Windows Analysis Report
5yCKVE324w.exe

Overview

General Information

Sample name: 5yCKVE324w.exe
renamed because original name is a hash value
Original sample name: 442fc32065555d167806a2a766454b88.exe
Analysis ID: 1646788
MD5: 442fc32065555d167806a2a766454b88
SHA1: 10882938da5aed6fe9e2d7df16919aca6e849eff
SHA256: 61260d7384abdbdf1ca775670bc8c19a0fae83b36f5c45913f8309fe15ce2af9
Tags: exeuser-abuse_ch
Infos:

Detection

Amadey
Score: 100
Range: 0 - 100
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Antivirus detection for dropped file
Detected unpacking (changes PE section rights)
Found malware configuration
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected Amadey
Yara detected Amadeys Clipper DLL
C2 URLs / IPs found in malware configuration
Contains functionality to start a terminal service
Hides threads from debuggers
Joe Sandbox ML detected suspicious sample
PE file contains section with special chars
Sample uses string decryption to hide its real strings
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Abnormal high CPU Usage
Checks for debuggers (devices)
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Creates job files (autostart)
Detected potential crypto function
Drops PE files
Entry point lies outside standard sections
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains an invalid checksum
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
Name Description Attribution Blogpost URLs Link
Amadey Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: 5yCKVE324w.exe Avira: detected
Antivirus detection for URL or domain
Source: http://176.113.115.6/Ni9kiput/index.php; Avira URL Cloud: Label: malware
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Found malware configuration
Source: 0000000A.00000003.1297610885.0000000004C90000.00000004.00001000.00020000.00000000.sdmp Malware Configuration Extractor: Amadey {"C2 url": "176.113.115.6/Ni9kiput/index.php", "Version": "5.21", "Install Folder": "bb556cff4a", "Install File": "rapes.exe"}
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe ReversingLabs: Detection: 66%
Multi AV Scanner detection for submitted file
Source: 5yCKVE324w.exe ReversingLabs: Detection: 66%
Source: 5yCKVE324w.exe Virustotal: Detection: 57% Perma Link
Joe Sandbox ML detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Sample uses string decryption to hide its real strings
Source: 0000000A.00000003.1297610885.0000000004C90000.00000004.00001000.00020000.00000000.sdmp String decryptor: 176.113.115.6
Source: 0000000A.00000003.1297610885.0000000004C90000.00000004.00001000.00020000.00000000.sdmp String decryptor: /Ni9kiput/index.php
Source: 0000000A.00000003.1297610885.0000000004C90000.00000004.00001000.00020000.00000000.sdmp String decryptor: S-%lu-
Source: 0000000A.00000003.1297610885.0000000004C90000.00000004.00001000.00020000.00000000.sdmp String decryptor: bb556cff4a
Source: 0000000A.00000003.1297610885.0000000004C90000.00000004.00001000.00020000.00000000.sdmp String decryptor: rapes.exe
Source: 0000000A.00000003.1297610885.0000000004C90000.00000004.00001000.00020000.00000000.sdmp String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Source: 0000000A.00000003.1297610885.0000000004C90000.00000004.00001000.00020000.00000000.sdmp String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Source: 0000000A.00000003.1297610885.0000000004C90000.00000004.00001000.00020000.00000000.sdmp String decryptor: Startup
Source: 0000000A.00000003.1297610885.0000000004C90000.00000004.00001000.00020000.00000000.sdmp String decryptor: cmd /C RMDIR /s/q
Source: 0000000A.00000003.1297610885.0000000004C90000.00000004.00001000.00020000.00000000.sdmp String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Source: 0000000A.00000003.1297610885.0000000004C90000.00000004.00001000.00020000.00000000.sdmp String decryptor: rundll32
Source: 0000000A.00000003.1297610885.0000000004C90000.00000004.00001000.00020000.00000000.sdmp String decryptor: Programs
Source: 0000000A.00000003.1297610885.0000000004C90000.00000004.00001000.00020000.00000000.sdmp String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
Source: 0000000A.00000003.1297610885.0000000004C90000.00000004.00001000.00020000.00000000.sdmp String decryptor: %USERPROFILE%
Source: 0000000A.00000003.1297610885.0000000004C90000.00000004.00001000.00020000.00000000.sdmp String decryptor: cred.dll|clip.dll|
Source: 0000000A.00000003.1297610885.0000000004C90000.00000004.00001000.00020000.00000000.sdmp String decryptor: cred.dll
Source: 0000000A.00000003.1297610885.0000000004C90000.00000004.00001000.00020000.00000000.sdmp String decryptor: clip.dll
Source: 0000000A.00000003.1297610885.0000000004C90000.00000004.00001000.00020000.00000000.sdmp String decryptor: http://
Source: 0000000A.00000003.1297610885.0000000004C90000.00000004.00001000.00020000.00000000.sdmp String decryptor: https://
Source: 0000000A.00000003.1297610885.0000000004C90000.00000004.00001000.00020000.00000000.sdmp String decryptor: /quiet
Source: 0000000A.00000003.1297610885.0000000004C90000.00000004.00001000.00020000.00000000.sdmp String decryptor: /Plugins/
Source: 0000000A.00000003.1297610885.0000000004C90000.00000004.00001000.00020000.00000000.sdmp String decryptor: &unit=
Source: 0000000A.00000003.1297610885.0000000004C90000.00000004.00001000.00020000.00000000.sdmp String decryptor: shell32.dll
Source: 0000000A.00000003.1297610885.0000000004C90000.00000004.00001000.00020000.00000000.sdmp String decryptor: kernel32.dll
Source: 0000000A.00000003.1297610885.0000000004C90000.00000004.00001000.00020000.00000000.sdmp String decryptor: GetNativeSystemInfo
Source: 0000000A.00000003.1297610885.0000000004C90000.00000004.00001000.00020000.00000000.sdmp String decryptor: ProgramData\
Source: 0000000A.00000003.1297610885.0000000004C90000.00000004.00001000.00020000.00000000.sdmp String decryptor: AVAST Software
Source: 0000000A.00000003.1297610885.0000000004C90000.00000004.00001000.00020000.00000000.sdmp String decryptor: Kaspersky Lab
Source: 0000000A.00000003.1297610885.0000000004C90000.00000004.00001000.00020000.00000000.sdmp String decryptor: Panda Security
Source: 0000000A.00000003.1297610885.0000000004C90000.00000004.00001000.00020000.00000000.sdmp String decryptor: Doctor Web
Source: 0000000A.00000003.1297610885.0000000004C90000.00000004.00001000.00020000.00000000.sdmp String decryptor: 360TotalSecurity
Source: 0000000A.00000003.1297610885.0000000004C90000.00000004.00001000.00020000.00000000.sdmp String decryptor: Bitdefender
Source: 0000000A.00000003.1297610885.0000000004C90000.00000004.00001000.00020000.00000000.sdmp String decryptor: Norton
Source: 0000000A.00000003.1297610885.0000000004C90000.00000004.00001000.00020000.00000000.sdmp String decryptor: Sophos
Source: 0000000A.00000003.1297610885.0000000004C90000.00000004.00001000.00020000.00000000.sdmp String decryptor: Comodo
Source: 0000000A.00000003.1297610885.0000000004C90000.00000004.00001000.00020000.00000000.sdmp String decryptor: WinDefender
Source: 0000000A.00000003.1297610885.0000000004C90000.00000004.00001000.00020000.00000000.sdmp String decryptor: 0123456789
Source: 0000000A.00000003.1297610885.0000000004C90000.00000004.00001000.00020000.00000000.sdmp String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 0000000A.00000003.1297610885.0000000004C90000.00000004.00001000.00020000.00000000.sdmp String decryptor: ------
Source: 0000000A.00000003.1297610885.0000000004C90000.00000004.00001000.00020000.00000000.sdmp String decryptor: ?scr=1
Source: 0000000A.00000003.1297610885.0000000004C90000.00000004.00001000.00020000.00000000.sdmp String decryptor: Content-Type: application/x-www-form-urlencoded
Source: 0000000A.00000003.1297610885.0000000004C90000.00000004.00001000.00020000.00000000.sdmp String decryptor: SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
Source: 0000000A.00000003.1297610885.0000000004C90000.00000004.00001000.00020000.00000000.sdmp String decryptor: ComputerName
Source: 0000000A.00000003.1297610885.0000000004C90000.00000004.00001000.00020000.00000000.sdmp String decryptor: abcdefghijklmnopqrstuvwxyz0123456789-_
Source: 0000000A.00000003.1297610885.0000000004C90000.00000004.00001000.00020000.00000000.sdmp String decryptor: -unicode-
Source: 0000000A.00000003.1297610885.0000000004C90000.00000004.00001000.00020000.00000000.sdmp String decryptor: SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
Source: 0000000A.00000003.1297610885.0000000004C90000.00000004.00001000.00020000.00000000.sdmp String decryptor: SYSTEM\ControlSet001\Services\BasicDisplay\Video
Source: 0000000A.00000003.1297610885.0000000004C90000.00000004.00001000.00020000.00000000.sdmp String decryptor: VideoID
Source: 0000000A.00000003.1297610885.0000000004C90000.00000004.00001000.00020000.00000000.sdmp String decryptor: DefaultSettings.XResolution
Source: 0000000A.00000003.1297610885.0000000004C90000.00000004.00001000.00020000.00000000.sdmp String decryptor: DefaultSettings.YResolution
Source: 0000000A.00000003.1297610885.0000000004C90000.00000004.00001000.00020000.00000000.sdmp String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 0000000A.00000003.1297610885.0000000004C90000.00000004.00001000.00020000.00000000.sdmp String decryptor: ProductName
Source: 0000000A.00000003.1297610885.0000000004C90000.00000004.00001000.00020000.00000000.sdmp String decryptor: CurrentBuild
Source: 0000000A.00000003.1297610885.0000000004C90000.00000004.00001000.00020000.00000000.sdmp String decryptor: rundll32.exe
Source: 0000000A.00000003.1297610885.0000000004C90000.00000004.00001000.00020000.00000000.sdmp String decryptor: "taskkill /f /im "
Source: 0000000A.00000003.1297610885.0000000004C90000.00000004.00001000.00020000.00000000.sdmp String decryptor: " && timeout 1 && del
Source: 0000000A.00000003.1297610885.0000000004C90000.00000004.00001000.00020000.00000000.sdmp String decryptor: && Exit"
Source: 0000000A.00000003.1297610885.0000000004C90000.00000004.00001000.00020000.00000000.sdmp String decryptor: " && ren
Source: 0000000A.00000003.1297610885.0000000004C90000.00000004.00001000.00020000.00000000.sdmp String decryptor: Powershell.exe
Source: 0000000A.00000003.1297610885.0000000004C90000.00000004.00001000.00020000.00000000.sdmp String decryptor: -executionpolicy remotesigned -File "
Source: 0000000A.00000003.1297610885.0000000004C90000.00000004.00001000.00020000.00000000.sdmp String decryptor: shutdown -s -t 0
Source: 0000000A.00000003.1297610885.0000000004C90000.00000004.00001000.00020000.00000000.sdmp String decryptor: random
Source: 0000000A.00000003.1297610885.0000000004C90000.00000004.00001000.00020000.00000000.sdmp String decryptor: Keyboard Layout\Preload
Source: 0000000A.00000003.1297610885.0000000004C90000.00000004.00001000.00020000.00000000.sdmp String decryptor: 00000419
Source: 0000000A.00000003.1297610885.0000000004C90000.00000004.00001000.00020000.00000000.sdmp String decryptor: 00000422
Source: 0000000A.00000003.1297610885.0000000004C90000.00000004.00001000.00020000.00000000.sdmp String decryptor: 00000423
Source: 0000000A.00000003.1297610885.0000000004C90000.00000004.00001000.00020000.00000000.sdmp String decryptor: 0000043f
Uses 32bit PE files
Source: 5yCKVE324w.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Networking
barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor IPs: 176.113.115.6
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 176.113.115.6 176.113.115.6
Source: Joe Sandbox View IP Address: 176.113.115.6 176.113.115.6
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: SELECTELRU SELECTELRU
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.9:49693 -> 176.113.115.6:80
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Code function: 10_2_00E52710 recv,recv,recv,recv, 10_2_00E52710
Source: rapes.exe, 0000000A.00000002.3348235431.00000000009EF000.00000004.00000020.00020000.00000000.sdmp, rapes.exe, 0000000A.00000002.3348235431.00000000009DB000.00000004.00000020.00020000.00000000.sdmp, rapes.exe, 0000000A.00000002.3348235431.0000000000A0A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://176.113.115.6/Ni9kiput/index.php
Source: rapes.exe, 0000000A.00000002.3348235431.00000000009EF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://176.113.115.6/Ni9kiput/index.php(5/
Source: rapes.exe, 0000000A.00000002.3348235431.00000000009DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://176.113.115.6/Ni9kiput/index.php.s
Source: rapes.exe, 0000000A.00000002.3348235431.0000000000A0A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://176.113.115.6/Ni9kiput/index.php;
Source: rapes.exe, 0000000A.00000002.3348235431.0000000000A0A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://176.113.115.6/Ni9kiput/index.phpV
Source: rapes.exe, 0000000A.00000002.3348235431.0000000000A0A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://176.113.115.6/Ni9kiput/index.phpb
Source: rapes.exe, 0000000A.00000002.3348235431.00000000009DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://176.113.115.6/Ni9kiput/index.phpfs
Source: rapes.exe, 0000000A.00000002.3348235431.000000000099B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://176.113.115.6/Ni9kiput/index.phpo
Source: rapes.exe, 0000000A.00000002.3348235431.0000000000A0A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://176.113.115.6/Ni9kiput/index.phpy

System Summary
barindex
PE file contains section with special chars
Source: 5yCKVE324w.exe Static PE information: section name:
Source: 5yCKVE324w.exe Static PE information: section name: .idata
Source: 5yCKVE324w.exe Static PE information: section name:
Source: rapes.exe.0.dr Static PE information: section name:
Source: rapes.exe.0.dr Static PE information: section name: .idata
Source: rapes.exe.0.dr Static PE information: section name:
Abnormal high CPU Usage
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Process Stats: CPU usage > 49%
Creates files inside the system directory
Source: C:\Users\user\Desktop\5yCKVE324w.exe File created: C:\Windows\Tasks\rapes.job Jump to behavior
Detected potential crypto function
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Code function: 10_2_00E461F0 10_2_00E461F0
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Code function: 10_2_00E4B700 10_2_00E4B700
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Code function: 10_2_00E6B4C0 10_2_00E6B4C0
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Code function: 10_2_00E85CD4 10_2_00E85CD4
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Code function: 10_2_00E84047 10_2_00E84047
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Code function: 10_2_00E72C20 10_2_00E72C20
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Code function: 10_2_00E85DF4 10_2_00E85DF4
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Code function: 10_2_00E451A0 10_2_00E451A0
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Code function: 10_2_00E44EF0 10_2_00E44EF0
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Code function: 10_2_00E7C6DD 10_2_00E7C6DD
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Code function: 10_2_00E6F6DB 10_2_00E6F6DB
Uses 32bit PE files
Source: 5yCKVE324w.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: 5yCKVE324w.exe Static PE information: Section: ZLIB complexity 0.9982836174242424
