%
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for sample
Source: 94g4KHMj9B.exe Joe Sandbox ML: detected
Source: 94g4KHMj9B.exe, 00000000.00000002.1650797309.0000000000AFD000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: -----BEGIN PUBLIC KEY----- memstr_d704cd38-0
Uses 32bit PE files
Source: 94g4KHMj9B.exe Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /ip HTTP/1.1Host: httpbin.orgAccept: */*
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 34.226.108.155 34.226.108.155
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /ip HTTP/1.1Host: httpbin.orgAccept: */*
Source: global traffic DNS traffic detected: DNS query: httpbin.org
Source: global traffic DNS traffic detected: DNS query: home.fivetk5ht.top
Source: 94g4KHMj9B.exe, 00000000.00000002.1650797309.0000000000AFD000.00000040.00000001.01000000.00000003.sdmp, 94g4KHMj9B.exe, 00000000.00000003.1461567252.00000000075D6000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://.css
Source: 94g4KHMj9B.exe, 00000000.00000002.1650797309.0000000000AFD000.00000040.00000001.01000000.00000003.sdmp, 94g4KHMj9B.exe, 00000000.00000003.1461567252.00000000075D6000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://.jpg
Source: 94g4KHMj9B.exe, 00000000.00000002.1652230066.0000000001991000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://home.fivetk5ht.top/zldPR
Source: 94g4KHMj9B.exe, 00000000.00000003.1461567252.00000000075D6000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://home.fivetk5ht.top/zldPRFrmVFHTtKntGpOv17
Source: 94g4KHMj9B.exe, 00000000.00000002.1652230066.000000000190E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://home.fivetk5ht.top/zldPRFrmVFHTtKntGpOv1734579851
Source: 94g4KHMj9B.exe, 00000000.00000002.1652230066.000000000190E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://home.fivetk5ht.top/zldPRFrmVFHTtKntGpOv17345798516963
Source: 94g4KHMj9B.exe, 00000000.00000002.1652230066.000000000190E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://home.fivetk5ht.top/zldPRFrmVFHTtKntGpOv1734579851fff::3
Source: 94g4KHMj9B.exe, 00000000.00000002.1650797309.0000000000AFD000.00000040.00000001.01000000.00000003.sdmp String found in binary or memory: http://home.fivetk5ht.top/zldPRFrmVFHTtKntGpOv1734579851http://home.fivetk5ht.top/zldPRFrmVFHTtKntGp
Source: 94g4KHMj9B.exe, 00000000.00000002.1650797309.0000000000AFD000.00000040.00000001.01000000.00000003.sdmp, 94g4KHMj9B.exe, 00000000.00000003.1461567252.00000000075D6000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://html4/loose.dtd
Source: Amcache.hve.4.dr String found in binary or memory: http://upx.sf.net
Source: 94g4KHMj9B.exe, 00000000.00000003.1461567252.00000000075D6000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: 94g4KHMj9B.exe, 00000000.00000003.1461567252.00000000075D6000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://curl.se/docs/hsts.html
Source: 94g4KHMj9B.exe, 00000000.00000002.1650797309.0000000000AFD000.00000040.00000001.01000000.00000003.sdmp, 94g4KHMj9B.exe, 00000000.00000003.1461567252.00000000075D6000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: 94g4KHMj9B.exe, 00000000.00000002.1650797309.0000000000AFD000.00000040.00000001.01000000.00000003.sdmp, 94g4KHMj9B.exe, 00000000.00000003.1461567252.00000000075D6000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://httpbin.org/ip
Source: 94g4KHMj9B.exe, 00000000.00000002.1650797309.0000000000AFD000.00000040.00000001.01000000.00000003.sdmp, 94g4KHMj9B.exe, 00000000.00000003.1461567252.00000000075D6000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://httpbin.org/ipbefore
Source: unknown Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49704

System Summary
barindex
PE file contains section with special chars
Source: 94g4KHMj9B.exe Static PE information: section name:
Source: 94g4KHMj9B.exe Static PE information: section name: .idata
Source: 94g4KHMj9B.exe Static PE information: section name:
One or more processes crash
Source: C:\Users\user\Desktop\94g4KHMj9B.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3272 -s 1136
Uses 32bit PE files
Source: 94g4KHMj9B.exe Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
Source: 94g4KHMj9B.exe Static PE information: Section: ibyjowhj ZLIB complexity 0.9943412810580681
Source: classification engine Classification label: mal100.evad.winEXE@2/5@14/1
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess3272
Source: C:\Users\user\Desktop\94g4KHMj9B.exe Mutant created: \Sessions\1\BaseNamedObjects\My_mutex
Source: C:\Windows\SysWOW64\WerFault.exe File created: C:\ProgramData\Microsoft\Windows\WER\Temp\58f3c164-3476-4b26-b8d6-aaf5d44af5ec Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: 94g4KHMj9B.exe Virustotal: Detection: 42%
Source: 94g4KHMj9B.exe ReversingLabs: Detection: 68%
Source: 94g4KHMj9B.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: unknown Process created: C:\Users\user\Desktop\94g4KHMj9B.exe "C:\Users\user\Desktop\94g4KHMj9B.exe"
Source: C:\Users\user\Desktop\94g4KHMj9B.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3272 -s 1136
Source: C:\Users\user\Desktop\94g4KHMj9B.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe Section loaded: napinsp.dll Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe Section loaded: pnrpnsp.dll Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe Section loaded: wshbth.dll Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe Section loaded: winrnr.dll Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe Section loaded: napinsp.dll Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe Section loaded: pnrpnsp.dll Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe Section loaded: wshbth.dll Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe Section loaded: winrnr.dll Jump to behavior
Source: 94g4KHMj9B.exe Static file information: File size 4490240 > 1048576
Source: 94g4KHMj9B.exe Static PE information: Raw size of is bigger than: 0x100000 < 0x284c00
Source: 94g4KHMj9B.exe Static PE information: Raw size of ibyjowhj is bigger than: 0x100000 < 0x1bfc00

Data Obfuscation
barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\user\Desktop\94g4KHMj9B.exe Unpacked PE file: 0.2.94g4KHMj9B.exe.520000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ibyjowhj:EW;mvafozls:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ibyjowhj:EW;mvafozls:EW;.taggant:EW;
Entry point lies outside standard sections
Source: initial sample Static PE information: section where entry point is pointing to: .taggant
PE file contains an invalid checksum
Source: 94g4KHMj9B.exe Static PE information: real checksum: 0x45151d should be: 0x4497ae
PE file contains sections with non-standard names
Source: 94g4KHMj9B.exe Static PE information: section name:
Source: 94g4KHMj9B.exe Static PE information: section name: .idata
Source: 94g4KHMj9B.exe Static PE information: section name:
Source: 94g4KHMj9B.exe Static PE information: section name: ibyjowhj
Source: 94g4KHMj9B.exe Static PE information: section name: mvafozls
Source: 94g4KHMj9B.exe Static PE information: section name: .taggant
Source: 94g4KHMj9B.exe Static PE information: section name: ibyjowhj entropy: 7.955270488785443

Boot Survival
barindex
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Source: C:\Users\user\Desktop\94g4KHMj9B.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe Window searched: window name: Filemonclass Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Source: C:\Users\user\Desktop\94g4KHMj9B.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: 94g4KHMj9B.exe, 00000000.00000002.1650797309.0000000000AFD000.00000040.00000001.01000000.00000003.sdmp, 94g4KHMj9B.exe, 00000000.00000003.1461567252.00000000075D6000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: PROCMON.EXE
Source: 94g4KHMj9B.exe, 00000000.00000002.1650797309.0000000000AFD000.00000040.00000001.01000000.00000003.sdmp, 94g4KHMj9B.exe, 00000000.00000003.1461567252.00000000075D6000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: X64DBG.EXE
Source: 94g4KHMj9B.exe, 00000000.00000002.1650797309.0000000000AFD000.00000040.00000001.01000000.00000003.sdmp, 94g4KHMj9B.exe, 00000000.00000003.1461567252.00000000075D6000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: WINDBG.EXE
Source: 94g4KHMj9B.exe, 00000000.00000003.1461567252.00000000075D6000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: SYSINTERNALSNUM_PROCESSORNUM_RAMNAMEALLFREEDRIVERSNUM_DISPLAYSRESOLUTION_XRESOLUTION_Y\*RECENT_FILESPROCESSESUPTIME_MINUTESC:\WINDOWS\SYSTEM32\VBOX*.DLL01VBOX_FIRSTSYSTEM\CONTROLSET001\SERVICES\VBOXSFVBOX_SECONDC:\USERS\PUBLIC\PUBLIC_CHECKWINDBG.EXEDBGWIRESHARK.EXEPROCMON.EXEX64DBG.EXEIDA.EXEDBG_SECDBG_THIRDYADROINSTALLED_APPSSOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALLSOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL%D%S\%SDISPLAYNAMEAPP_NAMEINDEXCREATETOOLHELP32SNAPSHOT FAILED.