Source: 5yCKVE324w.exe Static PE information: Section: biftacpe ZLIB complexity 0.9946107439286812
Source: rapes.exe.0.dr Static PE information: Section: ZLIB complexity 0.9982836174242424
Source: rapes.exe.0.dr Static PE information: Section: biftacpe ZLIB complexity 0.9946107439286812
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@4/3@0/1
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Users\user\Desktop\5yCKVE324w.exe File created: C:\Users\user\AppData\Local\Temp\bb556cff4a Jump to behavior
Source: C:\Users\user\Desktop\5yCKVE324w.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\5yCKVE324w.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: 5yCKVE324w.exe ReversingLabs: Detection: 66%
Source: 5yCKVE324w.exe Virustotal: Detection: 57%
Source: 5yCKVE324w.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: 5yCKVE324w.exe String found in binary or memory: " /add /y
Source: 5yCKVE324w.exe String found in binary or memory: " /add
Source: rapes.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: rapes.exe String found in binary or memory: " /add
Source: rapes.exe String found in binary or memory: " /add /y
Source: rapes.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: rapes.exe String found in binary or memory: " /add
Source: rapes.exe String found in binary or memory: " /add /y
Source: C:\Users\user\Desktop\5yCKVE324w.exe File read: C:\Users\user\Desktop\5yCKVE324w.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\5yCKVE324w.exe "C:\Users\user\Desktop\5yCKVE324w.exe"
Source: C:\Users\user\Desktop\5yCKVE324w.exe Process created: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe "C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe
Source: C:\Users\user\Desktop\5yCKVE324w.exe Process created: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe "C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe" Jump to behavior
Source: C:\Users\user\Desktop\5yCKVE324w.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\5yCKVE324w.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\5yCKVE324w.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\5yCKVE324w.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\5yCKVE324w.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\5yCKVE324w.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\5yCKVE324w.exe Section loaded: mstask.dll Jump to behavior
Source: C:\Users\user\Desktop\5yCKVE324w.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\5yCKVE324w.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\5yCKVE324w.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\Desktop\5yCKVE324w.exe Section loaded: dui70.dll Jump to behavior
Source: C:\Users\user\Desktop\5yCKVE324w.exe Section loaded: duser.dll Jump to behavior
Source: C:\Users\user\Desktop\5yCKVE324w.exe Section loaded: chartv.dll Jump to behavior
Source: C:\Users\user\Desktop\5yCKVE324w.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\5yCKVE324w.exe Section loaded: oleacc.dll Jump to behavior
Source: C:\Users\user\Desktop\5yCKVE324w.exe Section loaded: atlthunk.dll Jump to behavior
Source: C:\Users\user\Desktop\5yCKVE324w.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\Desktop\5yCKVE324w.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\Desktop\5yCKVE324w.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\5yCKVE324w.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\5yCKVE324w.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\5yCKVE324w.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\5yCKVE324w.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\5yCKVE324w.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\5yCKVE324w.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\5yCKVE324w.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Users\user\Desktop\5yCKVE324w.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\5yCKVE324w.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\5yCKVE324w.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\5yCKVE324w.exe Section loaded: windows.fileexplorer.common.dll Jump to behavior
Source: C:\Users\user\Desktop\5yCKVE324w.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\5yCKVE324w.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\5yCKVE324w.exe Section loaded: explorerframe.dll Jump to behavior
Source: C:\Users\user\Desktop\5yCKVE324w.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\5yCKVE324w.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\5yCKVE324w.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\5yCKVE324w.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\5yCKVE324w.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\5yCKVE324w.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\5yCKVE324w.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\5yCKVE324w.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\5yCKVE324w.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\5yCKVE324w.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\5yCKVE324w.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32 Jump to behavior
Source: 5yCKVE324w.exe Static file information: File size 1868288 > 1048576
Source: 5yCKVE324w.exe Static PE information: Raw size of biftacpe is bigger than: 0x100000 < 0x196a00

Data Obfuscation
barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\user\Desktop\5yCKVE324w.exe Unpacked PE file: 0.2.5yCKVE324w.exe.950000.0.unpack :EW;.rsrc:W;.idata :W; :EW;biftacpe:EW;oskbuggh:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;biftacpe:EW;oskbuggh:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Unpacked PE file: 1.2.rapes.exe.e40000.0.unpack :EW;.rsrc:W;.idata :W; :EW;biftacpe:EW;oskbuggh:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;biftacpe:EW;oskbuggh:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Unpacked PE file: 10.2.rapes.exe.e40000.0.unpack :EW;.rsrc:W;.idata :W; :EW;biftacpe:EW;oskbuggh:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;biftacpe:EW;oskbuggh:EW;.taggant:EW;
Entry point lies outside standard sections
Source: initial sample Static PE information: section where entry point is pointing to: .taggant
PE file contains an invalid checksum
Source: rapes.exe.0.dr Static PE information: real checksum: 0x1c9334 should be: 0x1cf682
Source: 5yCKVE324w.exe Static PE information: real checksum: 0x1c9334 should be: 0x1cf682
PE file contains sections with non-standard names
Source: 5yCKVE324w.exe Static PE information: section name:
Source: 5yCKVE324w.exe Static PE information: section name: .idata
Source: 5yCKVE324w.exe Static PE information: section name:
Source: 5yCKVE324w.exe Static PE information: section name: biftacpe
Source: 5yCKVE324w.exe Static PE information: section name: oskbuggh
Source: 5yCKVE324w.exe Static PE information: section name: .taggant
Source: rapes.exe.0.dr Static PE information: section name:
Source: rapes.exe.0.dr Static PE information: section name: .idata
Source: rapes.exe.0.dr Static PE information: section name:
Source: rapes.exe.0.dr Static PE information: section name: biftacpe
Source: rapes.exe.0.dr Static PE information: section name: oskbuggh
Source: rapes.exe.0.dr Static PE information: section name: .taggant
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Code function: 10_2_00E69FD5 push ecx; ret 10_2_00E69FD4
Source: 5yCKVE324w.exe Static PE information: section name: entropy: 7.977773430413818
Source: 5yCKVE324w.exe Static PE information: section name: biftacpe entropy: 7.953464414586601
Source: rapes.exe.0.dr Static PE information: section name: entropy: 7.977773430413818
Source: rapes.exe.0.dr Static PE information: section name: biftacpe entropy: 7.953464414586601
Drops PE files
Source: C:\Users\user\Desktop\5yCKVE324w.exe File created: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Jump to dropped file

Boot Survival
barindex
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Source: C:\Users\user\Desktop\5yCKVE324w.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\5yCKVE324w.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\Desktop\5yCKVE324w.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\Desktop\5yCKVE324w.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\5yCKVE324w.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Window searched: window name: Filemonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Window searched: window name: Regmonclass Jump to behavior
Creates job files (autostart)
Source: C:\Users\user\Desktop\5yCKVE324w.exe File created: C:\Windows\Tasks\rapes.job Jump to behavior
Source: C:\Users\user\Desktop\5yCKVE324w.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Source: C:\Users\user\Desktop\5yCKVE324w.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\Desktop\5yCKVE324w.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 9C2BC2 second address: 9C2BC7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 9C2BC7 second address: 9C2BDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e je 00007F78ECFA4DD6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 9C2BDB second address: 9C2BF3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78ECF4A364h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B2C898 second address: B2C8A1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B2C8A1 second address: B2C8C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F78ECF4A362h 0x0000000d jmp 00007F78ECF4A35Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B2C8C8 second address: B2C8CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B2C8CE second address: B2C8D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B385ED second address: B385F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B385F1 second address: B385F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B385F7 second address: B3860B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78ECFA4DDAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c push eax 0x0000000d pop eax 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B38A29 second address: B38A64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jno 00007F78ECF4A35Eh 0x0000000b je 00007F78ECF4A35Ch 0x00000011 popad 0x00000012 pushad 0x00000013 jmp 00007F78ECF4A366h 0x00000018 push eax 0x00000019 push edx 0x0000001a push ecx 0x0000001b pop ecx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B3B846 second address: 9C2BC2 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 xor dword ptr [esp], 40DD8CB6h 0x0000000e mov dword ptr [ebp+122D1ED2h], edi 0x00000014 push dword ptr [ebp+122D1401h] 0x0000001a call 00007F78ECFA4DE4h 0x0000001f xor esi, dword ptr [ebp+122D2A2Fh] 0x00000025 pop edx 0x00000026 call dword ptr [ebp+122D1EA7h] 0x0000002c pushad 0x0000002d ja 00007F78ECFA4DD7h 0x00000033 xor eax, eax 0x00000035 jmp 00007F78ECFA4DDEh 0x0000003a mov edx, dword ptr [esp+28h] 0x0000003e pushad 0x0000003f jng 00007F78ECFA4DDCh 0x00000045 clc 0x00000046 popad 0x00000047 mov dword ptr [ebp+122D27DFh], eax 0x0000004d je 00007F78ECFA4DDCh 0x00000053 clc 0x00000054 mov esi, 0000003Ch 0x00000059 jmp 00007F78ECFA4DE6h 0x0000005e add esi, dword ptr [esp+24h] 0x00000062 jns 00007F78ECFA4DDCh 0x00000068 lodsw 0x0000006a cmc 0x0000006b add eax, dword ptr [esp+24h] 0x0000006f mov dword ptr [ebp+122D2B5Fh], edx 0x00000075 mov ebx, dword ptr [esp+24h] 0x00000079 jmp 00007F78ECFA4DDFh 0x0000007e jmp 00007F78ECFA4DDFh 0x00000083 nop 0x00000084 push eax 0x00000085 push edx 0x00000086 jmp 00007F78ECFA4DE9h 0x0000008b rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B3B896 second address: B3B8E8 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F78ECF4A358h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d mov dword ptr [ebp+122D215Ah], edi 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push edi 0x00000018 call 00007F78ECF4A358h 0x0000001d pop edi 0x0000001e mov dword ptr [esp+04h], edi 0x00000022 add dword ptr [esp+04h], 0000001Ch 0x0000002a inc edi 0x0000002b push edi 0x0000002c ret 0x0000002d pop edi 0x0000002e ret 0x0000002f jmp 00007F78ECF4A35Ch 0x00000034 push 745EC53Ah 0x00000039 push eax 0x0000003a push edx 0x0000003b push eax 0x0000003c push edx 0x0000003d push edx 0x0000003e pop edx 0x0000003f rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B3B8E8 second address: B3B8EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B3B8EC second address: B3B8F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B3B8F2 second address: B3B980 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jns 00007F78ECFA4DD6h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xor dword ptr [esp], 745EC5BAh 0x00000013 push 00000000h 0x00000015 push edx 0x00000016 call 00007F78ECFA4DD8h 0x0000001b pop edx 0x0000001c mov dword ptr [esp+04h], edx 0x00000020 add dword ptr [esp+04h], 0000001Bh 0x00000028 inc edx 0x00000029 push edx 0x0000002a ret 0x0000002b pop edx 0x0000002c ret 0x0000002d push 00000003h 0x0000002f and cx, 56FEh 0x00000034 push 00000000h 0x00000036 pushad 0x00000037 jmp 00007F78ECFA4DDCh 0x0000003c jmp 00007F78ECFA4DDEh 0x00000041 popad 0x00000042 push 00000003h 0x00000044 push 00000000h 0x00000046 push ebx 0x00000047 call 00007F78ECFA4DD8h 0x0000004c pop ebx 0x0000004d mov dword ptr [esp+04h], ebx 0x00000051 add dword ptr [esp+04h], 0000001Bh 0x00000059 inc ebx 0x0000005a push ebx 0x0000005b ret 0x0000005c pop ebx 0x0000005d ret 0x0000005e push D5A54DB1h 0x00000063 push esi 0x00000064 push eax 0x00000065 push edx 0x00000066 je 00007F78ECFA4DD6h 0x0000006c rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B3B980 second address: B3B9C8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78ECF4A35Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a xor dword ptr [esp], 15A54DB1h 0x00000011 pushad 0x00000012 mov dword ptr [ebp+122D25A5h], edi 0x00000018 and edx, 3B1BAC63h 0x0000001e popad 0x0000001f lea ebx, dword ptr [ebp+1244C778h] 0x00000025 and edx, dword ptr [ebp+122D1EDAh] 0x0000002b xchg eax, ebx 0x0000002c pushad 0x0000002d jl 00007F78ECF4A35Ch 0x00000033 js 00007F78ECF4A356h 0x00000039 push eax 0x0000003a push edx 0x0000003b je 00007F78ECF4A356h 0x00000041 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B3BAF4 second address: B3BAFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B3BAFD second address: B3BB01 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B3BB01 second address: B3BB63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 push esi 0x0000000a pushad 0x0000000b push edx 0x0000000c pop edx 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 pop esi 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 jne 00007F78ECFA4DE0h 0x0000001b pop eax 0x0000001c add edx, dword ptr [ebp+122D1C6Ch] 0x00000022 lea ebx, dword ptr [ebp+1244C781h] 0x00000028 push 00000000h 0x0000002a push eax 0x0000002b call 00007F78ECFA4DD8h 0x00000030 pop eax 0x00000031 mov dword ptr [esp+04h], eax 0x00000035 add dword ptr [esp+04h], 0000001Ch 0x0000003d inc eax 0x0000003e push eax 0x0000003f ret 0x00000040 pop eax 0x00000041 ret 0x00000042 or dword ptr [ebp+122D276Ah], eax 0x00000048 push eax 0x00000049 pushad 0x0000004a push eax 0x0000004b push edx 0x0000004c push edx 0x0000004d pop edx 0x0000004e rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B3BB63 second address: B3BB67 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B3BB67 second address: B3BB71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B3BBB8 second address: B3BBBE instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B3BBBE second address: B3BC3F instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F78ECFA4DD8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b cld 0x0000000c push 00000000h 0x0000000e xor cl, 0000002Eh 0x00000011 push 60F75F3Bh 0x00000016 ja 00007F78ECFA4DE4h 0x0000001c xor dword ptr [esp], 60F75FBBh 0x00000023 jmp 00007F78ECFA4DE3h 0x00000028 adc esi, 7394F694h 0x0000002e push 00000003h 0x00000030 call 00007F78ECFA4DDEh 0x00000035 pop ecx 0x00000036 push 00000000h 0x00000038 mov edx, edi 0x0000003a push 00000003h 0x0000003c sub dword ptr [ebp+122D1E9Eh], ecx 0x00000042 pushad 0x00000043 or dword ptr [ebp+122D215Ah], ecx 0x00000049 xor edx, 4BD83612h 0x0000004f popad 0x00000050 push B2487A8Ah 0x00000055 pushad 0x00000056 push eax 0x00000057 push edx 0x00000058 push eax 0x00000059 push edx 0x0000005a rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B3BC3F second address: B3BC43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B3BC43 second address: B3BC87 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a popad 0x0000000b xor dword ptr [esp], 72487A8Ah 0x00000012 mov dx, di 0x00000015 lea ebx, dword ptr [ebp+1244C78Ch] 0x0000001b mov dword ptr [ebp+122D1ED2h], edx 0x00000021 xchg eax, ebx 0x00000022 js 00007F78ECFA4DECh 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c push ebx 0x0000002d pop ebx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B4D542 second address: B4D553 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jo 00007F78ECF4A35Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B4D553 second address: B4D557 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B4D557 second address: B4D561 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F78ECF4A356h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B5B971 second address: B5B99B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78ECFA4DDFh 0x00000007 jp 00007F78ECFA4DD6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 js 00007F78ECFA4DD6h 0x00000016 ja 00007F78ECFA4DD6h 0x0000001c push eax 0x0000001d pop eax 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B59AAC second address: B59AC1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jo 00007F78ECF4A356h 0x00000009 jns 00007F78ECF4A356h 0x0000000f pop eax 0x00000010 push esi 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B59BC3 second address: B59BD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B59D0D second address: B59D11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B59EC2 second address: B59EC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B59EC8 second address: B59ECE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B59ECE second address: B59EFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 pushad 0x00000007 jns 00007F78ECFA4DDEh 0x0000000d pushad 0x0000000e popad 0x0000000f jno 00007F78ECFA4DD6h 0x00000015 push esi 0x00000016 jmp 00007F78ECFA4DE5h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B59EFB second address: B59F1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007F78ECF4A369h 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B5A352 second address: B5A357 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B5A5BC second address: B5A5C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B5A5C0 second address: B5A5CA instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F78ECFA4DD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B5A5CA second address: B5A5D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B5A5D0 second address: B5A5D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B5A5D4 second address: B5A5EE instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F78ECF4A356h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c ja 00007F78ECF4A372h 0x00000012 jl 00007F78ECF4A362h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B5A761 second address: B5A765 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B5A765 second address: B5A786 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jp 00007F78ECF4A356h 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f jmp 00007F78ECF4A35Bh 0x00000014 jnc 00007F78ECF4A356h 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B5AA12 second address: B5AA17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B5AA17 second address: B5AA44 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F78ECF4A358h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jc 00007F78ECF4A37Eh 0x00000012 jmp 00007F78ECF4A368h 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B5B44B second address: B5B4A4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78ECFA4DE4h 0x00000007 jmp 00007F78ECFA4DE3h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push edx 0x0000000f jmp 00007F78ECFA4DE3h 0x00000014 jmp 00007F78ECFA4DE9h 0x00000019 pop edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B5B806 second address: B5B80D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B5F343 second address: B5F349 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B5F349 second address: B5F384 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78ECF4A366h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jnp 00007F78ECF4A375h 0x00000010 pushad 0x00000011 jmp 00007F78ECF4A367h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B5F384 second address: B5F3D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov eax, dword ptr [esp+04h] 0x00000009 pushad 0x0000000a jmp 00007F78ECFA4DDFh 0x0000000f push edx 0x00000010 jmp 00007F78ECFA4DE5h 0x00000015 pop edx 0x00000016 popad 0x00000017 mov eax, dword ptr [eax] 0x00000019 jmp 00007F78ECFA4DDCh 0x0000001e mov dword ptr [esp+04h], eax 0x00000022 push ecx 0x00000023 push eax 0x00000024 push edx 0x00000025 jnp 00007F78ECFA4DD6h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B6941D second address: B69422 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B69422 second address: B6942A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B688FD second address: B68916 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F78ECF4A362h 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B68A88 second address: B68A8E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B68A8E second address: B68A98 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F78ECF4A35Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B68FE4 second address: B68FEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B69130 second address: B6913D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F78ECF4A356h 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B69E2E second address: B69E34 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B6A044 second address: B6A04F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push esi 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B6A8F8 second address: B6A8FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B6A8FE second address: B6A902 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B6AB9E second address: B6ABA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B6ABA2 second address: B6ABAF instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B6ABAF second address: B6ABB3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B6ABB3 second address: B6ABB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B6ACC6 second address: B6ACCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B6ACCA second address: B6ACE7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a mov dword ptr [ebp+122D215Ah], ebx 0x00000010 mov esi, dword ptr [ebp+122D29A3h] 0x00000016 xchg eax, ebx 0x00000017 pushad 0x00000018 pushad 0x00000019 pushad 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B6BA8E second address: B6BA99 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jl 00007F78ECFA4DD6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B6EC08 second address: B6EC10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B6DE50 second address: B6DE54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B6DE54 second address: B6DE5E instructions: 0x00000000 rdtsc 0x00000002 jns 00007F78ECF4A356h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B70197 second address: B7019C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B7019C second address: B701A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B73EA5 second address: B73EAB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B73EAB second address: B73ED5 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F78ECF4A35Ch 0x00000008 jp 00007F78ECF4A356h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jp 00007F78ECF4A367h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B74584 second address: B745A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F78ECFA4DE9h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B757A5 second address: B757B9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78ECF4A360h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B766B3 second address: B766B8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B7740E second address: B77413 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B766B8 second address: B766BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B775E6 second address: B775EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B775EA second address: B775F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B78582 second address: B78586 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B775F4 second address: B775F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B794C5 second address: B794E6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78ECF4A367h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B794E6 second address: B794F3 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F78ECFA4DD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B7769A second address: B7769E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B7A384 second address: B7A38D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B7A38D second address: B7A3CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push ecx 0x0000000a call 00007F78ECF4A358h 0x0000000f pop ecx 0x00000010 mov dword ptr [esp+04h], ecx 0x00000014 add dword ptr [esp+04h], 00000016h 0x0000001c inc ecx 0x0000001d push ecx 0x0000001e ret 0x0000001f pop ecx 0x00000020 ret 0x00000021 mov dword ptr [ebp+12456A37h], ebx 0x00000027 mov ebx, 38DCD5CCh 0x0000002c push 00000000h 0x0000002e mov bl, DAh 0x00000030 push 00000000h 0x00000032 mov ebx, 6C16BCB5h 0x00000037 push eax 0x00000038 push ebx 0x00000039 push eax 0x0000003a push edx 0x0000003b pushad 0x0000003c popad 0x0000003d rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B7B2A7 second address: B7B2EE instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b mov ebx, 00DBC541h 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push ecx 0x00000015 call 00007F78ECFA4DD8h 0x0000001a pop ecx 0x0000001b mov dword ptr [esp+04h], ecx 0x0000001f add dword ptr [esp+04h], 00000016h 0x00000027 inc ecx 0x00000028 push ecx 0x00000029 ret 0x0000002a pop ecx 0x0000002b ret 0x0000002c sub edi, 387C0D00h 0x00000032 push 00000000h 0x00000034 cld 0x00000035 push eax 0x00000036 pushad 0x00000037 push eax 0x00000038 push edx 0x00000039 jmp 00007F78ECFA4DDAh 0x0000003e rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B7F2A2 second address: B7F2B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F78ECF4A35Bh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B7F2B5 second address: B7F2BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push edx 0x00000007 pop edx 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B7F2BE second address: B7F2DD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78ECF4A367h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B7F2DD second address: B7F2FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F78ECFA4DE3h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B7F2FA second address: B7F310 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F78ECF4A35Dh 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B7D4CB second address: B7D4CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B7C493 second address: B7C499 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B7F905 second address: B7F963 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 nop 0x00000007 movsx ebx, cx 0x0000000a mov bl, EEh 0x0000000c push 00000000h 0x0000000e or dword ptr [ebp+12458A9Bh], edx 0x00000014 push edi 0x00000015 pop edi 0x00000016 push 00000000h 0x00000018 push 00000000h 0x0000001a push ecx 0x0000001b call 00007F78ECFA4DD8h 0x00000020 pop ecx 0x00000021 mov dword ptr [esp+04h], ecx 0x00000025 add dword ptr [esp+04h], 00000014h 0x0000002d inc ecx 0x0000002e push ecx 0x0000002f ret 0x00000030 pop ecx 0x00000031 ret 0x00000032 pushad 0x00000033 and ebx, dword ptr [ebp+122D27DBh] 0x00000039 adc bx, 09F2h 0x0000003e popad 0x0000003f mov edi, 66090010h 0x00000044 push eax 0x00000045 push eax 0x00000046 push edx 0x00000047 jng 00007F78ECFA4DE5h 0x0000004d jmp 00007F78ECFA4DDFh 0x00000052 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B849A1 second address: B849A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B86AF2 second address: B86AFE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jbe 00007F78ECFA4DD6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B86AFE second address: B86B08 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F78ECF4A356h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B84BB3 second address: B84BB7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B84BB7 second address: B84BC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B84BC1 second address: B84BCE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B84BCE second address: B84BD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B84BD2 second address: B84BE7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78ECFA4DDDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B84BE7 second address: B84BEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B8B7D8 second address: B8B7DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B8B7DC second address: B8B7E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B8E326 second address: B8E344 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F78ECFA4DE3h 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B94627 second address: B9462D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B9462D second address: B94631 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B94631 second address: B9466E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F78ECF4A366h 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 push eax 0x00000013 push edx 0x00000014 jnl 00007F78ECF4A368h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B9466E second address: B94687 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78ECFA4DDAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jnc 00007F78ECFA4DD6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B94687 second address: B94695 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jng 00007F78ECF4A356h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B94695 second address: 9C2BC2 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F78ECFA4DD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f pushad 0x00000010 jmp 00007F78ECFA4DE3h 0x00000015 jmp 00007F78ECFA4DE3h 0x0000001a popad 0x0000001b pop eax 0x0000001c pushad 0x0000001d mov esi, edx 0x0000001f ja 00007F78ECFA4DDBh 0x00000025 or dx, 9EF1h 0x0000002a popad 0x0000002b push dword ptr [ebp+122D1401h] 0x00000031 jg 00007F78ECFA4DE2h 0x00000037 js 00007F78ECFA4DDCh 0x0000003d call dword ptr [ebp+122D1EA7h] 0x00000043 pushad 0x00000044 ja 00007F78ECFA4DD7h 0x0000004a xor eax, eax 0x0000004c jmp 00007F78ECFA4DDEh 0x00000051 mov edx, dword ptr [esp+28h] 0x00000055 pushad 0x00000056 jng 00007F78ECFA4DDCh 0x0000005c clc 0x0000005d popad 0x0000005e mov dword ptr [ebp+122D27DFh], eax 0x00000064 je 00007F78ECFA4DDCh 0x0000006a clc 0x0000006b mov esi, 0000003Ch 0x00000070 jmp 00007F78ECFA4DE6h 0x00000075 add esi, dword ptr [esp+24h] 0x00000079 jns 00007F78ECFA4DDCh 0x0000007f lodsw 0x00000081 cmc 0x00000082 add eax, dword ptr [esp+24h] 0x00000086 mov dword ptr [ebp+122D2B5Fh], edx 0x0000008c mov ebx, dword ptr [esp+24h] 0x00000090 jmp 00007F78ECFA4DDFh 0x00000095 jmp 00007F78ECFA4DDFh 0x0000009a nop 0x0000009b push eax 0x0000009c push edx 0x0000009d jmp 00007F78ECFA4DE9h 0x000000a2 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B9AE8F second address: B9AE93 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B9AE93 second address: B9AEB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F78ECFA4DE0h 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B9AEB1 second address: B9AED7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F78ECF4A360h 0x00000010 jmp 00007F78ECF4A35Bh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B9AED7 second address: B9AEE3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F78ECFA4DD6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B9AEE3 second address: B9AEE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B9A500 second address: B9A515 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F78ECFA4DD6h 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f je 00007F78ECFA4DD6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B9A515 second address: B9A51B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B9ABD4 second address: B9ABD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BA04F9 second address: BA0500 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BA0500 second address: BA054C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78ECFA4DDBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F78ECFA4DE6h 0x00000013 popad 0x00000014 pushad 0x00000015 jmp 00007F78ECFA4DE9h 0x0000001a push ebx 0x0000001b pop ebx 0x0000001c pushad 0x0000001d popad 0x0000001e push edi 0x0000001f pop edi 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BA054C second address: BA0562 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78ECF4A35Ch 0x00000007 jp 00007F78ECF4A362h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BA0562 second address: BA0568 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B9F370 second address: B9F376 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B9F376 second address: B9F397 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F78ECFA4DE3h 0x0000000c push esi 0x0000000d pop esi 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B9F397 second address: B9F39D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B9F8AD second address: B9F8C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F78ECFA4DDBh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B9FCFA second address: B9FD0A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a jp 00007F78ECF4A356h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B9FE5B second address: B9FE72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F78ECFA4DE3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BA0240 second address: BA024A instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F78ECF4A356h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B2FDF4 second address: B2FDF8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B2FDF8 second address: B2FE0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 ja 00007F78ECF4A356h 0x0000000d pop edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BAA6F9 second address: BAA6FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BAA6FF second address: BAA70F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F78ECF4A35Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B713BB second address: B713BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B715F0 second address: B715FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push ebx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B715FA second address: B71600 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B71A46 second address: B71A59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F78ECF4A35Eh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B71A59 second address: B71A5F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B71A5F second address: B71AA1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78ECF4A35Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xor dword ptr [esp], 78339D27h 0x00000012 push 00000000h 0x00000014 push edi 0x00000015 call 00007F78ECF4A358h 0x0000001a pop edi 0x0000001b mov dword ptr [esp+04h], edi 0x0000001f add dword ptr [esp+04h], 00000016h 0x00000027 inc edi 0x00000028 push edi 0x00000029 ret 0x0000002a pop edi 0x0000002b ret 0x0000002c add dh, FFFFFFF7h 0x0000002f push AB36D25Bh 0x00000034 pushad 0x00000035 push eax 0x00000036 push edx 0x00000037 push eax 0x00000038 push edx 0x00000039 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B71AA1 second address: B71AA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B71D3C second address: B71D42 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B71D42 second address: B71D46 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B72305 second address: B72309 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B72309 second address: B7230F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B7230F second address: B72336 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 js 00007F78ECF4A356h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e pushad 0x0000000f push eax 0x00000010 pop eax 0x00000011 jmp 00007F78ECF4A360h 0x00000016 popad 0x00000017 pushad 0x00000018 pushad 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B72458 second address: B7245E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B7245E second address: B72462 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B7260C second address: B72633 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F78ECFA4DE2h 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c jl 00007F78ECFA4DE8h 0x00000012 push eax 0x00000013 push edx 0x00000014 jnc 00007F78ECFA4DD6h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B726F4 second address: B726F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B726F8 second address: B726FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B726FE second address: B7274F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78ECF4A369h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push ebp 0x0000000f call 00007F78ECF4A358h 0x00000014 pop ebp 0x00000015 mov dword ptr [esp+04h], ebp 0x00000019 add dword ptr [esp+04h], 00000014h 0x00000021 inc ebp 0x00000022 push ebp 0x00000023 ret 0x00000024 pop ebp 0x00000025 ret 0x00000026 mov ecx, dword ptr [ebp+122D2A53h] 0x0000002c sbb cl, 00000000h 0x0000002f lea eax, dword ptr [ebp+124820F8h] 0x00000035 cld 0x00000036 push eax 0x00000037 push ebx 0x00000038 pushad 0x00000039 push eax 0x0000003a push edx 0x0000003b rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B7274F second address: B727CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 pop ebx 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push ebp 0x0000000e call 00007F78ECFA4DD8h 0x00000013 pop ebp 0x00000014 mov dword ptr [esp+04h], ebp 0x00000018 add dword ptr [esp+04h], 0000001Ch 0x00000020 inc ebp 0x00000021 push ebp 0x00000022 ret 0x00000023 pop ebp 0x00000024 ret 0x00000025 sub di, 787Bh 0x0000002a mov dx, 2A3Ch 0x0000002e jmp 00007F78ECFA4DE2h 0x00000033 lea eax, dword ptr [ebp+124820B4h] 0x00000039 push 00000000h 0x0000003b push esi 0x0000003c call 00007F78ECFA4DD8h 0x00000041 pop esi 0x00000042 mov dword ptr [esp+04h], esi 0x00000046 add dword ptr [esp+04h], 00000017h 0x0000004e inc esi 0x0000004f push esi 0x00000050 ret 0x00000051 pop esi 0x00000052 ret 0x00000053 sub dword ptr [ebp+1245E299h], ebx 0x00000059 pushad 0x0000005a movsx ecx, dx 0x0000005d popad 0x0000005e nop 0x0000005f push eax 0x00000060 push ecx 0x00000061 push eax 0x00000062 push edx 0x00000063 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B727CE second address: B727DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B727DD second address: B534BE instructions: 0x00000000 rdtsc 0x00000002 je 00007F78ECFA4DDCh 0x00000008 jc 00007F78ECFA4DD6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 nop 0x00000011 xor dword ptr [ebp+122D2749h], ecx 0x00000017 call dword ptr [ebp+122D1C30h] 0x0000001d jng 00007F78ECFA4DF9h 0x00000023 js 00007F78ECFA4DDEh 0x00000029 jne 00007F78ECFA4DD6h 0x0000002f pushad 0x00000030 popad 0x00000031 jmp 00007F78ECFA4DE5h 0x00000036 push ebx 0x00000037 push eax 0x00000038 push edx 0x00000039 pushad 0x0000003a popad 0x0000003b pushad 0x0000003c popad 0x0000003d rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BAAA24 second address: BAAA40 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78ECF4A368h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BAAE9E second address: BAAEA2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BAB047 second address: BAB053 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F78ECF4A356h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BAB1F6 second address: BAB206 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78ECFA4DDAh 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BAB206 second address: BAB20A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BAB4DF second address: BAB51E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 jmp 00007F78ECFA4DDCh 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d push esi 0x0000000e jmp 00007F78ECFA4DE3h 0x00000013 jng 00007F78ECFA4DD6h 0x00000019 pop esi 0x0000001a pop edx 0x0000001b pop eax 0x0000001c jnp 00007F78ECFA4DECh 0x00000022 jg 00007F78ECFA4DDCh 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BB215B second address: BB2163 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BB2163 second address: BB2167 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BB2167 second address: BB2182 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78ECF4A367h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BB0F03 second address: BB0F08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BB17DA second address: BB17E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BB17E0 second address: BB17E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BB17E7 second address: BB17F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F78ECF4A35Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BB17F5 second address: BB1814 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78ECFA4DDBh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007F78ECFA4DDBh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BB499D second address: BB49A6 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BB49A6 second address: BB49AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BB4589 second address: BB4591 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BB74D7 second address: BB74F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F78ECFA4DE5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BB74F0 second address: BB7505 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F78ECF4A35Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BB7505 second address: BB7510 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push esi 0x00000007 pop esi 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BB7510 second address: BB7546 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78ECF4A367h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F78ECF4A360h 0x0000000e jmp 00007F78ECF4A35Bh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BBB5D4 second address: BBB5E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F78ECFA4DE0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BBB5E8 second address: BBB60F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007F78ECF4A356h 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d jng 00007F78ECF4A356h 0x00000013 popad 0x00000014 push ebx 0x00000015 jmp 00007F78ECF4A360h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BBB60F second address: BBB620 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e push esi 0x0000000f pop esi 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BBAEE4 second address: BBAEFB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007F78ECF4A361h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BBAEFB second address: BBAF12 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F78ECFA4DE1h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BBAF12 second address: BBAF28 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jp 00007F78ECF4A35Ah 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BBB30E second address: BBB313 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BBB313 second address: BBB31B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BBB31B second address: BBB321 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BBE896 second address: BBE8A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F78ECF4A356h 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BBE8A5 second address: BBE8A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BBE8A9 second address: BBE8AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BBED1F second address: BBED4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F78ECFA4DD6h 0x0000000a popad 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 jp 00007F78ECFA4DEAh 0x0000001a jmp 00007F78ECFA4DE4h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BBED4D second address: BBED56 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BC5CE9 second address: BC5CED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BC4501 second address: BC4507 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BC4507 second address: BC451A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 jmp 00007F78ECFA4DDBh 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BC468A second address: BC468E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BC47B1 second address: BC47CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F78ECFA4DE8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BC47CD second address: BC47D3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BC47D3 second address: BC47E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jnp 00007F78ECFA4DD6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BC47E3 second address: BC47E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BC47E7 second address: BC47F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 js 00007F78ECFA4DD8h 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BC47F8 second address: BC47FD instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BC493F second address: BC4977 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jmp 00007F78ECFA4DE7h 0x0000000a pushad 0x0000000b popad 0x0000000c push edi 0x0000000d pop edi 0x0000000e popad 0x0000000f push eax 0x00000010 jo 00007F78ECFA4DD6h 0x00000016 jno 00007F78ECFA4DD6h 0x0000001c pop eax 0x0000001d pushad 0x0000001e jno 00007F78ECFA4DD6h 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BC4ADC second address: BC4AE0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BC4AE0 second address: BC4AE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BC4C6F second address: BC4C77 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BC4C77 second address: BC4C7B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BC4E00 second address: BC4E11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F78ECF4A35Ah 0x0000000c rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BC4E11 second address: BC4E33 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78ECFA4DDEh 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007F78ECFA4DDAh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BC5A33 second address: BC5A38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BCC494 second address: BCC4A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop eax 0x00000006 pushad 0x00000007 jns 00007F78ECFA4DD6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BCC4A3 second address: BCC4A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BCC4A9 second address: BCC4BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a js 00007F78ECFA4DD6h 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BCCF2D second address: BCCF33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BCCF33 second address: BCCF51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F78ECFA4DDBh 0x00000009 popad 0x0000000a jmp 00007F78ECFA4DDEh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BCCF51 second address: BCCF63 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F78ECF4A35Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BCD515 second address: BCD519 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BD5099 second address: BD50B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78ECF4A35Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a ja 00007F78ECF4A35Ah 0x00000010 push eax 0x00000011 pop eax 0x00000012 pushad 0x00000013 popad 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BD8F8A second address: BD8F90 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BD8F90 second address: BD8F9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F78ECF4A356h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BD8231 second address: BD8236 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BD8236 second address: BD8242 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F78ECF4A356h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BD8242 second address: BD8270 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F78ECFA4DE9h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ecx 0x0000000d push esi 0x0000000e jmp 00007F78ECFA4DDAh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BD8531 second address: BD8536 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BD86CE second address: BD86F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jns 00007F78ECFA4DECh 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BD8855 second address: BD885B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BD885B second address: BD885F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BD885F second address: BD8865 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BD8B09 second address: BD8B0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BD8B0F second address: BD8B28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F78ECF4A362h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BD8B28 second address: BD8B4C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F78ECFA4DE0h 0x0000000b push eax 0x0000000c push edx 0x0000000d jnp 00007F78ECFA4DD6h 0x00000013 ja 00007F78ECFA4DD6h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BD8CBD second address: BD8CC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BDEC58 second address: BDEC8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F78ECFA4DD6h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d pop esi 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F78ECFA4DE8h 0x00000015 jmp 00007F78ECFA4DDEh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BDEC8E second address: BDECC4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F78ECF4A365h 0x00000008 js 00007F78ECF4A356h 0x0000000e jmp 00007F78ECF4A363h 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 push edx 0x00000017 pop edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BDEFC0 second address: BDEFC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BDEFC6 second address: BDEFCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BDF67E second address: BDF682 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BE0066 second address: BE0077 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 jp 00007F78ECF4A356h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BE0077 second address: BE007B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BE0756 second address: BE0775 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jng 00007F78ECF4A356h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F78ECF4A363h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BE7AA3 second address: BE7AB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 js 00007F78ECFA4DE2h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BE7BD8 second address: BE7BDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BE7BDE second address: BE7C12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jp 00007F78ECFA4DE9h 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F78ECFA4DE4h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BE7C12 second address: BE7C40 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F78ECF4A356h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b pushad 0x0000000c pushad 0x0000000d jng 00007F78ECF4A356h 0x00000013 jmp 00007F78ECF4A367h 0x00000018 popad 0x00000019 push edi 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BF72AE second address: BF72CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F78ECFA4DE9h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: BF7441 second address: BF7449 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B27991 second address: B27997 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B27997 second address: B279A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B279A3 second address: B279B5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78ECFA4DDAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B279B5 second address: B279B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B279B9 second address: B279D3 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F78ECFA4DD6h 0x00000008 jmp 00007F78ECFA4DE0h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B279D3 second address: B279D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B279D9 second address: B279EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F78ECFA4DDFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: B279EC second address: B279F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: C075F4 second address: C075FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: C075FA second address: C0762F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F78ECF4A367h 0x00000010 jmp 00007F78ECF4A361h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: C0762F second address: C07648 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 pushad 0x00000007 pushad 0x00000008 jp 00007F78ECFA4DD6h 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 je 00007F78ECFA4DE7h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: C0B0A6 second address: C0B0AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: C0B0AC second address: C0B0B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: C0B0B0 second address: C0B0C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jbe 00007F78ECF4A37Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 jnp 00007F78ECF4A356h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: C0B0C8 second address: C0B0CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: C0B0CC second address: C0B0DE instructions: 0x00000000 rdtsc 0x00000002 ja 00007F78ECF4A356h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jc 00007F78ECF4A35Eh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: C11471 second address: C11475 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: C11475 second address: C11479 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: C11479 second address: C11491 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pushad 0x0000000a popad 0x0000000b pop esi 0x0000000c popad 0x0000000d js 00007F78ECFA4DE4h 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: C115FF second address: C11608 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: C11608 second address: C1160E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: C1176D second address: C1178B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F78ECF4A369h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: C118D9 second address: C118F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnp 00007F78ECFA4DD6h 0x0000000e jmp 00007F78ECFA4DDAh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: C118F1 second address: C118F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: C1647E second address: C16482 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: C16482 second address: C16486 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: C160C9 second address: C160D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F78ECFA4DD6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: C20B74 second address: C20B82 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F78ECF4A356h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: C24BC5 second address: C24BF7 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jno 00007F78ECFA4DD6h 0x00000009 pop ebx 0x0000000a ja 00007F78ECFA4DDCh 0x00000010 ja 00007F78ECFA4DD6h 0x00000016 pop edx 0x00000017 pop eax 0x00000018 push eax 0x00000019 push edx 0x0000001a jc 00007F78ECFA4DE5h 0x00000020 jmp 00007F78ECFA4DDDh 0x00000025 push edi 0x00000026 pop edi 0x00000027 push edi 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: C24BF7 second address: C24C0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F78ECF4A361h 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: C4D2F5 second address: C4D2FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: C4D2FC second address: C4D308 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F78ECF4A356h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: C4D308 second address: C4D30C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: C4C148 second address: C4C14D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: C4C14D second address: C4C153 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: C4C5A8 second address: C4C5AD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: C4C5AD second address: C4C5B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: C4C99D second address: C4C9B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F78ECF4A35Dh 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: C4C9B7 second address: C4C9BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: C4C9BD second address: C4C9C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: C4C9C3 second address: C4C9C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: C4CE1D second address: C4CE42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 jg 00007F78ECF4A356h 0x0000000c jnc 00007F78ECF4A356h 0x00000012 pop edi 0x00000013 pop ecx 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F78ECF4A35Fh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: C4CE42 second address: C4CE47 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: C4CE47 second address: C4CE4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: C4CFA7 second address: C4CFAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: C4CFAD second address: C4CFB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: C4CFB5 second address: C4CFB9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: C4CFB9 second address: C4CFDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F78ECF4A369h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: C515B2 second address: C515DF instructions: 0x00000000 rdtsc 0x00000002 jp 00007F78ECFA4DD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b mov dword ptr [esp], eax 0x0000000e mov edx, dword ptr [ebp+125152BDh] 0x00000014 push 00000004h 0x00000016 mov dword ptr [ebp+1245DA03h], edi 0x0000001c call 00007F78ECFA4DD9h 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 push eax 0x00000025 pop eax 0x00000026 push eax 0x00000027 pop eax 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: C515DF second address: C515E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: C515E5 second address: C515E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: C515E9 second address: C51605 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F78ECF4A361h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: C51605 second address: C5164A instructions: 0x00000000 rdtsc 0x00000002 ja 00007F78ECFA4DDCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e je 00007F78ECFA4DE0h 0x00000014 pushad 0x00000015 jns 00007F78ECFA4DD6h 0x0000001b pushad 0x0000001c popad 0x0000001d popad 0x0000001e mov eax, dword ptr [eax] 0x00000020 jg 00007F78ECFA4DE2h 0x00000026 mov dword ptr [esp+04h], eax 0x0000002a push eax 0x0000002b push eax 0x0000002c push edx 0x0000002d jne 00007F78ECFA4DD6h 0x00000033 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: C52B1C second address: C52B21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: C52B21 second address: C52B2C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007F78ECFA4DD6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 53406F9 second address: 53406FF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 53406FF second address: 534075D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, B70Bh 0x00000007 call 00007F78ECFA4DE0h 0x0000000c pop esi 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push esi 0x00000011 jmp 00007F78ECFA4DDEh 0x00000016 mov dword ptr [esp], ebp 0x00000019 jmp 00007F78ECFA4DE0h 0x0000001e mov ebp, esp 0x00000020 jmp 00007F78ECFA4DE0h 0x00000025 pop ebp 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007F78ECFA4DDAh 0x0000002f rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 534075D