Source: 94g4KHMj9B.exe, 00000000.00000002.1650797309.0000000000AFD000.00000040.00000001.01000000.00000003.sdmp, 94g4KHMj9B.exe, 00000000.00000003.1461567252.00000000075D6000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: WIRESHARK.EXE
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: DE709B second address: DE709F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: DE709F second address: DE70B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB41C53h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: DE70B6 second address: DE70C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 ja 00007F4D4CB43A26h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: DE7217 second address: DE7221 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F4D4CB41C46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: DE7221 second address: DE7250 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB43A2Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jmp 00007F4D4CB43A38h 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: DE7250 second address: DE7255 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: DE7255 second address: DE7269 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push edi 0x00000004 pop edi 0x00000005 je 00007F4D4CB43A26h 0x0000000b pop ebx 0x0000000c jnc 00007F4D4CB43A2Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: DE73AA second address: DE73AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: DE73AF second address: DE73DD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB43A2Ch 0x00000007 jmp 00007F4D4CB43A39h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: DE73DD second address: DE73E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: DE73E1 second address: DE73E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: DE73E5 second address: DE73EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: DE8C50 second address: DE8C54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: DE8C54 second address: DE8C5A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: DE8C5A second address: DE8C7F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F4D4CB43A37h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: DE8C7F second address: DE8C89 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F4D4CB41C4Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: DE8C89 second address: DE8C97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [eax] 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: DE8C97 second address: DE8C9D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: DE8D42 second address: DE8DB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 xor dword ptr [esp], 22D911C8h 0x0000000c call 00007F4D4CB43A2Eh 0x00000011 adc edi, 0C17A5BFh 0x00000017 pop esi 0x00000018 push 00000003h 0x0000001a sbb esi, 03EB6F7Bh 0x00000020 push 00000000h 0x00000022 mov edi, eax 0x00000024 push 00000003h 0x00000026 jns 00007F4D4CB43A28h 0x0000002c mov esi, edi 0x0000002e push A0F78A52h 0x00000033 push eax 0x00000034 jno 00007F4D4CB43A28h 0x0000003a pop eax 0x0000003b xor dword ptr [esp], 60F78A52h 0x00000042 mov cl, bh 0x00000044 lea ebx, dword ptr [ebp+12450B91h] 0x0000004a jmp 00007F4D4CB43A2Fh 0x0000004f mov edx, edi 0x00000051 xchg eax, ebx 0x00000052 push eax 0x00000053 push edx 0x00000054 pushad 0x00000055 jne 00007F4D4CB43A26h 0x0000005b push eax 0x0000005c push edx 0x0000005d rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: DE8DB4 second address: DE8DB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: DE8DB9 second address: DE8DBF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: DE8F18 second address: DE8F1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: DE8F1C second address: DE8F22 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: DE8F22 second address: DE8F3F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F4D4CB41C51h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: DE8F3F second address: DE8FF8 instructions: 0x00000000 rdtsc 0x00000002 js 00007F4D4CB43A2Ch 0x00000008 ja 00007F4D4CB43A26h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 push edi 0x00000015 pushad 0x00000016 pushad 0x00000017 popad 0x00000018 pushad 0x00000019 popad 0x0000001a popad 0x0000001b pop edi 0x0000001c pop eax 0x0000001d xor dword ptr [ebp+122D2811h], edi 0x00000023 push 00000003h 0x00000025 ja 00007F4D4CB43A2Bh 0x0000002b push 00000000h 0x0000002d and esi, dword ptr [ebp+122D36EEh] 0x00000033 push 00000003h 0x00000035 call 00007F4D4CB43A33h 0x0000003a pushad 0x0000003b jnc 00007F4D4CB43A26h 0x00000041 push edx 0x00000042 pop eax 0x00000043 popad 0x00000044 pop edi 0x00000045 call 00007F4D4CB43A29h 0x0000004a jmp 00007F4D4CB43A2Ch 0x0000004f push eax 0x00000050 push ebx 0x00000051 push ebx 0x00000052 jmp 00007F4D4CB43A33h 0x00000057 pop ebx 0x00000058 pop ebx 0x00000059 mov eax, dword ptr [esp+04h] 0x0000005d jmp 00007F4D4CB43A33h 0x00000062 mov eax, dword ptr [eax] 0x00000064 jmp 00007F4D4CB43A30h 0x00000069 mov dword ptr [esp+04h], eax 0x0000006d push eax 0x0000006e push edx 0x0000006f pushad 0x00000070 push ecx 0x00000071 pop ecx 0x00000072 push eax 0x00000073 push edx 0x00000074 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: DE8FF8 second address: DE8FFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: DE8FFD second address: DE9008 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007F4D4CB43A26h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E08E0A second address: E08E0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E08E0E second address: E08E14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E0937A second address: E09383 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E097F2 second address: E097F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E097F8 second address: E097FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E09A67 second address: E09A74 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F4D4CB43A26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E09A74 second address: E09A7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E0172B second address: E01736 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E01736 second address: E0173A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E0173A second address: E0173E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E0173E second address: E01744 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E01744 second address: E0176B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4D4CB43A33h 0x00000009 jmp 00007F4D4CB43A30h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E09BE1 second address: E09BFD instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F4D4CB41C54h 0x00000008 jmp 00007F4D4CB41C4Eh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push edi 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E09BFD second address: E09C15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4D4CB43A32h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E0A433 second address: E0A437 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E12514 second address: E12539 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F4D4CB43A26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jng 00007F4D4CB43A26h 0x00000015 jmp 00007F4D4CB43A2Fh 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E12539 second address: E12540 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E12947 second address: E12952 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F4D4CB43A26h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E12952 second address: E1295C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F4D4CB41C46h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E1295C second address: E12982 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB43A39h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pushad 0x00000010 popad 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E12AB2 second address: E12ACC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB41C52h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E12ACC second address: E12AF0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edi 0x00000009 jng 00007F4D4CB43A28h 0x0000000f pushad 0x00000010 popad 0x00000011 pop edi 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 jbe 00007F4D4CB43A32h 0x0000001c je 00007F4D4CB43A2Ch 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E12AF0 second address: E12AFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov eax, dword ptr [eax] 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E12AFB second address: E12AFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E12AFF second address: E12B03 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E1147E second address: E11482 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E11482 second address: E11488 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E18B59 second address: E18B6C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB43A2Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E18B6C second address: E18B81 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB41C4Eh 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E18035 second address: E18039 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E18039 second address: E1803D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E18169 second address: E1816F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E1816F second address: E181A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F4D4CB41C46h 0x0000000a jmp 00007F4D4CB41C59h 0x0000000f popad 0x00000010 jmp 00007F4D4CB41C54h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E181A7 second address: E181EC instructions: 0x00000000 rdtsc 0x00000002 jg 00007F4D4CB43A2Eh 0x00000008 jp 00007F4D4CB43A26h 0x0000000e pushad 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 jmp 00007F4D4CB43A39h 0x00000018 push eax 0x00000019 push edx 0x0000001a push edi 0x0000001b pop edi 0x0000001c jmp 00007F4D4CB43A35h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E188B1 second address: E188B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E188B5 second address: E188B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E1935B second address: E193B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 xor dword ptr [esp], 019AB4AEh 0x0000000c push 00000000h 0x0000000e push eax 0x0000000f call 00007F4D4CB41C48h 0x00000014 pop eax 0x00000015 mov dword ptr [esp+04h], eax 0x00000019 add dword ptr [esp+04h], 0000001Ah 0x00000021 inc eax 0x00000022 push eax 0x00000023 ret 0x00000024 pop eax 0x00000025 ret 0x00000026 add dword ptr [ebp+122D3455h], esi 0x0000002c mov dword ptr [ebp+122D59DBh], edx 0x00000032 call 00007F4D4CB41C49h 0x00000037 pushad 0x00000038 jmp 00007F4D4CB41C4Ah 0x0000003d push ecx 0x0000003e jns 00007F4D4CB41C46h 0x00000044 pop ecx 0x00000045 popad 0x00000046 push eax 0x00000047 push ebx 0x00000048 push eax 0x00000049 push edx 0x0000004a pushad 0x0000004b popad 0x0000004c rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E193B8 second address: E193F1 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b jl 00007F4D4CB43A2Ah 0x00000011 mov eax, dword ptr [eax] 0x00000013 pushad 0x00000014 pushad 0x00000015 pushad 0x00000016 popad 0x00000017 jmp 00007F4D4CB43A39h 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E195A6 second address: E195AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E19789 second address: E1979A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jp 00007F4D4CB43A26h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E1979A second address: E197A9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB41C4Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E1984A second address: E1984E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E1A0C9 second address: E1A0FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 jp 00007F4D4CB41C50h 0x0000000e xchg eax, ebx 0x0000000f mov esi, 7E736626h 0x00000014 nop 0x00000015 jmp 00007F4D4CB41C4Dh 0x0000001a push eax 0x0000001b push eax 0x0000001c push edx 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E1A0FB second address: E1A100 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E1A100 second address: E1A106 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E1A325 second address: E1A32A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E1A544 second address: E1A55C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4D4CB41C54h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E1C42F second address: E1C435 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E1CC78 second address: E1CC8B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jnc 00007F4D4CB41C46h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edi 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E1D935 second address: E1D93A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E1E317 second address: E1E38F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jno 00007F4D4CB41C4Ch 0x0000000b popad 0x0000000c mov dword ptr [esp], eax 0x0000000f push esi 0x00000010 mov esi, dword ptr [ebp+122D36E2h] 0x00000016 pop edi 0x00000017 movzx edi, bx 0x0000001a push 00000000h 0x0000001c push 00000000h 0x0000001e push ebp 0x0000001f call 00007F4D4CB41C48h 0x00000024 pop ebp 0x00000025 mov dword ptr [esp+04h], ebp 0x00000029 add dword ptr [esp+04h], 0000001Dh 0x00000031 inc ebp 0x00000032 push ebp 0x00000033 ret 0x00000034 pop ebp 0x00000035 ret 0x00000036 mov edi, dword ptr [ebp+122D39CAh] 0x0000003c push 00000000h 0x0000003e push 00000000h 0x00000040 push edi 0x00000041 call 00007F4D4CB41C48h 0x00000046 pop edi 0x00000047 mov dword ptr [esp+04h], edi 0x0000004b add dword ptr [esp+04h], 00000018h 0x00000053 inc edi 0x00000054 push edi 0x00000055 ret 0x00000056 pop edi 0x00000057 ret 0x00000058 mov edi, esi 0x0000005a xchg eax, ebx 0x0000005b push eax 0x0000005c push edx 0x0000005d push edx 0x0000005e push eax 0x0000005f pop eax 0x00000060 pop edx 0x00000061 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E1EF55 second address: E1EF65 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F4D4CB43A26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push esi 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E1E0FA second address: E1E100 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E1EC44 second address: E1EC4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E1F885 second address: E1F8A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4D4CB41C58h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E23E00 second address: E23E0A instructions: 0x00000000 rdtsc 0x00000002 js 00007F4D4CB43A26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E24E44 second address: E24E4B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E24E4B second address: E24E61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jo 00007F4D4CB43A32h 0x0000000e jng 00007F4D4CB43A2Ch 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E25E4D second address: E25E51 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E25054 second address: E2505A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E25E51 second address: E25E69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 pushad 0x00000009 jmp 00007F4D4CB41C4Dh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E2505A second address: E2505E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E25E69 second address: E25E73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E260C4 second address: E260C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E27E40 second address: E27EA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push eax 0x0000000a call 00007F4D4CB41C48h 0x0000000f pop eax 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 add dword ptr [esp+04h], 0000001Ah 0x0000001c inc eax 0x0000001d push eax 0x0000001e ret 0x0000001f pop eax 0x00000020 ret 0x00000021 push 00000000h 0x00000023 push 00000000h 0x00000025 push 00000000h 0x00000027 push edx 0x00000028 call 00007F4D4CB41C48h 0x0000002d pop edx 0x0000002e mov dword ptr [esp+04h], edx 0x00000032 add dword ptr [esp+04h], 00000014h 0x0000003a inc edx 0x0000003b push edx 0x0000003c ret 0x0000003d pop edx 0x0000003e ret 0x0000003f sbb edi, 792CBA64h 0x00000045 mov edi, 45D07DB3h 0x0000004a push eax 0x0000004b pushad 0x0000004c push eax 0x0000004d push edx 0x0000004e jmp 00007F4D4CB41C4Bh 0x00000053 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E27EA3 second address: E27EA7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E270A0 second address: E270A6 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E28EA1 second address: E28EB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop ebx 0x00000006 push eax 0x00000007 pushad 0x00000008 ja 00007F4D4CB43A28h 0x0000000e jl 00007F4D4CB43A2Ch 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E2B63D second address: E2B660 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jns 00007F4D4CB41C4Ch 0x0000000d popad 0x0000000e push eax 0x0000000f jc 00007F4D4CB41C58h 0x00000015 push eax 0x00000016 push edx 0x00000017 je 00007F4D4CB41C46h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E29131 second address: E29136 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E2B660 second address: E2B6B5 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F4D4CB41C46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push edi 0x0000000e call 00007F4D4CB41C48h 0x00000013 pop edi 0x00000014 mov dword ptr [esp+04h], edi 0x00000018 add dword ptr [esp+04h], 00000015h 0x00000020 inc edi 0x00000021 push edi 0x00000022 ret 0x00000023 pop edi 0x00000024 ret 0x00000025 or bx, 828Eh 0x0000002a mov dword ptr [ebp+1247E3B2h], ecx 0x00000030 push 00000000h 0x00000032 mov bl, 4Ch 0x00000034 push 00000000h 0x00000036 movzx edi, di 0x00000039 push eax 0x0000003a pushad 0x0000003b jmp 00007F4D4CB41C54h 0x00000040 push ecx 0x00000041 push eax 0x00000042 push edx 0x00000043 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E29136 second address: E2913C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E2913C second address: E29165 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F4D4CB41C46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e jmp 00007F4D4CB41C56h 0x00000013 pushad 0x00000014 push edi 0x00000015 pop edi 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E2FC38 second address: E2FC7C instructions: 0x00000000 rdtsc 0x00000002 jl 00007F4D4CB43A2Ch 0x00000008 jno 00007F4D4CB43A26h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov dword ptr [esp], eax 0x00000013 mov edi, 4795E1C9h 0x00000018 push 00000000h 0x0000001a pushad 0x0000001b mov bx, di 0x0000001e mov dword ptr [ebp+122D1CB5h], eax 0x00000024 popad 0x00000025 push 00000000h 0x00000027 call 00007F4D4CB43A2Bh 0x0000002c mov bl, 16h 0x0000002e pop ebx 0x0000002f xchg eax, esi 0x00000030 push eax 0x00000031 push edx 0x00000032 push eax 0x00000033 jmp 00007F4D4CB43A2Ah 0x00000038 pop eax 0x00000039 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E2FC7C second address: E2FC82 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E2FC82 second address: E2FC86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E2FC86 second address: E2FC8A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E31B1C second address: E31B20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E31B20 second address: E31B24 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E31B24 second address: E31B38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 pushad 0x00000009 jp 00007F4D4CB43A28h 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E31BCA second address: E31BD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E2EDD6 second address: E2EDDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E2FDC5 second address: E2FDCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E30EF9 second address: E30EFF instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E2FDCB second address: E2FDE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 push eax 0x00000007 pushad 0x00000008 jns 00007F4D4CB41C4Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E32C3B second address: E32C4E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 je 00007F4D4CB43A30h 0x0000000f push eax 0x00000010 push edx 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E30EFF second address: E30F06 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E2FDE3 second address: E2FDE7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E30F06 second address: E30F13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E33C0D second address: E33C11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E33C11 second address: E33C27 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB41C4Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E33C27 second address: E33C8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push ebp 0x0000000c call 00007F4D4CB43A28h 0x00000011 pop ebp 0x00000012 mov dword ptr [esp+04h], ebp 0x00000016 add dword ptr [esp+04h], 00000017h 0x0000001e inc ebp 0x0000001f push ebp 0x00000020 ret 0x00000021 pop ebp 0x00000022 ret 0x00000023 movzx ebx, si 0x00000026 push 00000000h 0x00000028 mov edi, dword ptr [ebp+12480F75h] 0x0000002e push 00000000h 0x00000030 jmp 00007F4D4CB43A37h 0x00000035 push eax 0x00000036 push eax 0x00000037 push edx 0x00000038 ja 00007F4D4CB43A39h 0x0000003e rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E34C49 second address: E34C80 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB41C52h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a jne 00007F4D4CB41C46h 0x00000010 pop ecx 0x00000011 popad 0x00000012 push eax 0x00000013 pushad 0x00000014 pushad 0x00000015 jmp 00007F4D4CB41C53h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E33EAF second address: E33EB3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E34E20 second address: E34E28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E35F25 second address: E35F2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E3D915 second address: E3D921 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 je 00007F4D4CB41C46h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E3D921 second address: E3D93B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f je 00007F4D4CB43A26h 0x00000015 push ebx 0x00000016 pop ebx 0x00000017 push ecx 0x00000018 pop ecx 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E3DC73 second address: E3DC9E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F4D4CB41C59h 0x00000008 pushad 0x00000009 popad 0x0000000a push esi 0x0000000b pop esi 0x0000000c push edx 0x0000000d pop edx 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 jo 00007F4D4CB41C46h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E3DC9E second address: E3DCA2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E3DDD3 second address: E3DDD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E3DDD9 second address: E3DDDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E3DDDE second address: E3DE08 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop edx 0x00000006 jl 00007F4D4CB41C4Eh 0x0000000c jg 00007F4D4CB41C46h 0x00000012 pushad 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 pushad 0x00000017 jmp 00007F4D4CB41C4Fh 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E4485A second address: E448B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 jmp 00007F4D4CB43A2Ah 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f pushad 0x00000010 jmp 00007F4D4CB43A30h 0x00000015 jmp 00007F4D4CB43A36h 0x0000001a popad 0x0000001b mov eax, dword ptr [eax] 0x0000001d jmp 00007F4D4CB43A2Ch 0x00000022 mov dword ptr [esp+04h], eax 0x00000026 push eax 0x00000027 push edx 0x00000028 push esi 0x00000029 jbe 00007F4D4CB43A26h 0x0000002f pop esi 0x00000030 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E44968 second address: E4499B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push edx 0x00000006 jmp 00007F4D4CB41C55h 0x0000000b pop edx 0x0000000c popad 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F4D4CB41C53h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E4499B second address: E449B9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB43A31h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push edx 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E449B9 second address: E449BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E449BD second address: E449EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov eax, dword ptr [eax] 0x00000009 jnp 00007F4D4CB43A3Ah 0x0000000f jmp 00007F4D4CB43A34h 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c jp 00007F4D4CB43A26h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E449EE second address: E449FD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB41C4Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E449FD second address: E44A02 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E4A7D5 second address: E4A7DF instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F4D4CB41C46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E4AADB second address: E4AAE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E4AC3D second address: E4AC5B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F4D4CB41C56h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E4AC5B second address: E4AC5F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E4B18E second address: E4B196 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E4B331 second address: E4B337 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E4B337 second address: E4B33C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E4B33C second address: E4B347 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 js 00007F4D4CB43A26h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E54D2A second address: E54D34 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F4D4CB41C46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E54D34 second address: E54D49 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F4D4CB43A2Eh 0x00000008 push esi 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E54D49 second address: E54D58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jnp 00007F4D4CB41C46h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E54D58 second address: E54D5C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E53AF9 second address: E53B04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E20B17 second address: E20B39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 nop 0x00000005 mov dword ptr [ebp+12450C88h], esi 0x0000000b lea eax, dword ptr [ebp+124888C6h] 0x00000011 mov ecx, dword ptr [ebp+122D2789h] 0x00000017 push eax 0x00000018 push eax 0x00000019 push edx 0x0000001a jnl 00007F4D4CB43A28h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E20B39 second address: E0172B instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F4D4CB41C48h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push eax 0x00000010 call 00007F4D4CB41C48h 0x00000015 pop eax 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a add dword ptr [esp+04h], 0000001Ch 0x00000022 inc eax 0x00000023 push eax 0x00000024 ret 0x00000025 pop eax 0x00000026 ret 0x00000027 adc di, 01E1h 0x0000002c call dword ptr [ebp+12456A9Dh] 0x00000032 jns 00007F4D4CB41C66h 0x00000038 jmp 00007F4D4CB41C4Dh 0x0000003d push esi 0x0000003e jmp 00007F4D4CB41C51h 0x00000043 pop esi 0x00000044 push eax 0x00000045 push edx 0x00000046 push edi 0x00000047 push eax 0x00000048 push edx 0x00000049 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E20C35 second address: E20C3F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F4D4CB43A26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E20C3F second address: E20C60 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push eax 0x0000000d pop eax 0x0000000e jmp 00007F4D4CB41C52h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E20C60 second address: E20C66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E20C66 second address: E20C6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E20FDF second address: E20FE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E2109B second address: E210D8 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F4D4CB41C46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F4D4CB41C56h 0x0000000f popad 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 push ebx 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F4D4CB41C55h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E210D8 second address: E210DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E2124E second address: E21264 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F4D4CB41C4Fh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E21264 second address: E212BD instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, esi 0x00000008 push 00000000h 0x0000000a push ecx 0x0000000b call 00007F4D4CB43A28h 0x00000010 pop ecx 0x00000011 mov dword ptr [esp+04h], ecx 0x00000015 add dword ptr [esp+04h], 0000001Dh 0x0000001d inc ecx 0x0000001e push ecx 0x0000001f ret 0x00000020 pop ecx 0x00000021 ret 0x00000022 push ebx 0x00000023 pop ecx 0x00000024 jmp 00007F4D4CB43A2Bh 0x00000029 nop 0x0000002a jmp 00007F4D4CB43A37h 0x0000002f push eax 0x00000030 push eax 0x00000031 push edx 0x00000032 push edx 0x00000033 push ebx 0x00000034 pop ebx 0x00000035 pop edx 0x00000036 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E21601 second address: E21614 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB41C4Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E21614 second address: E21694 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F4D4CB43A28h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d jmp 00007F4D4CB43A39h 0x00000012 sub dword ptr [ebp+122D1AA3h], esi 0x00000018 push 00000004h 0x0000001a push 00000000h 0x0000001c push eax 0x0000001d call 00007F4D4CB43A28h 0x00000022 pop eax 0x00000023 mov dword ptr [esp+04h], eax 0x00000027 add dword ptr [esp+04h], 00000019h 0x0000002f inc eax 0x00000030 push eax 0x00000031 ret 0x00000032 pop eax 0x00000033 ret 0x00000034 nop 0x00000035 pushad 0x00000036 push edi 0x00000037 jmp 00007F4D4CB43A37h 0x0000003c pop edi 0x0000003d jmp 00007F4D4CB43A30h 0x00000042 popad 0x00000043 push eax 0x00000044 pushad 0x00000045 push eax 0x00000046 push eax 0x00000047 push edx 0x00000048 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E21A8B second address: E21ABE instructions: 0x00000000 rdtsc 0x00000002 je 00007F4D4CB41C4Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b jg 00007F4D4CB41C4Ch 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 push 0000001Eh 0x00000019 jc 00007F4D4CB41C49h 0x0000001f movsx edi, di 0x00000022 push eax 0x00000023 jc 00007F4D4CB41C54h 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c pop eax 0x0000002d rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E21E34 second address: E21E3E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E21E3E second address: E21E42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E21E42 second address: E21E50 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E21E50 second address: E21E54 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E21E54 second address: E21E5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E21E5A second address: E02274 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F4D4CB41C4Fh 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push edx 0x0000000f call 00007F4D4CB41C48h 0x00000014 pop edx 0x00000015 mov dword ptr [esp+04h], edx 0x00000019 add dword ptr [esp+04h], 00000018h 0x00000021 inc edx 0x00000022 push edx 0x00000023 ret 0x00000024 pop edx 0x00000025 ret 0x00000026 mov ch, 75h 0x00000028 jnl 00007F4D4CB41C65h 0x0000002e call dword ptr [ebp+122D33B9h] 0x00000034 pushad 0x00000035 jmp 00007F4D4CB41C4Bh 0x0000003a push eax 0x0000003b push edx 0x0000003c push eax 0x0000003d push edx 0x0000003e rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E02274 second address: E0227A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E0227A second