second address: 5340761 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 5340761 second address: 5340767 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 530094E second address: 530096B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78ECF4A362h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 530096B second address: 5300971 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 5300971 second address: 5300991 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 call 00007F78ECF4A360h 0x0000000a pop esi 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 5300991 second address: 5300997 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 5300997 second address: 53009CD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F78ECF4A362h 0x00000009 and eax, 4648E7B8h 0x0000000f jmp 00007F78ECF4A35Bh 0x00000014 popfd 0x00000015 mov cx, B3EFh 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c xchg eax, ebp 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 53009CD second address: 53009D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 53009D1 second address: 53009D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 53009D7 second address: 53009E1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, 4DF5A1FBh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 53009E1 second address: 53009F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov ebp, esp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push edx 0x0000000f pop ecx 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 53009F2 second address: 5300A20 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78ECFA4DE0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F78ECFA4DE7h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 52C0C3E second address: 52C0C71 instructions: 0x00000000 rdtsc 0x00000002 mov ecx, 0007E565h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F78ECF4A361h 0x0000000f pop esi 0x00000010 popad 0x00000011 push esi 0x00000012 jmp 00007F78ECF4A35Ch 0x00000017 mov dword ptr [esp], ebp 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 52C0C71 second address: 52C0C77 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 52C0C77 second address: 52C0C99 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78ECF4A364h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push ebx 0x0000000f pop eax 0x00000010 mov ecx, edi 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 52C0C99 second address: 52C0C9F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 52C0C9F second address: 52C0CBA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78ECF4A35Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push dword ptr [ebp+04h] 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 52C0CBA second address: 52C0CC0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 530072D second address: 5300733 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 5300733 second address: 5300737 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 5300737 second address: 53007CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a mov ebx, esi 0x0000000c mov edx, eax 0x0000000e popad 0x0000000f push eax 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007F78ECF4A363h 0x00000017 and cx, 861Eh 0x0000001c jmp 00007F78ECF4A369h 0x00000021 popfd 0x00000022 mov ax, D3E7h 0x00000026 popad 0x00000027 xchg eax, ebp 0x00000028 pushad 0x00000029 pushad 0x0000002a pushfd 0x0000002b jmp 00007F78ECF4A366h 0x00000030 sub ecx, 34001B48h 0x00000036 jmp 00007F78ECF4A35Bh 0x0000003b popfd 0x0000003c mov ch, B2h 0x0000003e popad 0x0000003f mov dl, E6h 0x00000041 popad 0x00000042 mov ebp, esp 0x00000044 jmp 00007F78ECF4A35Ch 0x00000049 pop ebp 0x0000004a push eax 0x0000004b push edx 0x0000004c push eax 0x0000004d push edx 0x0000004e jmp 00007F78ECF4A35Ah 0x00000053 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 53007CF second address: 53007D5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 52F09FD second address: 52F0A01 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 52F0A01 second address: 52F0A11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 52F0A11 second address: 52F0A15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 52F0A15 second address: 52F0A25 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78ECFA4DDCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 52F0A25 second address: 52F0A70 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 call 00007F78ECF4A367h 0x0000000a pop eax 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov ebp, esp 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 mov bl, cl 0x00000015 pushfd 0x00000016 jmp 00007F78ECF4A35Dh 0x0000001b xor ah, 00000016h 0x0000001e jmp 00007F78ECF4A361h 0x00000023 popfd 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 5350094 second address: 5350099 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 5350099 second address: 5350107 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov bx, AFC0h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d pushad 0x0000000e jmp 00007F78ECF4A35Bh 0x00000013 mov cx, 398Fh 0x00000017 popad 0x00000018 mov ax, DFABh 0x0000001c popad 0x0000001d mov ebp, esp 0x0000001f pushad 0x00000020 pushfd 0x00000021 jmp 00007F78ECF4A35Ch 0x00000026 and ecx, 510F8138h 0x0000002c jmp 00007F78ECF4A35Bh 0x00000031 popfd 0x00000032 push ecx 0x00000033 pop esi 0x00000034 popad 0x00000035 pop ebp 0x00000036 push eax 0x00000037 push edx 0x00000038 pushad 0x00000039 pushfd 0x0000003a jmp 00007F78ECF4A35Ah 0x0000003f sub esi, 1323FB98h 0x00000045 jmp 00007F78ECF4A35Bh 0x0000004a popfd 0x0000004b mov cx, 8D4Fh 0x0000004f popad 0x00000050 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 5340E17 second address: 5340E6F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78ECFA4DE0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F78ECFA4DDEh 0x00000011 adc ecx, 5C48FE48h 0x00000017 jmp 00007F78ECFA4DDBh 0x0000001c popfd 0x0000001d mov cx, 11BFh 0x00000021 popad 0x00000022 push eax 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007F78ECFA4DE7h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 5340E6F second address: 5340E8C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78ECF4A369h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 535044B second address: 53504D1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78ECFA4DE9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b push esi 0x0000000c push edx 0x0000000d pop eax 0x0000000e pop edx 0x0000000f mov dh, ch 0x00000011 popad 0x00000012 push eax 0x00000013 pushad 0x00000014 mov cx, 9A33h 0x00000018 mov esi, 6542A68Fh 0x0000001d popad 0x0000001e xchg eax, ebp 0x0000001f jmp 00007F78ECFA4DE2h 0x00000024 mov ebp, esp 0x00000026 jmp 00007F78ECFA4DE0h 0x0000002b mov eax, dword ptr [ebp+08h] 0x0000002e pushad 0x0000002f mov di, si 0x00000032 jmp 00007F78ECFA4DDAh 0x00000037 popad 0x00000038 and dword ptr [eax], 00000000h 0x0000003b jmp 00007F78ECFA4DE0h 0x00000040 and dword ptr [eax+04h], 00000000h 0x00000044 push eax 0x00000045 push edx 0x00000046 push eax 0x00000047 push edx 0x00000048 pushad 0x00000049 popad 0x0000004a rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 53504D1 second address: 53504EE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78ECF4A369h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 52F08B4 second address: 52F08BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 52F08BA second address: 52F08D1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78ECF4A35Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 52F08D1 second address: 52F0919 instructions: 0x00000000 rdtsc 0x00000002 mov esi, edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 pushfd 0x00000008 jmp 00007F78ECFA4DE0h 0x0000000d or al, 00000078h 0x00000010 jmp 00007F78ECFA4DDBh 0x00000015 popfd 0x00000016 pop eax 0x00000017 popad 0x00000018 push eax 0x00000019 jmp 00007F78ECFA4DE6h 0x0000001e xchg eax, ebp 0x0000001f pushad 0x00000020 push eax 0x00000021 push edx 0x00000022 mov si, FB33h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 52F0919 second address: 52F0932 instructions: 0x00000000 rdtsc 0x00000002 movzx esi, dx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F78ECF4A35Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 52F0932 second address: 52F0957 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78ECFA4DE1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F78ECFA4DDDh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 52F0957 second address: 52F095C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 53407A2 second address: 53407A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 53407A6 second address: 53407AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 53407AC second address: 53407B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 53407B2 second address: 53407B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 53407B6 second address: 5340808 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78ECFA4DE0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007F78ECFA4DE0h 0x00000011 push eax 0x00000012 pushad 0x00000013 push edi 0x00000014 push eax 0x00000015 pop edx 0x00000016 pop eax 0x00000017 mov esi, ebx 0x00000019 popad 0x0000001a xchg eax, ebp 0x0000001b jmp 00007F78ECFA4DDBh 0x00000020 mov ebp, esp 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 movsx edi, si 0x00000028 call 00007F78ECFA4DDCh 0x0000002d pop eax 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 5340808 second address: 534080E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 534080E second address: 5340812 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 5340812 second address: 5340842 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78ECF4A35Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebp 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushfd 0x00000010 jmp 00007F78ECF4A35Ch 0x00000015 adc ah, FFFFFFB8h 0x00000018 jmp 00007F78ECF4A35Bh 0x0000001d popfd 0x0000001e rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 5350257 second address: 535025D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 535025D second address: 5350263 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 5350263 second address: 5350287 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F78ECFA4DE9h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 5320E14 second address: 5320E1A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 5320E1A second address: 5320E1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 5320E1E second address: 5320E41 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78ECF4A35Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F78ECF4A35Dh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 5320E41 second address: 5320E9F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78ECFA4DE1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b mov si, di 0x0000000e pushfd 0x0000000f jmp 00007F78ECFA4DE3h 0x00000014 xor cx, 996Eh 0x00000019 jmp 00007F78ECFA4DE9h 0x0000001e popfd 0x0000001f popad 0x00000020 xchg eax, ebp 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007F78ECFA4DDDh 0x00000028 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 5320E9F second address: 5320EE0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78ECF4A361h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007F78ECF4A35Eh 0x00000010 mov eax, dword ptr [ebp+08h] 0x00000013 jmp 00007F78ECF4A360h 0x00000018 and dword ptr [eax], 00000000h 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 5320EE0 second address: 5320EFD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78ECFA4DE9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 5320EFD second address: 5320F0D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F78ECF4A35Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 5320F0D second address: 5320F11 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 5320F11 second address: 5320F26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F78ECF4A35Ah 0x00000010 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 5320F26 second address: 5320F2C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 5320F2C second address: 5320F30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 5310611 second address: 5310620 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78ECFA4DDBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 5310620 second address: 53106D1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F78ECF4A35Fh 0x00000009 sbb ax, 1F1Eh 0x0000000e jmp 00007F78ECF4A369h 0x00000013 popfd 0x00000014 mov esi, 76E0D8E7h 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c xchg eax, ebp 0x0000001d pushad 0x0000001e mov esi, 0575FDDFh 0x00000023 mov cx, 98FBh 0x00000027 popad 0x00000028 push eax 0x00000029 pushad 0x0000002a pushfd 0x0000002b jmp 00007F78ECF4A367h 0x00000030 jmp 00007F78ECF4A363h 0x00000035 popfd 0x00000036 push eax 0x00000037 pushfd 0x00000038 jmp 00007F78ECF4A35Fh 0x0000003d sub ah, 0000003Eh 0x00000040 jmp 00007F78ECF4A369h 0x00000045 popfd 0x00000046 pop eax 0x00000047 popad 0x00000048 xchg eax, ebp 0x00000049 push eax 0x0000004a push edx 0x0000004b jmp 00007F78ECF4A35Ah 0x00000050 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 53106D1 second address: 53106E4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, 523A43E4h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 53106E4 second address: 53106E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 53106E8 second address: 53106EE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 53106EE second address: 5310736 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78ECF4A363h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [ebp+08h] 0x0000000c jmp 00007F78ECF4A366h 0x00000011 and dword ptr [eax], 00000000h 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 jmp 00007F78ECF4A35Dh 0x0000001c mov si, 5C27h 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 52D01EA second address: 52D01EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 52D01EE second address: 52D01F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 52D01F4 second address: 52D021A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx eax, bx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F78ECFA4DE5h 0x0000000f xchg eax, ebp 0x00000010 pushad 0x00000011 pushad 0x00000012 mov ah, 51h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 52D021A second address: 52D026E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov al, bh 0x00000007 popad 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b movzx ecx, di 0x0000000e mov ax, bx 0x00000011 popad 0x00000012 and esp, FFFFFFF8h 0x00000015 jmp 00007F78ECF4A361h 0x0000001a xchg eax, ecx 0x0000001b pushad 0x0000001c mov ecx, 2ACE6003h 0x00000021 movzx ecx, dx 0x00000024 popad 0x00000025 push eax 0x00000026 pushad 0x00000027 pushad 0x00000028 call 00007F78ECF4A35Eh 0x0000002d pop eax 0x0000002e mov bx, D986h 0x00000032 popad 0x00000033 mov di, 0812h 0x00000037 popad 0x00000038 xchg eax, ecx 0x00000039 pushad 0x0000003a push eax 0x0000003b push edx 0x0000003c movzx eax, di 0x0000003f rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 52D026E second address: 