address: E0227E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E53DA9 second address: E53DAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E53DAD second address: E53DDA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F4D4CB41C59h 0x0000000b pop ecx 0x0000000c pushad 0x0000000d jng 00007F4D4CB41C48h 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E53DDA second address: E53DE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E540F4 second address: E540FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E540FA second address: E54105 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E54105 second address: E5410B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E5410B second address: E54111 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E54281 second address: E54299 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4D4CB41C54h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E54403 second address: E5442C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edi 0x00000008 pop edi 0x00000009 jnp 00007F4D4CB43A26h 0x0000000f jmp 00007F4D4CB43A39h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E5442C second address: E54431 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E545A3 second address: E545B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007F4D4CB43A2Ch 0x0000000a rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E545B4 second address: E545EB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB41C4Fh 0x00000007 jbe 00007F4D4CB41C48h 0x0000000d push esi 0x0000000e pop esi 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 jnp 00007F4D4CB41C46h 0x0000001a pushad 0x0000001b popad 0x0000001c jmp 00007F4D4CB41C50h 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E5ECDD second address: E5ECE8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jno 00007F4D4CB43A26h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E5D91F second address: E5D924 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E5D924 second address: E5D944 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F4D4CB43A38h 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E5D944 second address: E5D948 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E5D948 second address: E5D94C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E5DD40 second address: E5DD45 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E5D4F9 second address: E5D52F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB43A30h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F4D4CB43A32h 0x0000000f pushad 0x00000010 js 00007F4D4CB43A26h 0x00000016 je 00007F4D4CB43A26h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E64AA3 second address: E64ACA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB41C59h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d jg 00007F4D4CB41C46h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E64ACA second address: E64ACE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E63856 second address: E6385A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E6385A second address: E6386E instructions: 0x00000000 rdtsc 0x00000002 jc 00007F4D4CB43A26h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f pop edi 0x00000010 push eax 0x00000011 push edx 0x00000012 push edx 0x00000013 pop edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E634FF second address: E63513 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F4D4CB41C4Ah 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E63513 second address: E63523 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 jnp 00007F4D4CB43A6Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E63523 second address: E63535 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4D4CB41C4Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E63535 second address: E63551 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB43A32h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E64277 second address: E64283 instructions: 0x00000000 rdtsc 0x00000002 js 00007F4D4CB41C46h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E64283 second address: E6428D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F4D4CB43A26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E67597 second address: E6759B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E6A06E second address: E6A074 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E6A074 second address: E6A078 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E6A078 second address: E6A081 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E6C4F4 second address: E6C4FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E6C4FD second address: E6C501 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E721E9 second address: E721EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E721EF second address: E721F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E721F3 second address: E7221F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F4D4CB41C46h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007F4D4CB41C4Dh 0x00000012 push edx 0x00000013 pop edx 0x00000014 popad 0x00000015 pushad 0x00000016 jc 00007F4D4CB41C46h 0x0000001c jp 00007F4D4CB41C46h 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E70ACA second address: E70ADA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jo 00007F4D4CB43A26h 0x0000000c popad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E70ADA second address: E70AF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4D4CB41C4Bh 0x00000009 jmp 00007F4D4CB41C4Dh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E70AF8 second address: E70B0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push esi 0x00000007 push eax 0x00000008 jnp 00007F4D4CB43A26h 0x0000000e pushad 0x0000000f popad 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E70B0D second address: E70B11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E70C74 second address: E70C9C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB43A2Bh 0x00000007 jmp 00007F4D4CB43A35h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push edx 0x0000000f push esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E70E0D second address: E70E13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E70E13 second address: E70E17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E70E17 second address: E70E2B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jne 00007F4D4CB41C46h 0x0000000e ja 00007F4D4CB41C46h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E70F72 second address: E70F7A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E70F7A second address: E70F7F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E70F7F second address: E70F85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E70F85 second address: E70F8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E21A7C second address: E21A8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jl 00007F4D4CB43A28h 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E21A95 second address: E21ABE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 jg 00007F4D4CB41C4Ch 0x0000000d push 0000001Eh 0x0000000f jc 00007F4D4CB41C49h 0x00000015 movsx edi, di 0x00000018 push eax 0x00000019 jc 00007F4D4CB41C54h 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 pop eax 0x00000023 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E7149E second address: E714A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E756F8 second address: E756FD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E756FD second address: E7570B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F4D4CB43A26h 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E75AD1 second address: E75AD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E75AD6 second address: E75AF8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F4D4CB43A34h 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d jno 00007F4D4CB43A26h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E75AF8 second address: E75B41 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB41C4Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e jmp 00007F4D4CB41C4Bh 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 pop esi 0x00000016 pushad 0x00000017 push esi 0x00000018 pop esi 0x00000019 jmp 00007F4D4CB41C57h 0x0000001e jns 00007F4D4CB41C46h 0x00000024 push ecx 0x00000025 pop ecx 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E75DF1 second address: E75E12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F4D4CB43A26h 0x0000000a jmp 00007F4D4CB43A35h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E75E12 second address: E75E2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push edi 0x00000007 pop edi 0x00000008 jmp 00007F4D4CB41C50h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E75E2C second address: E75E33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E79FD6 second address: E79FDA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E79718 second address: E79722 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F4D4CB43A26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E79722 second address: E79740 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB41C54h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E79740 second address: E7974C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jp 00007F4D4CB43A26h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E79A4F second address: E79A74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4D4CB41C58h 0x00000009 pop edx 0x0000000a jng 00007F4D4CB41C4Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E79A74 second address: E79A7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E79A7C second address: E79A86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F4D4CB41C46h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E8093F second address: E80943 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E81F5D second address: E81F86 instructions: 0x00000000 rdtsc 0x00000002 js 00007F4D4CB41C46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jns 00007F4D4CB41C46h 0x00000011 jmp 00007F4D4CB41C56h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E81F86 second address: E81FAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F4D4CB43A39h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E81FAA second address: E81FAE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E83E5C second address: E83E64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E89EBD second address: E89ECF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F4D4CB41C46h 0x0000000a push eax 0x0000000b push edx 0x0000000c jp 00007F4D4CB41C46h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E89ECF second address: E89EDB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jns 00007F4D4CB43A26h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E89EDB second address: E89EF8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F4D4CB41C56h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E8D23E second address: E8D250 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4D4CB43A2Dh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E8D250 second address: E8D263 instructions: 0x00000000 rdtsc 0x00000002 js 00007F4D4CB41C4Eh 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E8D263 second address: E8D269 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E8D3D3 second address: E8D413 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jmp 00007F4D4CB41C4Ch 0x0000000b popad 0x0000000c popad 0x0000000d pushad 0x0000000e push edi 0x0000000f jmp 00007F4D4CB41C4Ch 0x00000014 pop edi 0x00000015 push eax 0x00000016 push edx 0x00000017 push ecx 0x00000018 pop ecx 0x00000019 jmp 00007F4D4CB41C59h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E8D576 second address: E8D58F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F4D4CB43A30h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E8D6CA second address: E8D6D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F4D4CB41C46h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E96F4F second address: E96F53 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E94FFD second address: E95002 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E95002 second address: E9501F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F4D4CB43A38h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E9501F second address: E95044 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jmp 00007F4D4CB41C50h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jg 00007F4D4CB41C46h 0x00000018 push ebx 0x00000019 pop ebx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E95044 second address: E95050 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jnc 00007F4D4CB43A26h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E95050 second address: E95055 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E951CE second address: E951D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E951D2 second address: E951F7 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F4D4CB41C46h 0x00000008 jmp 00007F4D4CB41C57h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E951F7 second address: E951FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E951FB second address: E9520A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d push edx 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E9520A second address: E9520E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E9520E second address: E95218 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E95218 second address: E9521C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E9521C second address: E95222 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E95222 second address: E95240 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB43A32h 0x00000007 je 00007F4D4CB43A2Eh 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E958A2 second address: E958AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E958AA second address: E958AF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E95A39 second address: E95A3D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E95A3D second address: E95A54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F4D4CB43A2Eh 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E96692 second address: E96696 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: E96696 second address: E966A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edi 0x00000008 pop edi 0x00000009 push eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: EA991C second address: EA992A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edi 0x00000006 pop edi 0x00000007 pushad 0x00000008 popad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: EA992A second address: EA992E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: EA9A7B second address: EA9A81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: EAE6A2 second address: EAE6E0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB43A34h 0x00000007 push edi 0x00000008 jnl 00007F4D4CB43A26h 0x0000000e pop edi 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 push edi 0x00000013 jmp 00007F4D4CB43A31h 0x00000018 pushad 0x00000019 popad 0x0000001a pop edi 0x0000001b je 00007F4D4CB43A2Ch 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: EAE7F4 second address: EAE7FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: EAE7FA second address: EAE808 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F4D4CB43A26h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: EAE808 second address: EAE837 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4D4CB41C4Fh 0x00000009 popad 0x0000000a pop ecx 0x0000000b push ebx 0x0000000c js 00007F4D4CB41C55h 0x00000012 jmp 00007F4D4CB41C4Fh 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: EAE837 second address: EAE83B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: EB0468 second address: EB046C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: EB046C second address: EB0470 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: EB72C4 second address: EB72DE instructions: 0x00000000 rdtsc 0x00000002 jo 00007F4D4CB41C46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jc 00007F4D4CB41C46h 0x00000011 push edx 0x00000012 pop edx 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: EBCB1E second address: EBCB3C instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F4D4CB43A26h 0x00000008 jmp 00007F4D4CB43A2Dh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: EC117F second address: EC1183 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: EC90B6 second address: EC90BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: EC90BE second address: EC90DC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB41C54h 0x00000007 jg 00007F4D4CB41C52h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: EC9228 second address: EC924E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F4D4CB43A26h 0x0000000a jno 00007F4D4CB43A26h 0x00000010 popad 0x00000011 jmp 00007F4D4CB43A35h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: EC924E second address: EC9258 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F4D4CB41C46h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: EC93B4 second address: EC93BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: EC93BF second address: EC93C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: EC94E3 second address: EC9500 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F4D4CB43A33h 0x0000000b popad 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: EC9500 second address: EC950A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: EC950A second address: EC951F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F4D4CB43A26h 0x0000000a popad 0x0000000b popad 0x0000000c push edx 0x0000000d jc 00007F4D4CB43A2Ch 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: ECDCBD second address: ECDCD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4D4CB41C55h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: ECDCD9 second address: ECDCE9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F4D4CB43A2Ah 0x0000000b rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: F0BEDB second address: F0BEE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: F0BEE1 second address: F0BEE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: F1AD61 second address: F1AD67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: F1C4E6 second address: F1C4EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: F1FA26 second address: F1FA35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 jo 00007F4D4CB41C52h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: F1FA35 second address: F1FA3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: F1FA3B second address: F1FA3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: F1FA3F second address: F1FA45 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: F1FBC1 second address: F1FBE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4D4CB41C56h 0x00000009 popad 0x0000000a pushad 0x0000000b js 00007F4D4CB41C46h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: F1FBE5 second address: F1FC02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F4D4CB43A26h 0x0000000a jmp 00007F4D4CB43A32h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: F1FC02 second address: F1FC2C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jnl 00007F4D4CB41C46h 0x00000009 jmp 00007F4D4CB41C52h 0x0000000e pop edi 0x0000000f push eax 0x00000010 push edx 0x00000011 jc 00007F4D4CB41C46h 0x00000017 jne 00007F4D4CB41C46h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: F24B0E second address: F24B12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: FE83B4 second address: FE83ED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB41C53h 0x00000007 jmp 00007F4D4CB41C53h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jc 00007F4D4CB41C4Ch 0x00000014 jnp 00007F4D4CB41C46h 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: FE83ED second address: FE8403 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4D4CB43A30h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: FE8403 second address: FE8428 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4D4CB41C54h 0x00000009 popad 0x0000000a popad 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e jp 00007F4D4CB41C46h 0x00000014 push esi 0x00000015 pop esi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: FE8428 second address: FE842C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: FE8576 second address: FE8580 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F4D4CB41C46h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: FE8580 second address: FE858A instructions: 0x00000000 rdtsc 0x00000002 jns 00007F4D4CB43A26h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: FE858A second address: FE8598 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnl 00007F4D4CB41C4Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: FE86E3 second address: FE86F8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB43A31h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: FE8CB9 second address: FE8CDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 jo 00007F4D4CB41C5Ah 0x0000000d jmp 00007F4D4CB41C54h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: FED46F second address: FED486 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F4D4CB43A2Dh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: FED6EC second address: FED6F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: FED6F0 second address: FED75A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB43A36h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push ebx 0x0000000f call 00007F4D4CB43A28h 0x00000014 pop ebx 0x00000015 mov dword ptr [esp+04h], ebx 0x00000019 add dword ptr [esp+04h], 00000017h 0x00000021 inc ebx 0x00000022 push ebx 0x00000023 ret 0x00000024 pop ebx 0x00000025 ret 0x00000026 mov dx, 325Bh 0x0000002a push 00000004h 0x0000002c call 00007F4D4CB43A37h 0x00000031 mov edx, dword ptr [ebp+122D28CAh] 0x00000037 pop edx 0x00000038 push 586BD477h 0x0000003d pushad 0x0000003e push eax 0x0000003f push edx 0x00000040 push esi 0x00000041 pop esi 0x00000042 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: FED75A second address: FED764 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 730013C second address: 7300158 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4D4CB43A38h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 7300158 second address: 730016E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a mov edi, eax 0x0000000c mov edi, ecx 0x0000000e popad 0x0000000f xchg eax, ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 730016E second address: 7300172 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 7300172 second address: 7300178 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 7300178 second address: 7300208 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB43A36h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebx, dword ptr [eax+10h] 0x0000000c jmp 00007F4D4CB43A30h 0x00000011 xchg eax, esi 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007F4D4CB43A2Eh 0x00000019 add ecx, 28A289D8h 0x0000001f jmp 00007F4D4CB43A2Bh 0x00000024 popfd 0x00000025 pushfd 0x00000026 jmp 00007F4D4CB43A38h 0x0000002b and ah, 00000038h 0x0000002e jmp 00007F4D4CB43A2Bh 0x00000033 popfd 0x00000034 popad 0x00000035 push eax 0x00000036 push eax 0x00000037 push edx 0x00000038 jmp 00007F4D4CB43A34h 0x0000003d rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 7300208 second address: 730024D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB41C4Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a jmp 00007F4D4CB41C56h 0x0000000f mov esi, dword ptr [756006ECh] 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F4D4CB41C57h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 730024D second address: 7300252 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 7300252 second address: 7300291 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test esi, esi 0x0000000b jmp 00007F4D4CB41C57h 0x00000010 jne 00007F4D4CB42A02h 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F4D4CB41C55h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 7300291 second address: 7300297 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 7300297 second address: 730029B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 730029B second address: 730029F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 730029F second address: 7300312 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 jmp 00007F4D4CB41C54h 0x0000000e mov dword ptr [esp], edi 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007F4D4CB41C4Eh 0x00000018 add si, 0278h 0x0000001d jmp 00007F4D4CB41C4Bh 0x00000022 popfd 0x00000023 push esi 0x00000024 mov dx, 009Ah 0x00000028 pop ebx 0x00000029 popad 0x0000002a call dword ptr [755D0B60h] 0x00000030 mov eax, 7696E5E0h 0x00000035 ret 0x00000036 jmp 00007F4D4CB41C4Eh 0x0000003b push 00000044h 0x0000003d pushad 0x0000003e push ecx 0x0000003f mov edi, 0C89AEF0h 0x00000044 pop edx 0x00000045 mov eax, 189CC625h 0x0000004a popad 0x0000004b pop edi 0x0000004c push eax 0x0000004d push edx 0x0000004e push eax 0x0000004f push edx 0x00000050 pushad 0x00000051 popad 0x00000052 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 7300312 second address: 7300316 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 7300316 second address: 730031C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 730031C second address: 7300322 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 7300322 second address: 7300346 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, edi 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F4D4CB41C59h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 7300346 second address: 730036C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB43A31h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007F4D4CB43A2Ah 0x00000012 push eax 0x00000013 pop edi 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 730036C second address: 73003B5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB41C57h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, edi 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F4D4CB41C54h 0x00000011 adc cx, 1588h 0x00000016 jmp 00007F4D4CB41C4Bh 0x0000001b popfd 0x0000001c push eax 0x0000001d push edx 0x0000001e mov cx, D615h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 73003B5 second address: 73003D4 instructions: 0x00000000 rdtsc 0x00000002 mov dx, cx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 push dword ptr [eax] 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F4D4CB43A33h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 73003D4 second address: 73003EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4D4CB41C54h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 73004D8 second address: 73004DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 73004DE second address: 73004FF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, cx 0x00000006 mov cx, 061Bh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esi], edi 0x0000000f pushad 0x00000010 mov si, 1D93h 0x00000014 mov dx, si 0x00000017 popad 0x00000018 mov dword ptr [esi+04h], eax 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 73004FF second address: 7300503 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 7300503 second address: 7300509 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 7300509 second address: 730050E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 730050E second address: 7300524 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov edi, ecx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esi+08h], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push ebx 0x00000010 pop esi 0x00000011 mov dx, DD48h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 7300524 second address: 73005B7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB43A2Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esi+0Ch], eax 0x0000000c pushad 0x0000000d mov esi, 40EBFB8Dh 0x00000012 jmp 00007F4D4CB43A2Ah 0x00000017 popad 0x00000018 mov eax, dword ptr [ebx+4Ch] 0x0000001b jmp 00007F4D4CB43A30h 0x00000020 mov dword ptr [esi+10h], eax 0x00000023 pushad 0x00000024 pushfd 0x00000025 jmp 00007F4D4CB43A2Eh 0x0000002a add cx, 1208h 0x0000002f jmp 00007F4D4CB43A2Bh 0x00000034 popfd 0x00000035 pushfd 0x00000036 jmp 00007F4D4CB43A38h 0x0000003b xor ch, 00000068h 0x0000003e jmp 00007F4D4CB43A2Bh 0x00000043 popfd 0x00000044 popad 0x00000045 mov eax, dword ptr [ebx+50h] 0x00000048 push eax 0x00000049 push edx 0x0000004a pushad 0x0000004b mov cx, di 0x0000004e movsx edx, ax 0x00000051 popad 0x00000052 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 73005B7 second address: 7300636 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F4D4CB41C4Fh 0x00000009 and cx, 885Eh 0x0000000e jmp 00007F4D4CB41C59h 0x00000013 popfd 0x00000014 mov cx, 8127h 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b mov dword ptr [esi+14h], eax 0x0000001e jmp 00007F4D4CB41C4Ah 0x00000023 mov eax, dword ptr [ebx+54h] 0x00000026 pushad 0x00000027 mov bl, ah 0x00000029 push eax 0x0000002a push edx 0x0000002b pushfd 0x0000002c jmp 00007F4D4CB41C59h 0x00000031 or ax, 17F6h 0x00000036 jmp 00007F4D4CB41C51h 0x0000003b popfd 0x0000003c rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 7300636 second address: 730065B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esi+18h], eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F4D4CB43A39h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 730065B second address: 7300677 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB41C51h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [ebx+58h] 0x0000000c pushad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 7300677 second address: 730069E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F4D4CB43A34h 0x0000000a popad 0x0000000b mov dword ptr [esi+1Ch], eax 0x0000000e pushad 0x0000000f mov si, 4B6Dh 0x00000013 push eax 0x00000014 push edx 0x00000015 mov di, cx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 730069E second address: 73006D5 instructions: 0x00000000 rdtsc 0x00000002 mov eax, 642ADAABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov eax, dword ptr [ebx+5Ch] 0x0000000d jmp 00007F4D4CB41C4Eh 0x00000012 mov dword ptr [esi+20h], eax 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F4D4CB41C57h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 73006D5 second address: 73006DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 73006DB second address: 73006DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 73006DF second address: 73006E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 73006E3 second address: 73006F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [ebx+60h] 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov bl, al 0x00000010 mov esi, edi 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 73006F6 second address: 7300724 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB43A2Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esi+24h], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F4D4CB43A37h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 7300724 second address: 730075E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB41C59h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [ebx+64h] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f call 00007F4D4CB41C53h 0x00000014 pop ecx 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 730075E second address: 730076D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4D4CB43A2Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 730076D second address: 73007C6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB41C59h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esi+28h], eax 0x0000000e jmp 00007F4D4CB41C4Eh 0x00000013 mov eax, dword ptr [ebx+68h] 0x00000016 jmp 