52D02A6 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F78ECFA4DDDh 0x00000008 xor al, FFFFFFE6h 0x0000000b jmp 00007F78ECFA4DE1h 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 popad 0x00000014 xchg eax, ebx 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F78ECFA4DDDh 0x0000001c rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 52D02A6 second address: 52D02DC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78ECF4A361h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F78ECF4A361h 0x0000000f xchg eax, ebx 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 call 00007F78ECF4A35Ah 0x00000018 pop eax 0x00000019 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 52D02DC second address: 52D02E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 52D02E0 second address: 52D0345 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushfd 0x00000007 jmp 00007F78ECF4A361h 0x0000000c jmp 00007F78ECF4A35Bh 0x00000011 popfd 0x00000012 popad 0x00000013 mov ebx, dword ptr [ebp+10h] 0x00000016 pushad 0x00000017 pushfd 0x00000018 jmp 00007F78ECF4A364h 0x0000001d or cx, E5A8h 0x00000022 jmp 00007F78ECF4A35Bh 0x00000027 popfd 0x00000028 mov si, 249Fh 0x0000002c popad 0x0000002d xchg eax, esi 0x0000002e pushad 0x0000002f mov bx, ax 0x00000032 push eax 0x00000033 push edx 0x00000034 jmp 00007F78ECF4A35Ah 0x00000039 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 52D0345 second address: 52D03BE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007F78ECFA4DE1h 0x0000000d xchg eax, esi 0x0000000e pushad 0x0000000f mov ebx, ecx 0x00000011 pushfd 0x00000012 jmp 00007F78ECFA4DE8h 0x00000017 sbb ch, FFFFFF98h 0x0000001a jmp 00007F78ECFA4DDBh 0x0000001f popfd 0x00000020 popad 0x00000021 mov esi, dword ptr [ebp+08h] 0x00000024 jmp 00007F78ECFA4DE6h 0x00000029 xchg eax, edi 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007F78ECFA4DE7h 0x00000031 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 52D03BE second address: 52D03C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 52D03C4 second address: 52D03C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 52D03C8 second address: 52D03CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 52D03CC second address: 52D03DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 52D03DB second address: 52D03EE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78ECF4A35Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 52D03EE second address: 52D03F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 52D03F3 second address: 52D0473 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov si, bx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, edi 0x0000000b pushad 0x0000000c pushad 0x0000000d mov dx, 25CEh 0x00000011 push edi 0x00000012 pop eax 0x00000013 popad 0x00000014 pushfd 0x00000015 jmp 00007F78ECF4A35Bh 0x0000001a or eax, 338B9E7Eh 0x00000020 jmp 00007F78ECF4A369h 0x00000025 popfd 0x00000026 popad 0x00000027 test esi, esi 0x00000029 jmp 00007F78ECF4A35Eh 0x0000002e je 00007F795F9D8527h 0x00000034 jmp 00007F78ECF4A360h 0x00000039 cmp dword ptr [esi+08h], DDEEDDEEh 0x00000040 pushad 0x00000041 mov bx, F4C0h 0x00000045 popad 0x00000046 je 00007F795F9D851Ah 0x0000004c push eax 0x0000004d push edx 0x0000004e push eax 0x0000004f push edx 0x00000050 pushad 0x00000051 popad 0x00000052 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 52D0473 second address: 52D0483 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78ECFA4DDCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 52D0483 second address: 52D04BF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78ECF4A35Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edx, dword ptr [esi+44h] 0x0000000c pushad 0x0000000d mov dx, ax 0x00000010 mov bh, ah 0x00000012 popad 0x00000013 or edx, dword ptr [ebp+0Ch] 0x00000016 jmp 00007F78ECF4A363h 0x0000001b test edx, 61000000h 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 mov eax, edi 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 52D04BF second address: 52D04C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 52D04C4 second address: 52D04CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 52D04CA second address: 52D04F1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78ECFA4DE4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jne 00007F795FA32F7Ah 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 mov dl, C1h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 52D04F1 second address: 52D04F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 52D04F6 second address: 52D0532 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78ECFA4DE5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test byte ptr [esi+48h], 00000001h 0x0000000d jmp 00007F78ECFA4DDEh 0x00000012 jne 00007F795FA32F56h 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b mov ch, dl 0x0000001d mov esi, 16813915h 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 52F0BEC second address: 52F0C3E instructions: 0x00000000 rdtsc 0x00000002 mov si, 7829h 0x00000006 pop edx 0x00000007 pop eax 0x00000008 call 00007F78ECF4A366h 0x0000000d pushfd 0x0000000e jmp 00007F78ECF4A362h 0x00000013 jmp 00007F78ECF4A365h 0x00000018 popfd 0x00000019 pop ecx 0x0000001a popad 0x0000001b and esp, FFFFFFF8h 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 52F0C3E second address: 52F0C42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 52F0C42 second address: 52F0C48 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 52F0C48 second address: 52F0C4D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 52F0C4D second address: 52F0C53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 52F0C53 second address: 52F0C95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push edx 0x00000008 jmp 00007F78ECFA4DE8h 0x0000000d mov dword ptr [esp], ebx 0x00000010 jmp 00007F78ECFA4DE0h 0x00000015 xchg eax, esi 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F78ECFA4DDAh 0x0000001f rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 52F0C95 second address: 52F0CA4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78ECF4A35Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 52F0CA4 second address: 52F0D3A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, ax 0x00000006 mov bl, ah 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d mov si, 02AFh 0x00000011 jmp 00007F78ECFA4DE4h 0x00000016 popad 0x00000017 xchg eax, esi 0x00000018 jmp 00007F78ECFA4DE0h 0x0000001d mov esi, dword ptr [ebp+08h] 0x00000020 pushad 0x00000021 jmp 00007F78ECFA4DDEh 0x00000026 movzx ecx, bx 0x00000029 popad 0x0000002a mov ebx, 00000000h 0x0000002f pushad 0x00000030 mov bx, si 0x00000033 pushfd 0x00000034 jmp 00007F78ECFA4DE4h 0x00000039 xor ax, 1A98h 0x0000003e jmp 00007F78ECFA4DDBh 0x00000043 popfd 0x00000044 popad 0x00000045 test esi, esi 0x00000047 pushad 0x00000048 jmp 00007F78ECFA4DE4h 0x0000004d push eax 0x0000004e push edx 0x0000004f rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 52F0D3A second address: 52F0DC8 instructions: 0x00000000 rdtsc 0x00000002 mov bx, F9C2h 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 je 00007F795F9AF9A1h 0x0000000f jmp 00007F78ECF4A369h 0x00000014 cmp dword ptr [esi+08h], DDEEDDEEh 0x0000001b jmp 00007F78ECF4A35Eh 0x00000020 mov ecx, esi 0x00000022 jmp 00007F78ECF4A360h 0x00000027 je 00007F795F9AF970h 0x0000002d push eax 0x0000002e push edx 0x0000002f pushad 0x00000030 call 00007F78ECF4A35Dh 0x00000035 pop ecx 0x00000036 pushfd 0x00000037 jmp 00007F78ECF4A361h 0x0000003c xor ch, 00000056h 0x0000003f jmp 00007F78ECF4A361h 0x00000044 popfd 0x00000045 popad 0x00000046 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 52F0DC8 second address: 52F0DD8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F78ECFA4DDCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 52F0DD8 second address: 52F0DDC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 52F0DDC second address: 52F0E97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test byte ptr [77DE6968h], 00000002h 0x0000000f jmp 00007F78ECFA4DE7h 0x00000014 jne 00007F795FA0A38Ah 0x0000001a pushad 0x0000001b push eax 0x0000001c push ebx 0x0000001d pop eax 0x0000001e pop edx 0x0000001f movzx ecx, bx 0x00000022 popad 0x00000023 mov edx, dword ptr [ebp+0Ch] 0x00000026 pushad 0x00000027 pushfd 0x00000028 jmp 00007F78ECFA4DE5h 0x0000002d or eax, 65E1C876h 0x00000033 jmp 00007F78ECFA4DE1h 0x00000038 popfd 0x00000039 mov ch, F3h 0x0000003b popad 0x0000003c push ebx 0x0000003d pushad 0x0000003e push ecx 0x0000003f movsx edx, ax 0x00000042 pop ecx 0x00000043 call 00007F78ECFA4DE7h 0x00000048 pushfd 0x00000049 jmp 00007F78ECFA4DE8h 0x0000004e or ch, 00000028h 0x00000051 jmp 00007F78ECFA4DDBh 0x00000056 popfd 0x00000057 pop ecx 0x00000058 popad 0x00000059 mov dword ptr [esp], ebx 0x0000005c push eax 0x0000005d push edx 0x0000005e push eax 0x0000005f push edx 0x00000060 push eax 0x00000061 push edx 0x00000062 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 52F0E97 second address: 52F0E9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 52F0E9B second address: 52F0EAB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78ECFA4DDCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 52F0EAB second address: 52F0EE9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78ECF4A35Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a pushad 0x0000000b mov edi, esi 0x0000000d mov dx, si 0x00000010 popad 0x00000011 push eax 0x00000012 jmp 00007F78ECF4A35Dh 0x00000017 xchg eax, ebx 0x00000018 jmp 00007F78ECF4A35Eh 0x0000001d push dword ptr [ebp+14h] 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 mov dx, cx 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 52F0F76 second address: 52F0FDD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ch, 76h 0x00000005 pushfd 0x00000006 jmp 00007F78ECFA4DE5h 0x0000000b or ax, A636h 0x00000010 jmp 00007F78ECFA4DE1h 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 mov esp, ebp 0x0000001b jmp 00007F78ECFA4DDEh 0x00000020 pop ebp 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 mov si, di 0x00000027 call 00007F78ECFA4DE9h 0x0000002c pop eax 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 52F0145 second address: 52F0149 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 52F0149 second address: 52F014F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 52F014F second address: 52F01D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F78ECF4A35Ch 0x00000009 and al, FFFFFFB8h 0x0000000c jmp 00007F78ECF4A35Bh 0x00000011 popfd 0x00000012 call 00007F78ECF4A368h 0x00000017 pop eax 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b push eax 0x0000001c pushad 0x0000001d mov al, 6Ah 0x0000001f mov dh, AAh 0x00000021 popad 0x00000022 xchg eax, ebp 0x00000023 jmp 00007F78ECF4A362h 0x00000028 mov ebp, esp 0x0000002a jmp 00007F78ECF4A360h 0x0000002f pop ebp 0x00000030 push eax 0x00000031 push edx 0x00000032 jmp 00007F78ECF4A367h 0x00000037 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 52E0CDD second address: 52E0CE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 52E0CE1 second address: 52E0CE7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 52E0CE7 second address: 52E0CED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 52E0CED second address: 52E0CF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 5360ECC second address: 5360ED2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 5360ED2 second address: 5360ED6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 5360ED6 second address: 5360EDA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 5360EDA second address: 5360EEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push ebx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 5360EEA second address: 5360EEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 5360EEF second address: 5360EF5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 5360EF5 second address: 5360EF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 5360EF9 second address: 5360EFD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 5360EFD second address: 5360F0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 5360F0E second address: 5360F14 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 5360F14 second address: 5360F32 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov edx, ecx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov ebp, esp 0x0000000c jmp 00007F78ECFA4DDAh 0x00000011 pop ebp 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 pushad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 5360F32 second address: 5360F37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 5360F37 second address: 5360F3D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 5360F3D second address: 5360F41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 5360217 second address: 536021D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 536021D second address: 5360237 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78ECF4A35Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 5360237 second address: 536024A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78ECFA4DDFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 536024A second address: 536029E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F78ECF4A35Fh 0x00000008 pop eax 0x00000009 pushfd 0x0000000a jmp 00007F78ECF4A369h 0x0000000f add ch, FFFFFFE6h 0x00000012 jmp 00007F78ECF4A361h 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b push eax 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F78ECF4A35Ch 0x00000023 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 536029E second address: 53602C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, 1D8AE634h 0x00000008 mov ax, dx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, ebp 0x0000000f jmp 00007F78ECFA4DDFh 0x00000014 mov ebp, esp 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 movsx edx, si 0x0000001c mov edi, ecx 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 5350F5D second address: 5350F72 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F78ECF4A361h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 5350F72 second address: 5350F76 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 5350F76 second address: 5350F99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F78ECF4A368h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 5350F99 second address: 5350F9F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 5350F9F second address: 5350FA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 5350FA3 second address: 5350FA7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 52F077B second address: 52F0781 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 52F0781 second address: 52F07B5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007F78ECFA4DE6h 0x00000010 add ah, 00000018h 0x00000013 jmp 00007F78ECFA4DDBh 0x00000018 popfd 0x00000019 push eax 0x0000001a push edx 0x0000001b mov dl, al 0x0000001d rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 5360501 second address: 5360506 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 5360506 second address: 5360596 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov edi, 