00007F4D4CB41C50h 0x0000001b mov dword ptr [esi+2Ch], eax 0x0000001e pushad 0x0000001f mov esi, 612C6FFDh 0x00000024 movzx esi, dx 0x00000027 popad 0x00000028 mov ax, word ptr [ebx+6Ch] 0x0000002c pushad 0x0000002d push eax 0x0000002e push edx 0x0000002f mov ecx, edi 0x00000031 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 73007C6 second address: 73008EE instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushfd 0x00000007 jmp 00007F4D4CB43A39h 0x0000000c add ecx, 1F67C876h 0x00000012 jmp 00007F4D4CB43A31h 0x00000017 popfd 0x00000018 popad 0x00000019 mov word ptr [esi+30h], ax 0x0000001d jmp 00007F4D4CB43A2Eh 0x00000022 mov ax, word ptr [ebx+00000088h] 0x00000029 jmp 00007F4D4CB43A30h 0x0000002e mov word ptr [esi+32h], ax 0x00000032 pushad 0x00000033 pushfd 0x00000034 jmp 00007F4D4CB43A2Eh 0x00000039 or ch, FFFFFFF8h 0x0000003c jmp 00007F4D4CB43A2Bh 0x00000041 popfd 0x00000042 mov ch, F9h 0x00000044 popad 0x00000045 mov eax, dword ptr [ebx+0000008Ch] 0x0000004b jmp 00007F4D4CB43A2Bh 0x00000050 mov dword ptr [esi+34h], eax 0x00000053 jmp 00007F4D4CB43A36h 0x00000058 mov eax, dword ptr [ebx+18h] 0x0000005b jmp 00007F4D4CB43A30h 0x00000060 mov dword ptr [esi+38h], eax 0x00000063 jmp 00007F4D4CB43A30h 0x00000068 mov eax, dword ptr [ebx+1Ch] 0x0000006b pushad 0x0000006c mov edx, eax 0x0000006e mov bx, cx 0x00000071 popad 0x00000072 mov dword ptr [esi+3Ch], eax 0x00000075 jmp 00007F4D4CB43A34h 0x0000007a mov eax, dword ptr [ebx+20h] 0x0000007d jmp 00007F4D4CB43A30h 0x00000082 mov dword ptr [esi+40h], eax 0x00000085 push eax 0x00000086 push edx 0x00000087 jmp 00007F4D4CB43A37h 0x0000008c rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 73008EE second address: 73008F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 73008F4 second address: 7300913 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB43A2Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b lea eax, dword ptr [ebx+00000080h] 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 mov dh, 6Ch 0x00000016 push eax 0x00000017 pop edi 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 7300913 second address: 7300919 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 7300919 second address: 730091D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 730091D second address: 73009C4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB41C4Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push 00000001h 0x0000000d jmp 00007F4D4CB41C56h 0x00000012 nop 0x00000013 jmp 00007F4D4CB41C50h 0x00000018 push eax 0x00000019 pushad 0x0000001a mov dx, 5074h 0x0000001e pushfd 0x0000001f jmp 00007F4D4CB41C4Dh 0x00000024 jmp 00007F4D4CB41C4Bh 0x00000029 popfd 0x0000002a popad 0x0000002b nop 0x0000002c pushad 0x0000002d pushfd 0x0000002e jmp 00007F4D4CB41C54h 0x00000033 sub si, 4558h 0x00000038 jmp 00007F4D4CB41C4Bh 0x0000003d popfd 0x0000003e mov di, si 0x00000041 popad 0x00000042 lea eax, dword ptr [ebp-10h] 0x00000045 jmp 00007F4D4CB41C52h 0x0000004a nop 0x0000004b push eax 0x0000004c push edx 0x0000004d pushad 0x0000004e mov esi, edi 0x00000050 mov dx, 86FCh 0x00000054 popad 0x00000055 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 73009C4 second address: 73009CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 73009CA second address: 73009CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 7300A13 second address: 7300ABE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB43A31h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edi, eax 0x0000000b jmp 00007F4D4CB43A2Eh 0x00000010 test edi, edi 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007F4D4CB43A2Eh 0x00000019 sbb si, 5938h 0x0000001e jmp 00007F4D4CB43A2Bh 0x00000023 popfd 0x00000024 pushfd 0x00000025 jmp 00007F4D4CB43A38h 0x0000002a adc si, D398h 0x0000002f jmp 00007F4D4CB43A2Bh 0x00000034 popfd 0x00000035 popad 0x00000036 js 00007F4DBADC2663h 0x0000003c jmp 00007F4D4CB43A36h 0x00000041 mov eax, dword ptr [ebp-0Ch] 0x00000044 push eax 0x00000045 push edx 0x00000046 jmp 00007F4D4CB43A37h 0x0000004b rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 7300ABE second address: 7300AD6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4D4CB41C54h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 7300AD6 second address: 7300ADA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 7300ADA second address: 7300AF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esi+04h], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F4D4CB41C4Ah 0x00000012 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 7300AF1 second address: 7300BD6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F4D4CB43A31h 0x00000009 or cx, 96A6h 0x0000000e jmp 00007F4D4CB43A31h 0x00000013 popfd 0x00000014 mov ch, D9h 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 lea eax, dword ptr [ebx+78h] 0x0000001c pushad 0x0000001d pushfd 0x0000001e jmp 00007F4D4CB43A39h 0x00000023 sbb ah, FFFFFFB6h 0x00000026 jmp 00007F4D4CB43A31h 0x0000002b popfd 0x0000002c pushfd 0x0000002d jmp 00007F4D4CB43A30h 0x00000032 sub eax, 5ADF21D8h 0x00000038 jmp 00007F4D4CB43A2Bh 0x0000003d popfd 0x0000003e popad 0x0000003f push 00000001h 0x00000041 jmp 00007F4D4CB43A36h 0x00000046 nop 0x00000047 jmp 00007F4D4CB43A30h 0x0000004c push eax 0x0000004d jmp 00007F4D4CB43A2Bh 0x00000052 nop 0x00000053 jmp 00007F4D4CB43A36h 0x00000058 lea eax, dword ptr [ebp-08h] 0x0000005b push eax 0x0000005c push edx 0x0000005d push eax 0x0000005e push edx 0x0000005f jmp 00007F4D4CB43A2Ah 0x00000064 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 7300BD6 second address: 7300BDA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 7300BDA second address: 7300BE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 7300BE0 second address: 7300C0C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB41C4Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F4D4CB41C57h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 7300C59 second address: 7300CE6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB43A32h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edi, eax 0x0000000b pushad 0x0000000c mov cl, 25h 0x0000000e mov cl, dh 0x00000010 popad 0x00000011 test edi, edi 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007F4D4CB43A30h 0x0000001a adc eax, 596CB4D8h 0x00000020 jmp 00007F4D4CB43A2Bh 0x00000025 popfd 0x00000026 pushfd 0x00000027 jmp 00007F4D4CB43A38h 0x0000002c xor esi, 38E37F38h 0x00000032 jmp 00007F4D4CB43A2Bh 0x00000037 popfd 0x00000038 popad 0x00000039 js 00007F4DBADC2416h 0x0000003f push eax 0x00000040 push edx 0x00000041 jmp 00007F4D4CB43A35h 0x00000046 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 7300CE6 second address: 7300D04 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB41C51h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [ebp-04h] 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 7300D04 second address: 7300D08 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 7300D08 second address: 7300D0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 7300D0E second address: 7300D91 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, ecx 0x00000005 pushfd 0x00000006 jmp 00007F4D4CB43A2Ch 0x0000000b add cl, 00000028h 0x0000000e jmp 00007F4D4CB43A2Bh 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 mov dword ptr [esi+08h], eax 0x0000001a pushad 0x0000001b mov si, C73Bh 0x0000001f mov dx, si 0x00000022 popad 0x00000023 lea eax, dword ptr [ebx+70h] 0x00000026 pushad 0x00000027 mov edx, eax 0x00000029 pushad 0x0000002a mov ah, 83h 0x0000002c push edx 0x0000002d pop esi 0x0000002e popad 0x0000002f popad 0x00000030 push 00000001h 0x00000032 jmp 00007F4D4CB43A39h 0x00000037 nop 0x00000038 pushad 0x00000039 mov bh, ch 0x0000003b popad 0x0000003c push eax 0x0000003d jmp 00007F4D4CB43A35h 0x00000042 nop 0x00000043 push eax 0x00000044 push edx 0x00000045 jmp 00007F4D4CB43A2Dh 0x0000004a rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 7300E92 second address: 7300ED7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB41C51h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 js 00007F4DBADC044Eh 0x0000000f jmp 00007F4D4CB41C4Eh 0x00000014 mov eax, dword ptr [ebp-14h] 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F4D4CB41C57h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 7300ED7 second address: 7300EFC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB43A39h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, esi 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 7300EFC second address: 7300F00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 7300F00 second address: 7300F04 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 7300F04 second address: 7300F0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 7300F0A second address: 7300FD2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB43A32h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esi+0Ch], eax 0x0000000c pushad 0x0000000d pushad 0x0000000e movzx eax, dx 0x00000011 mov cx, bx 0x00000014 popad 0x00000015 mov si, di 0x00000018 popad 0x00000019 mov edx, 756006ECh 0x0000001e jmp 00007F4D4CB43A37h 0x00000023 sub eax, eax 0x00000025 pushad 0x00000026 mov di, 49F8h 0x0000002a pushfd 0x0000002b jmp 00007F4D4CB43A31h 0x00000030 or cx, BFE6h 0x00000035 jmp 00007F4D4CB43A31h 0x0000003a popfd 0x0000003b popad 0x0000003c lock cmpxchg dword ptr [edx], ecx 0x00000040 pushad 0x00000041 pushfd 0x00000042 jmp 00007F4D4CB43A33h 0x00000047 xor eax, 22F31B1Eh 0x0000004d jmp 00007F4D4CB43A39h 0x00000052 popfd 0x00000053 popad 0x00000054 pop edi 0x00000055 push eax 0x00000056 push edx 0x00000057 pushad 0x00000058 call 00007F4D4CB43A33h 0x0000005d pop ecx 0x0000005e mov cl, bl 0x00000060 popad 0x00000061 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 7301110 second address: 730117B instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F4D4CB41C4Ch 0x00000008 add cx, 00D8h 0x0000000d jmp 00007F4D4CB41C4Bh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 popad 0x00000016 mov dword ptr [edx+0Ch], eax 0x00000019 jmp 00007F4D4CB41C56h 0x0000001e mov eax, dword ptr [esi+10h] 0x00000021 jmp 00007F4D4CB41C50h 0x00000026 mov dword ptr [edx+10h], eax 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007F4D4CB41C57h 0x00000030 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 730117B second address: 73011BE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop eax 0x00000005 pushfd 0x00000006 jmp 00007F4D4CB43A2Bh 0x0000000b sub ch, 0000005Eh 0x0000000e jmp 00007F4D4CB43A39h 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 mov eax, dword ptr [esi+14h] 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F4D4CB43A2Dh 0x00000021 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 73011BE second address: 7301203 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB41C51h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [edx+14h], eax 0x0000000c pushad 0x0000000d mov ebx, esi 0x0000000f jmp 00007F4D4CB41C58h 0x00000014 popad 0x00000015 mov eax, dword ptr [esi+18h] 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F4D4CB41C4Ah 0x00000021 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 7301203 second address: 7301207 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 7301207 second address: 730120D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 730120D second address: 730126F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB43A2Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [edx+18h], eax 0x0000000c pushad 0x0000000d movzx esi, di 0x00000010 movsx edi, ax 0x00000013 popad 0x00000014 mov eax, dword ptr [esi+1Ch] 0x00000017 jmp 00007F4D4CB43A32h 0x0000001c mov dword ptr [edx+1Ch], eax 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 pushfd 0x00000023 jmp 00007F4D4CB43A2Dh 0x00000028 xor si, AA16h 0x0000002d jmp 00007F4D4CB43A31h 0x00000032 popfd 0x00000033 mov si, 4C87h 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 730126F second address: 7301275 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 7301275 second address: 7301279 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 7301279 second address: 73012BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esi+20h] 0x0000000b jmp 00007F4D4CB41C4Bh 0x00000010 mov dword ptr [edx+20h], eax 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 call 00007F4D4CB41C4Bh 0x0000001b pop ecx 0x0000001c jmp 00007F4D4CB41C59h 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 73012BB second address: 73012E2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB43A31h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esi+24h] 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F4D4CB43A2Dh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 73012E2 second address: 73013A8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F4D4CB41C57h 0x00000008 pop esi 0x00000009 pushfd 0x0000000a jmp 00007F4D4CB41C59h 0x0000000f sbb cx, D0F6h 0x00000014 jmp 00007F4D4CB41C51h 0x00000019 popfd 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d mov dword ptr [edx+24h], eax 0x00000020 pushad 0x00000021 pushfd 0x00000022 jmp 00007F4D4CB41C4Ch 0x00000027 add cl, 00000018h 0x0000002a jmp 00007F4D4CB41C4Bh 0x0000002f popfd 0x00000030 movzx ecx, dx 0x00000033 popad 0x00000034 mov eax, dword ptr [esi+28h] 0x00000037 jmp 00007F4D4CB41C4Bh 0x0000003c mov dword ptr [edx+28h], eax 0x0000003f jmp 00007F4D4CB41C56h 0x00000044 mov ecx, dword ptr [esi+2Ch] 0x00000047 push eax 0x00000048 push edx 0x00000049 pushad 0x0000004a pushfd 0x0000004b jmp 00007F4D4CB41C4Dh 0x00000050 add ax, F516h 0x00000055 jmp 00007F4D4CB41C51h 0x0000005a popfd 0x0000005b popad 0x0000005c rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 73013A8 second address: 73013D5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB43A2Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [edx+2Ch], ecx 0x0000000c jmp 00007F4D4CB43A30h 0x00000011 mov ax, word ptr [esi+30h] 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 movzx eax, dx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 73013D5 second address: 7301427 instructions: 0x00000000 rdtsc 0x00000002 call 00007F4D4CB41C59h 0x00000007 pop esi 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov ax, dx 0x0000000d popad 0x0000000e mov word ptr [edx+30h], ax 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 pushfd 0x00000016 jmp 00007F4D4CB41C54h 0x0000001b sub cx, 6D28h 0x00000020 jmp 00007F4D4CB41C4Bh 0x00000025 popfd 0x00000026 push ecx 0x00000027 pop ebx 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 7301427 second address: 730144A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB43A35h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ax, word ptr [esi+32h] 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 730144A second address: 7301450 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 7301450 second address: 7301488 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx ecx, bx 0x00000006 mov ebx, 7CAB68D0h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov word ptr [edx+32h], ax 0x00000012 jmp 00007F4D4CB43A2Fh 0x00000017 mov eax, dword ptr [esi+34h] 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F4D4CB43A30h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 7301488 second address: 7301497 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB41C4Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 7301497 second address: 730152E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB43A39h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [edx+34h], eax 0x0000000c jmp 00007F4D4CB43A2Eh 0x00000011 test ecx, 00000700h 0x00000017 jmp 00007F4D4CB43A30h 0x0000001c jne 00007F4DBADC1C62h 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 pushfd 0x00000026 jmp 00007F4D4CB43A2Dh 0x0000002b xor esi, 76788176h 0x00000031 jmp 00007F4D4CB43A31h 0x00000036 popfd 0x00000037 pushfd 0x00000038 jmp 00007F4D4CB43A30h 0x0000003d or ecx, 608AFE98h 0x00000043 jmp 00007F4D4CB43A2Bh 0x00000048 popfd 0x00000049 popad 0x0000004a rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 730152E second address: 73015B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB41C59h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 or dword ptr [edx+38h], FFFFFFFFh 0x0000000d jmp 00007F4D4CB41C4Eh 0x00000012 or dword ptr [edx+3Ch], FFFFFFFFh 0x00000016 jmp 00007F4D4CB41C50h 0x0000001b or dword ptr [edx+40h], FFFFFFFFh 0x0000001f jmp 00007F4D4CB41C50h 0x00000024 pop esi 0x00000025 pushad 0x00000026 movzx eax, dx 0x00000029 movsx edi, cx 0x0000002c popad 0x0000002d pop ebx 0x0000002e pushad 0x0000002f pushfd 0x00000030 jmp 00007F4D4CB41C50h 0x00000035 or cx, 54E8h 0x0000003a jmp 00007F4D4CB41C4Bh 0x0000003f popfd 0x00000040 push eax 0x00000041 push edx 0x00000042 mov cl, 4Bh 0x00000044 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 7350C9F second address: 7350CAF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4D4CB43A2Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 72F06E8 second address: 72F06ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 72F06ED second address: 72F06FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4D4CB43A2Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 72F06FC second address: 72F0712 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F4D4CB41C4Bh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 72F0712 second address: 72F0758 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop ecx 0x00000005 mov ecx, ebx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, ebp 0x0000000b pushad 0x0000000c mov ecx, edx 0x0000000e pushfd 0x0000000f jmp 00007F4D4CB43A2Fh 0x00000014 sub cx, E57Eh 0x00000019 jmp 00007F4D4CB43A39h 0x0000001e popfd 0x0000001f popad 0x00000020 mov ebp, esp 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 72F0758 second address: 72F076B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB41C4Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 7290012 second address: 7290018 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 7290018 second address: 729001C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 729001C second address: 7290058 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebp 0x00000009 jmp 00007F4D4CB43A36h 0x0000000e mov dword ptr [esp], ebp 0x00000011 pushad 0x00000012 mov edi, esi 0x00000014 mov bh, al 0x00000016 popad 0x00000017 mov ebp, esp 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F4D4CB43A30h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 729064F second address: 72906C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F4D4CB41C57h 0x00000009 add cx, 257Eh 0x0000000e jmp 00007F4D4CB41C59h 0x00000013 popfd 0x00000014 pushfd 0x00000015 jmp 00007F4D4CB41C50h 0x0000001a or esi, 7900D078h 0x00000020 jmp 00007F4D4CB41C4Bh 0x00000025 popfd 0x00000026 popad 0x00000027 pop edx 0x00000028 pop eax 0x00000029 mov ebp, esp 0x0000002b push eax 0x0000002c push edx 0x0000002d push eax 0x0000002e push edx 0x0000002f jmp 00007F4D4CB41C50h 0x00000034 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 72906C5 second address: 72906D4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB43A2Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 72906D4 second address: 72906E8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F4D4CB41C4Fh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 72906E8 second address: 729072D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pop ebp 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d pushfd 0x0000000e jmp 00007F4D4CB43A37h 0x00000013 sub si, 9AFEh 0x00000018 jmp 00007F4D4CB43A39h 0x0000001d popfd 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 72E08DC second address: 72E08E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 72E08E0 second address: 72E08FB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB43A37h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 72E08FB second address: 72E093E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, 46F79E8Ah 0x00000008 pushfd 0x00000009 jmp 00007F4D4CB41C4Bh 0x0000000e jmp 00007F4D4CB41C53h 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 xchg eax, ebp 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F4D4CB41C55h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 72E093E second address: 72E0A09 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB43A31h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push edx 0x0000000c pushfd 0x0000000d jmp 00007F4D4CB43A2Ah 0x00000012 sbb ch, 00000008h 0x00000015 jmp 00007F4D4CB43A2Bh 0x0000001a popfd 0x0000001b pop esi 0x0000001c pushad 0x0000001d mov si, bx 0x00000020 mov di, 4D76h 0x00000024 popad 0x00000025 popad 0x00000026 xchg eax, ebp 0x00000027 pushad 0x00000028 call 00007F4D4CB43A33h 0x0000002d pushfd 0x0000002e jmp 00007F4D4CB43A38h 0x00000033 adc ecx, 43F229C8h 0x00000039 jmp 00007F4D4CB43A2Bh 0x0000003e popfd 0x0000003f pop esi 0x00000040 mov esi, edx 0x00000042 popad 0x00000043 mov ebp, esp 0x00000045 pushad 0x00000046 pushfd 0x00000047 jmp 00007F4D4CB43A2Ch 0x0000004c adc cx, 2C28h 0x00000051 jmp 00007F4D4CB43A2Bh 0x00000056 popfd 0x00000057 popad 0x00000058 pop ebp 0x00000059 pushad 0x0000005a push eax 0x0000005b push edx 0x0000005c pushfd 0x0000005d jmp 00007F4D4CB43A32h 0x00000062 add si, DE88h 0x00000067 jmp 00007F4D4CB43A2Bh 0x0000006c popfd 0x0000006d rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 72C0029 second address: 72C008E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebp 0x00000006 pushad 0x00000007 pushfd 0x00000008 jmp 00007F4D4CB41C4Ah 0x0000000d jmp 00007F4D4CB41C55h 0x00000012 popfd 0x00000013 mov edi, eax 0x00000015 popad 0x00000016 mov dword ptr [esp], ebp 0x00000019 pushad 0x0000001a push esi 0x0000001b pop edx 0x0000001c mov si, 8C77h 0x00000020 popad 0x00000021 mov ebp, esp 0x00000023 jmp 00007F4D4CB41C4Ah 0x00000028 and esp, FFFFFFF0h 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e push ebx 0x0000002f pop ecx 0x00000030 call 00007F4D4CB41C59h 0x00000035 pop eax 0x00000036 popad 0x00000037 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 72C008E second address: 72C011C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB43A2Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub esp, 44h 0x0000000c pushad 0x0000000d call 00007F4D4CB43A2Eh 0x00000012 mov si, D241h 0x00000016 pop ecx 0x00000017 jmp 00007F4D4CB43A37h 0x0000001c popad 0x0000001d xchg eax, ebx 0x0000001e pushad 0x0000001f push esi 0x00000020 mov dx, ED46h 0x00000024 pop ebx 0x00000025 mov dh, ah 0x00000027 popad 0x00000028 push eax 0x00000029 jmp 00007F4D4CB43A36h 0x0000002e xchg eax, ebx 0x0000002f jmp 00007F4D4CB43A30h 0x00000034 xchg eax, esi 0x00000035 push eax 0x00000036 push edx 0x00000037 jmp 00007F4D4CB43A37h 0x0000003c rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 72C011C second address: 72C0148 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB41C59h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F4D4CB41C4Ch 0x00000011 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 72C0148 second address: 72C015A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4D4CB43A2Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 72C015A second address: 72C015E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 72C015E second address: 72C0193 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, esi 0x00000009 jmp 00007F4D4CB43A37h 0x0000000e xchg eax, edi 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F4D4CB43A30h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 72C0193 second address: 72C01A2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB41C4Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 72C01A2 second address: 72C01C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, 6EE677BAh 0x00000008 push edi 0x00000009 pop eax 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F4D4CB43A33h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 72C01C5 second address: 72C01F2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB41C59h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, edi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F4D4CB41C4Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 72C01F2 second address: 72C028C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB43A31h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edi, dword ptr [ebp+08h] 0x0000000c pushad 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F4D4CB43A2Ah 0x00000014 and cx, 2CE8h 0x00000019 jmp 00007F4D4CB43A2Bh 0x0000001e popfd 0x0000001f mov si, 4CDFh 0x00000023 popad 0x00000024 mov edx, esi 0x00000026 popad 0x00000027 mov dword ptr [esp+24h], 00000000h 0x0000002f pushad 0x00000030 movzx eax, dx 0x00000033 mov si, bx 0x00000036 popad 0x00000037 lock bts dword ptr [edi], 00000000h 0x0000003c jmp 00007F4D4CB43A2Bh 0x00000041 jc 00007F4DBCCB5C09h 0x00000047 jmp 00007F4D4CB43A36h 0x0000004c pop edi 0x0000004d jmp 00007F4D4CB43A30h 0x00000052 pop esi 0x00000053 push eax 0x00000054 push edx 0x00000055 push eax 0x00000056 push edx 0x00000057 jmp 00007F4D4CB43A2Ah 0x0000005c rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 72C028C second address: 72C029B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB41C4Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 72F07D7 second address: 72F086C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F4D4CB43A37h 0x00000008 mov dx, ax 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f jmp 00007F4D4CB43A35h 0x00000014 xchg eax, ebp 0x00000015 pushad 0x00000016 pushfd 0x00000017 jmp 00007F4D4CB43A2Ch 0x0000001c adc ah, 00000058h 0x0000001f jmp 00007F4D4CB43A2Bh 0x00000024 popfd 0x00000025 pushfd 0x00000026 jmp 00007F4D4CB43A38h 0x0000002b adc ax, 7EB8h 0x00000030 jmp 00007F4D4CB43A2Bh 0x00000035 popfd 0x00000036 popad 0x00000037 mov ebp, esp 0x00000039 push eax 0x0000003a push edx 0x0000003b push eax 0x0000003c push edx 0x0000003d jmp 00007F4D4CB43A30h 0x00000042 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 72F086C second address: 72F087B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB41C4Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 72F0A52 second address: 72F0A58 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 72F0A58 second address: 72F0A5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 72F0A5C second address: 72F0A60 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 7360A03 second address: 7360A36 instructions: 0x00000000 rdtsc 0x00000002 mov ecx, 667248A7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dl, byte ptr [ebp+14h] 0x0000000d jmp 00007F4D4CB41C4Ah 0x00000012 mov eax, dword ptr [ebp+10h] 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F4D4CB41C57h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 7360A36 second address: 7360A4E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4D4CB43A34h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 7360A4E second address: 7360A52 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 7360A52 second address: 7360AB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 and dl, 00000007h 0x0000000b pushad 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F4D4CB43A33h 0x00000013 sbb esi, 444DF2AEh 0x00000019 jmp 00007F4D4CB43A39h 0x0000001e popfd 0x0000001f call 00007F4D4CB43A30h 0x00000024 pop ecx 0x00000025 popad 0x00000026 mov edx, 241862E6h 0x0000002b popad 0x0000002c test eax, eax 0x0000002e push eax 0x0000002f push edx 0x00000030 pushad 0x00000031 pushad 0x00000032 popad 0x00000033 popad 0x00000034 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 7360AB3 second address: 7360AB9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 7360AB9 second address: 7360ADC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F4DBCC39157h 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F4D4CB43A32h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 7340E8E second address: 7340E92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 7340E92 second address: 7340EAF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB43A39h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 7340EAF second address: 7340ED3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB41C51h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F4D4CB41C4Ch 0x00000011 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 7340ED3 second address: 7340EED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bh, 8Dh 0x00000005 call 00007F4D4CB43A2Ah 0x0000000a pop ecx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 7340EED second address: 7340EF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 7340EF1 second address: 7340EF7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 7340EF7 second address: 7340EFD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 7340EFD second address: 7340F20 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F4D4CB43A35h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 7340F20 second address: 7340F26 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 7350427 second address: 735042B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 735042B second address: 7350431 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 7350431 second address: 7350442 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4D4CB43A2Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 7350442 second address: 7350472 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a mov edx, ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushfd 0x0000000f jmp 00007F4D4CB41C52h 0x00000014 adc ah, FFFFFF88h 0x00000017 jmp 00007F4D4CB41C4Bh 0x0000001c popfd 0x0000001d rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 7350472 second address: 73504E3 instructions: 0x00000000 rdtsc 0x00000002 call 00007F4D4CB43A38h 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp], ebp 0x0000000e jmp 00007F4D4CB43A31h 0x00000013 mov ebp, esp 0x00000015 jmp 00007F4D4CB43A2Eh 0x0000001a xchg eax, ebx 0x0000001b jmp 00007F4D4CB43A30h 0x00000020 push eax 0x00000021 pushad 0x00000022 mov dx, 9A24h 0x00000026 popad 0x00000027 xchg eax, ebx 0x00000028 push eax 0x00000029 push edx 0x0000002a pushad 0x0000002b call 00007F4D4CB43A30h 0x00000030 pop ecx 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 73504E3 second address: 73504E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 73504E8 second address: 7350506 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB43A2Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push edx 0x0000000e pop eax 0x0000000f mov edx, 111B3E4Ch 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 7350506 second address: 7350540 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB41C52h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F4D4CB41C4Bh 0x0000000f xchg eax, esi 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F4D4CB41C55h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 7350540 second address: 7350546 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 7350546 second address: 735054A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 735054A second address: 7350582 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov esi, dword ptr [ebp+08h] 0x0000000b jmp 00007F4D4CB43A2Fh 0x00000010 sub ecx, ecx 0x00000012 pushad 0x00000013 movsx edx, ax 0x00000016 mov edi, ecx 0x00000018 popad 0x00000019 xchg eax, edi 0x0000001a pushad 0x0000001b mov si, F535h 0x0000001f pushad 0x00000020 mov di, si 0x00000023 mov dh, ah 0x00000025 popad 0x00000026 popad 0x00000027 push eax 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 7350582 second address: 7350586 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 7350586 second address: 735058C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 735058C second address: 7350592 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 7350592 second address: 7350596 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 7350596 second address: 73505BA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, edi 0x00000009 jmp 00007F4D4CB41C50h 0x0000000e mov eax, 00000001h 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 73505BA second address: 73505D7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB43A39h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 73505D7 second address: 7350642 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB41C51h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lock cmpxchg dword ptr [esi], ecx 0x0000000d jmp 00007F4D4CB41C4Eh 0x00000012 mov ecx, eax 0x00000014 jmp 00007F4D4CB41C50h 0x00000019 cmp ecx, 01h 0x0000001c jmp 00007F4D4CB41C50h 0x00000021 jne 00007F4DBCC23BF1h 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007F4D4CB41C57h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 7350642 second address: 735065A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4D4CB43A34h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 735065A second address: 7350694 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edi 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov edi, esi 0x0000000e pushfd 0x0000000f jmp 00007F4D4CB41C54h 0x00000014 jmp 00007F4D4CB41C55h 0x00000019 popfd 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 7350694 second address: 7350712 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, 79B48D72h 0x00000008 call 00007F4D4CB43A33h 0x0000000d pop ecx 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pop esi 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007F4D4CB43A35h 0x00000019 sub esi, 2C8A38F6h 0x0000001f jmp 00007F4D4CB43A31h 0x00000024 popfd 0x00000025 call 00007F4D4CB43A30h 0x0000002a push ecx 0x0000002b pop edx 0x0000002c pop ecx 0x0000002d popad 0x0000002e pop ebx 0x0000002f push eax 0x00000030 push edx 0x00000031 jmp 00007F4D4CB43A38h 0x00000036 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 73104D9 second address: 7310548 instructions: 0x00000000 rdtsc 0x00000002 mov bx, ax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F4D4CB41C52h 0x00000011 sbb ax, 8008h 0x00000016 jmp 00007F4D4CB41C4Bh 0x0000001b popfd 0x0000001c pushad 0x0000001d mov al, C6h 0x0000001f pushfd 0x00000020 jmp 00007F4D4CB41C4Bh 0x00000025 and ax, 784Eh 0x0000002a jmp 00007F4D4CB41C59h 0x0000002f popfd 0x00000030 popad 0x00000031 popad 0x00000032 xchg eax, ecx 0x00000033 push eax 0x00000034 push edx 0x00000035 jmp 00007F4D4CB41C4Dh 0x0000003a rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 7310548 second address: 731057C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB43A31h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b mov edi, 542FFCC2h 0x00000010 mov ebx, 0485230Eh 0x00000015 popad 0x00000016 xchg eax, ecx 0x00000017 pushad 0x00000018 movsx edx, ax 0x0000001b push eax 0x0000001c push edx 0x0000001d call 00007F4D4CB43A2Ah 0x00000022 pop esi 0x00000023 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 731057C second address: 73105DF instructions: 0x00000000 rdtsc 0x00000002 mov ebx, 25D23496h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push 00000000h 0x0000000c jmp 00007F4D4CB41C4Dh 0x00000011 push 00000000h 0x00000013 jmp 00007F4D4CB41C4Eh 0x00000018 push dword ptr [ebp+08h] 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e mov bx, B2D0h 0x00000022 pushfd 0x00000023 jmp 00007F4D4CB41C59h 0x00000028 adc ah, 00000056h 0x0000002b jmp 00007F4D4CB41C51h 0x00000030 popfd 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 73105DF second address: 73105EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4D4CB43A2Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 73102D5 second address: 7310311 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F4D4CB41C58h 0x00000009 xor cx, 5128h 0x0000000e jmp 00007F4D4CB41C4Bh 0x00000013 popfd 0x00000014 mov ecx, 4DAFD61Fh 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c xchg eax, ebp 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 mov dx, si 0x00000023 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 7310311 second address: 7310367 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F4D4CB43A2Ah 0x00000008 and eax, 75258388h 0x0000000e jmp 00007F4D4CB43A2Bh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 pushfd 0x00000017 jmp 00007F4D4CB43A38h 0x0000001c and ah, FFFFFFE8h 0x0000001f jmp 00007F4D4CB43A2Bh 0x00000024 popfd 0x00000025 popad 0x00000026 push eax 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a push esi 0x0000002b pop ebx 0x0000002c mov ecx, 751551ADh 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 7310367 second address: 7310396 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB41C53h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F4D4CB41C55h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 7310396 second address: 73103A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4D4CB43A2Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 73103A6 second address: 73103CD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F4D4CB41C59h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 73103CD second address: 73103D3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 73103D3 second address: 73103D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 73103D9 second address: 7310444 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB43A36h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [ebp+08h] 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007F4D4CB43A2Eh 0x00000015 or ecx, 420721C8h 0x0000001b jmp 00007F4D4CB43A2Bh 0x00000020 popfd 0x00000021 jmp 00007F4D4CB43A38h 0x00000026 popad 0x00000027 and dword ptr [eax], 00000000h 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e jmp 00007F4D4CB43A2Ah 0x00000033 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 7310444 second address: 7310448 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 7310448 second address: 731044E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 7310150 second address: 7310167 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4D4CB41C53h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 7310167 second address: 7310196 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB43A39h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F4D4CB43A2Dh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 7310196 second address: 73101C2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB41C51h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007F4D4CB41C4Eh 0x00000010 pop ebp 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 mov bx, cx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 72A0199 second address: 72A019E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 72A019E second address: 72A01A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 72A01A4 second address: 72A01A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe RDTSC instruction interceptor: First address: 72A01A8 second address: 72A01E3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 jmp 00007F4D4CB41C56h 0x0000000e mov dword ptr [esp], ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F4D4CB41C57h 0x00000018 rdtsc
Tries to evade debugger and weak emulator (self modifying code)
Source: C:\Users\user\Desktop\94g4KHMj9B.exe Special instruction interceptor: First address: C6BA4A instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\94g4KHMj9B.exe Special instruction interceptor: First address: E12A1E instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\94g4KHMj9B.exe Special instruction interceptor: First address: E20CB8 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\94g4KHMj9B.exe Special instruction interceptor: First address: E9FE0C instructions caused by: Self-modifying code
Contains capabilities to detect virtual machines
Source: C:\Users\user\Desktop\94g4KHMj9B.exe Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\94g4KHMj9B.exe Code function: 0_2_072D0B13 rdtsc 0_2_072D0B13
Found large amount of non-executed APIs
Source: C:\Users\user\Desktop\94g4KHMj9B.exe API coverage: 2.7 %
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Users\user\Desktop\94g4KHMj9B.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\94g4KHMj9B.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: 94g4KHMj9B.exe, 94g4KHMj9B.exe, 00000000.00000002.1651382690.0000000000DEE000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: Amcache.hve.4.dr Binary or memory string: VMware
Source: Amcache.hve.4.dr Binary or memory string: VMware Virtual USB Mouse
Source: 94g4KHMj9B.exe, 00000000.00000003.1491349345.0000000006B61000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Y\MACHINE\SYSTEM\ControlSet001\Services\VBoxSFlO#b
Source: Amcache.hve.4.dr Binary or memory string: vmci.syshbin
Source: Amcache.hve.4.dr Binary or memory string: VMware-42 27 c5 9a 47 85 d6 84-53 49 ec ec 87 a6 6d 67
Source: Amcache.hve.4.dr Binary or memory string: VMware, Inc.
Source: Amcache.hve.4.dr Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.4.dr Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.4.dr Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: 94g4KHMj9B.exe, 00000000.00000003.1461567252.00000000075D6000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: SYSINTERNALSNum_processorNum_ramnameallfreedriversNum_displaysresolution_xresolution_y\*recent_filesprocessesuptime_minutesC:\Windows\System32\VBox*.dll01vbox_firstSYSTEM\ControlSet001\Services\VBoxSFvbox_secondC:\USERS\PUBLIC\public_checkWINDBG.EXEdbgwireshark.exeprocmon.exex64dbg.exeida.exedbg_secdbg_thirdyadroinstalled_appsSOFTWARE\Microsoft\Windows\CurrentVersion\UninstallSOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall%d%s\%sDisplayNameapp_nameindexCreateToolhelp32Snapshot failed.
Source: Amcache.hve.4.dr Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.4.dr Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: 94g4KHMj9B.exe, 00000000.00000002.1652230066.0000000001991000.00000004.00000020.00020000.00000000.sdmp, 94g4KHMj9B.exe, 00000000.00000003.1488916312.0000000001942000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Amcache.hve.4.dr Binary or memory string: vmci.sys
Source: 94g4KHMj9B.exe, 00000000.00000003.1461567252.00000000075D6000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: SYSTEM\ControlSet001\Services\VBoxSF
Source: Amcache.hve.4.dr Binary or memory string: vmci.syshbin`
Source: Amcache.hve.4.dr Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.4.dr Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr Binary or memory string: VMware20,1
Source: Amcache.hve.4.dr Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.4.dr Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.4.dr Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.4.dr Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.4.dr Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.4.dr Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.4.dr Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.4.dr Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.4.dr Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.4.dr Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: 94g4KHMj9B.exe, 00000000.00000002.1651382690.0000000000DEE000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: Amcache.hve.4.dr Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: C:\Users\user\Desktop\94g4KHMj9B.exe System information queried: ModuleInformation Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging
barindex
Hides threads from debuggers
Source: C:\Users\user\Desktop\94g4KHMj9B.exe Thread information set: HideFromDebugger Jump to behavior
Potentially malicious time measurement code found
Source: C:\Users\user\Desktop\94g4KHMj9B.exe Code function: 0_2_07330A34 Start: 07330BA4 End: 07330AD2 0_2_07330A34
Source: C:\Users\user\Desktop\94g4KHMj9B.exe Code function: 0_2_07330A22 Start: 07330BA4 End: 07330AD2 0_2_07330A22
Source: C:\Users\user\Desktop\94g4KHMj9B.exe Code function: 0_2_07330A15 Start: 07330BA4 End: 07330AD2 0_2_07330A15
Source: C:\Users\user\Desktop\94g4KHMj9B.exe Code function: 0_2_07330A66 Start: 07330BA4 End: 07330AD2 0_2_07330A66
Source: C:\Users\user\Desktop\94g4KHMj9B.exe Code function: 0_2_0733096C Start: 07330BA4 End: 07330AD2 0_2_0733096C
Source: C:\Users\user\Desktop\94g4KHMj9B.exe Code function: 0_2_073309A1 Start: 07330BA4 End: 07330AD2 0_2_073309A1
Source: C:\Users\user\Desktop\94g4KHMj9B.exe Code function: 0_2_073309AE Start: 07330BA4 End: 07330AD2 0_2_073309AE
Source: C:\Users\user\Desktop\94g4KHMj9B.exe Code function: 0_2_0733098D Start: 07330BA4 End: 07330AD2 0_2_0733098D
Source: C:\Users\user\Desktop\94g4KHMj9B.exe Code function: 0_2_073309F7 Start: 07330BA4 End: 07330AD2 0_2_073309F7
Source: C:\Users\user\Desktop\94g4KHMj9B.exe Code function: 0_2_073309CB Start: 07330BA4 End: 07330AD2 0_2_073309CB
Tries to detect sandboxes and other dynamic analysis tools (window names)
Source: C:\Users\user\Desktop\94g4KHMj9B.exe Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\94g4KHMj9B.exe Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\94g4KHMj9B.exe Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\94g4KHMj9B.exe Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\94g4KHMj9B.exe Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\94g4KHMj9B.exe Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\94g4KHMj9B.exe Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\94g4KHMj9B.exe Open window title or class name: file monitor - sysinternals: www.sysinternals.com
Checks for debuggers (devices)
Source: C:\Users\user\Desktop\94g4KHMj9B.exe File opened: NTICE
Source: C:\Users\user\Desktop\94g4KHMj9B.exe File opened: SICE
Source: C:\Users\user\Desktop\94g4KHMj9B.exe File opened: SIWVID
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\94g4KHMj9B.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\94g4KHMj9B.exe Code function: 0_2_072D0B13 rdtsc 0_2_072D0B13
Source: 94g4KHMj9B.exe Binary or memory string: Program Manager
Source: 94g4KHMj9B.exe, 00000000.00000002.1651382690.0000000000DEE000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: Program Manager
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\94g4KHMj9B.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
AV process strings found (often used to terminate AV products)
Source: 94g4KHMj9B.exe, 00000000.00000002.1650797309.0000000000AFD000.00000040.00000001.01000000.00000003.sdmp, 94g4KHMj9B.exe, 00000000.00000003.1461567252.00000000075D6000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: procmon.exe
Source: Amcache.hve.4.dr Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.4.dr Binary or memory string: msmpeng.exe
Source: 94g4KHMj9B.exe, 00000000.00000002.1650797309.0000000000AFD000.00000040.00000001.01000000.00000003.sdmp, 94g4KHMj9B.exe, 00000000.00000003.1461567252.00000000075D6000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: wireshark.exe
Source: Amcache.hve.4.dr Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.4.dr Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.4.dr Binary or memory string: MsMpEng.exe
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1579683 Sample: 94g4KHMj9B.exe Startdate: 23/12/2024 Architecture: WINDOWS Score: 100 19 Antivirus / Scanner detection for submitted sample 2->19 21 Multi AV Scanner detection for submitted file 2->21 23 Machine Learning detection for sample 2->23 25 2 other signatures 2->25 6 94g4KHMj9B.exe 2->6         started        process3 dnsIp4 15 httpbin.org 34.226.108.155, 443, 49704 AMAZON-AESUS United States 6->15 17 home.fivetk5ht.top 6->17 27 Detected unpacking (changes PE section rights) 6->27 29 Tries to detect sandboxes and other dynamic analysis tools (window names) 6->29 31 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 6->31 33 6 other signatures 6->33 10 WerFault.exe 19 16 6->10         started        signatures5 process6 file7 13 C:\ProgramData\Microsoft\...\Report.wer, Unicode 10->13 dropped
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
34.226.108.155
 httpbin.org United States
14618 AMAZON-AESUS false

Contacted Domains

Name IP Active
httpbin.org 34.226.108.155 true
home.fivetk5ht.top unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://httpbin.org/ip false
    		high