42F74182h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov ebp, esp 0x0000000e jmp 00007F78ECFA4DE9h 0x00000013 push dword ptr [ebp+0Ch] 0x00000016 pushad 0x00000017 push eax 0x00000018 mov dh, 71h 0x0000001a pop ecx 0x0000001b call 00007F78ECFA4DE5h 0x00000020 pushfd 0x00000021 jmp 00007F78ECFA4DE0h 0x00000026 jmp 00007F78ECFA4DE5h 0x0000002b popfd 0x0000002c pop esi 0x0000002d popad 0x0000002e push dword ptr [ebp+08h] 0x00000031 jmp 00007F78ECFA4DE7h 0x00000036 push 8C226529h 0x0000003b pushad 0x0000003c push ebx 0x0000003d push eax 0x0000003e push edx 0x0000003f rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 5360596 second address: 53605BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 movsx edx, si 0x00000008 popad 0x00000009 add dword ptr [esp], 73DE9AD9h 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F78ECF4A360h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 53605BA second address: 53605C9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78ECFA4DDBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 5330442 second address: 53304A0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F78ECF4A367h 0x00000009 jmp 00007F78ECF4A363h 0x0000000e popfd 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 pushfd 0x00000019 jmp 00007F78ECF4A360h 0x0000001e sub si, 60D8h 0x00000023 jmp 00007F78ECF4A35Bh 0x00000028 popfd 0x00000029 mov di, cx 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 53304A0 second address: 53304A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 53304A6 second address: 53304AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 53304AA second address: 53304CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F78ECFA4DE6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 53304CB second address: 533050E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, ax 0x00000006 pushfd 0x00000007 jmp 00007F78ECF4A35Ah 0x0000000c adc ax, A598h 0x00000011 jmp 00007F78ECF4A35Bh 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a mov ebp, esp 0x0000001c jmp 00007F78ECF4A366h 0x00000021 and esp, FFFFFFF0h 0x00000024 pushad 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 533050E second address: 53305F6 instructions: 0x00000000 rdtsc 0x00000002 mov eax, edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F78ECFA4DDFh 0x0000000b popad 0x0000000c sub esp, 44h 0x0000000f pushad 0x00000010 pushad 0x00000011 mov ax, 87B1h 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 pushad 0x00000019 mov cx, 7BE9h 0x0000001d pushfd 0x0000001e jmp 00007F78ECFA4DE6h 0x00000023 sub si, 34B8h 0x00000028 jmp 00007F78ECFA4DDBh 0x0000002d popfd 0x0000002e popad 0x0000002f popad 0x00000030 xchg eax, ebx 0x00000031 pushad 0x00000032 jmp 00007F78ECFA4DDBh 0x00000037 popad 0x00000038 push eax 0x00000039 jmp 00007F78ECFA4DE9h 0x0000003e xchg eax, ebx 0x0000003f pushad 0x00000040 jmp 00007F78ECFA4DDCh 0x00000045 pushfd 0x00000046 jmp 00007F78ECFA4DE2h 0x0000004b or cl, FFFFFFA8h 0x0000004e jmp 00007F78ECFA4DDBh 0x00000053 popfd 0x00000054 popad 0x00000055 xchg eax, esi 0x00000056 push eax 0x00000057 push edx 0x00000058 pushad 0x00000059 pushfd 0x0000005a jmp 00007F78ECFA4DDBh 0x0000005f or ah, FFFFFFEEh 0x00000062 jmp 00007F78ECFA4DE9h 0x00000067 popfd 0x00000068 jmp 00007F78ECFA4DE0h 0x0000006d popad 0x0000006e rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 53305F6 second address: 533069D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78ECF4A35Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F78ECF4A369h 0x0000000f xchg eax, esi 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007F78ECF4A35Ch 0x00000017 adc esi, 2E5DE2F8h 0x0000001d jmp 00007F78ECF4A35Bh 0x00000022 popfd 0x00000023 mov eax, 0A8BA02Fh 0x00000028 popad 0x00000029 xchg eax, edi 0x0000002a jmp 00007F78ECF4A362h 0x0000002f push eax 0x00000030 jmp 00007F78ECF4A35Bh 0x00000035 xchg eax, edi 0x00000036 jmp 00007F78ECF4A366h 0x0000003b mov edi, dword ptr [ebp+08h] 0x0000003e jmp 00007F78ECF4A360h 0x00000043 mov dword ptr [esp+24h], 00000000h 0x0000004b pushad 0x0000004c mov bx, cx 0x0000004f push eax 0x00000050 push edx 0x00000051 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 533069D second address: 53306F0 instructions: 0x00000000 rdtsc 0x00000002 mov cl, bl 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 lock bts dword ptr [edi], 00000000h 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007F78ECFA4DE3h 0x00000015 and ax, B6DEh 0x0000001a jmp 00007F78ECFA4DE9h 0x0000001f popfd 0x00000020 jmp 00007F78ECFA4DE0h 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 53306F0 second address: 53306F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 53306F6 second address: 53306FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 53306FA second address: 533074A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jc 00007F795F91C087h 0x0000000e jmp 00007F78ECF4A369h 0x00000013 pop edi 0x00000014 jmp 00007F78ECF4A35Eh 0x00000019 pop esi 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F78ECF4A367h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 533074A second address: 5330784 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78ECFA4DE9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F78ECFA4DE8h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 5330784 second address: 533078A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 533078A second address: 5330790 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 5330790 second address: 5330794 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 5330794 second address: 5330798 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 5330086 second address: 5330157 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F78ECF4A35Fh 0x00000009 sbb si, 91CEh 0x0000000e jmp 00007F78ECF4A369h 0x00000013 popfd 0x00000014 push eax 0x00000015 pop edx 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 mov dword ptr [esp], ebp 0x0000001c jmp 00007F78ECF4A35Ah 0x00000021 mov ebp, esp 0x00000023 jmp 00007F78ECF4A360h 0x00000028 xchg eax, ebx 0x00000029 jmp 00007F78ECF4A360h 0x0000002e push eax 0x0000002f jmp 00007F78ECF4A35Bh 0x00000034 xchg eax, ebx 0x00000035 pushad 0x00000036 jmp 00007F78ECF4A364h 0x0000003b jmp 00007F78ECF4A362h 0x00000040 popad 0x00000041 xchg eax, esi 0x00000042 pushad 0x00000043 jmp 00007F78ECF4A35Eh 0x00000048 mov cx, F181h 0x0000004c popad 0x0000004d push eax 0x0000004e pushad 0x0000004f mov ebx, 2ED1ED80h 0x00000054 mov esi, ebx 0x00000056 popad 0x00000057 xchg eax, esi 0x00000058 push eax 0x00000059 push edx 0x0000005a pushad 0x0000005b call 00007F78ECF4A35Ch 0x00000060 pop ecx 0x00000061 mov dx, DB86h 0x00000065 popad 0x00000066 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 5330157 second address: 533015D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 533015D second address: 53301D9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78ECF4A366h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov esi, dword ptr [ebp+08h] 0x0000000e pushad 0x0000000f movzx esi, di 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007F78ECF4A369h 0x00000019 xor cx, 7E46h 0x0000001e jmp 00007F78ECF4A361h 0x00000023 popfd 0x00000024 call 00007F78ECF4A360h 0x00000029 pop ecx 0x0000002a popad 0x0000002b popad 0x0000002c mov ecx, 00000000h 0x00000031 push eax 0x00000032 push edx 0x00000033 jmp 00007F78ECF4A35Dh 0x00000038 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 53301D9 second address: 533024E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78ECFA4DE1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, edi 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F78ECFA4DDCh 0x00000011 sub al, 00000078h 0x00000014 jmp 00007F78ECFA4DDBh 0x00000019 popfd 0x0000001a pushfd 0x0000001b jmp 00007F78ECFA4DE8h 0x00000020 add ax, 3AD8h 0x00000025 jmp 00007F78ECFA4DDBh 0x0000002a popfd 0x0000002b popad 0x0000002c push eax 0x0000002d push eax 0x0000002e push edx 0x0000002f jmp 00007F78ECFA4DE4h 0x00000034 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 533024E second address: 5330322 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F78ECF4A361h 0x00000009 adc esi, 7D31DD26h 0x0000000f jmp 00007F78ECF4A361h 0x00000014 popfd 0x00000015 call 00007F78ECF4A360h 0x0000001a pop ecx 0x0000001b popad 0x0000001c pop edx 0x0000001d pop eax 0x0000001e xchg eax, edi 0x0000001f jmp 00007F78ECF4A361h 0x00000024 mov eax, 00000001h 0x00000029 jmp 00007F78ECF4A35Eh 0x0000002e lock cmpxchg dword ptr [esi], ecx 0x00000032 jmp 00007F78ECF4A360h 0x00000037 mov ecx, eax 0x00000039 pushad 0x0000003a mov dl, cl 0x0000003c popad 0x0000003d cmp ecx, 01h 0x00000040 pushad 0x00000041 mov edx, 50298946h 0x00000046 pushfd 0x00000047 jmp 00007F78ECF4A367h 0x0000004c add ah, FFFFFFCEh 0x0000004f jmp 00007F78ECF4A369h 0x00000054 popfd 0x00000055 popad 0x00000056 jne 00007F795F91C617h 0x0000005c push eax 0x0000005d push edx 0x0000005e jmp 00007F78ECF4A35Dh 0x00000063 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 5330322 second address: 5330360 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78ECFA4DE1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a jmp 00007F78ECFA4DDEh 0x0000000f pop esi 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F78ECFA4DE7h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 5330360 second address: 5330366 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 5330366 second address: 533036A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 533036A second address: 533038D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push esi 0x0000000d pop edi 0x0000000e jmp 00007F78ECF4A364h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 533038D second address: 5330393 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 5330393 second address: 53303AB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F78ECF4A35Bh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 53303AB second address: 53303AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 53303AF second address: 53303B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 534002B second address: 534003C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dl, 53h 0x00000005 mov ch, A7h 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 534003C second address: 5340040 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 5340040 second address: 5340046 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 5340046 second address: 534004C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 534004C second address: 5340075 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a pushad 0x0000000b push esi 0x0000000c pop edi 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 movzx esi, di 0x00000013 popad 0x00000014 mov ebp, esp 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F78ECFA4DDFh 0x0000001f rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 5340075 second address: 534007B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 534007B second address: 534008A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F78ECFA4DDBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 534008A second address: 53400CE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push FFFFFFFEh 0x0000000a pushad 0x0000000b push edi 0x0000000c mov ax, FD9Dh 0x00000010 pop ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushfd 0x00000014 jmp 00007F78ECF4A369h 0x00000019 adc si, ECE6h 0x0000001e jmp 00007F78ECF4A361h 0x00000023 popfd 0x00000024 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 53400CE second address: 5340103 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push 2C8CD0F5h 0x0000000c pushad 0x0000000d pushad 0x0000000e call 00007F78ECFA4DDFh 0x00000013 pop eax 0x00000014 mov eax, edi 0x00000016 popad 0x00000017 mov bx, 93B8h 0x0000001b popad 0x0000001c xor dword ptr [esp], 5B5010EDh 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 mov ch, CFh 0x00000028 push edx 0x00000029 pop eax 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 5340103 second address: 5340176 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78ECF4A35Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 call 00007F78ECF4A359h 0x0000000e pushad 0x0000000f mov di, ax 0x00000012 call 00007F78ECF4A35Ah 0x00000017 push esi 0x00000018 pop edi 0x00000019 pop ecx 0x0000001a popad 0x0000001b push eax 0x0000001c jmp 00007F78ECF4A35Ch 0x00000021 mov eax, dword ptr [esp+04h] 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 mov edi, esi 0x0000002a pushfd 0x0000002b jmp 00007F78ECF4A368h 0x00000030 jmp 00007F78ECF4A365h 0x00000035 popfd 0x00000036 popad 0x00000037 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 5340176 second address: 53401FD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F78ECFA4DE7h 0x00000009 sbb cl, 0000004Eh 0x0000000c jmp 00007F78ECFA4DE9h 0x00000011 popfd 0x00000012 pushfd 0x00000013 jmp 00007F78ECFA4DE0h 0x00000018 sbb eax, 102996C8h 0x0000001e jmp 00007F78ECFA4DDBh 0x00000023 popfd 0x00000024 popad 0x00000025 pop edx 0x00000026 pop eax 0x00000027 mov eax, dword ptr [eax] 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c mov bx, si 0x0000002f pushfd 0x00000030 jmp 00007F78ECFA4DDEh 0x00000035 sub si, 1928h 0x0000003a jmp 00007F78ECFA4DDBh 0x0000003f popfd 0x00000040 popad 0x00000041 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 53401FD second address: 5340203 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 5340203 second address: 534021E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F78ECFA4DDDh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 534021E second address: 5340288 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78ECF4A361h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a jmp 00007F78ECF4A35Eh 0x0000000f mov eax, dword ptr fs:[00000000h] 0x00000015 jmp 00007F78ECF4A360h 0x0000001a nop 0x0000001b pushad 0x0000001c pushfd 0x0000001d jmp 00007F78ECF4A35Eh 0x00000022 or al, 00000048h 0x00000025 jmp 00007F78ECF4A35Bh 0x0000002a popfd 0x0000002b pushad 0x0000002c movzx ecx, bx 0x0000002f movsx edx, ax 0x00000032 popad 0x00000033 popad 0x00000034 push eax 0x00000035 push eax 0x00000036 push edx 0x00000037 push eax 0x00000038 push edx 0x00000039 pushad 0x0000003a popad 0x0000003b rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 5340288 second address: 534028E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 534028E second address: 5340329 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov edx, 0DFF7EC0h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d nop 0x0000000e jmp 00007F78ECF4A35Fh 0x00000013 sub esp, 1Ch 0x00000016 pushad 0x00000017 pushfd 0x00000018 jmp 00007F78ECF4A364h 0x0000001d and ax, B038h 0x00000022 jmp 00007F78ECF4A35Bh 0x00000027 popfd 0x00000028 pushfd 0x00000029 jmp 00007F78ECF4A368h 0x0000002e or eax, 4F31AA98h 0x00000034 jmp 00007F78ECF4A35Bh 0x00000039 popfd 0x0000003a popad 0x0000003b xchg eax, ebx 0x0000003c jmp 00007F78ECF4A366h 0x00000041 push eax 0x00000042 push eax 0x00000043 push edx 0x00000044 jmp 00007F78ECF4A35Eh 0x00000049 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 5340329 second address: 53403AD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F78ECFA4DE1h 0x00000009 or esi, 5F45F196h 0x0000000f jmp 00007F78ECFA4DE1h 0x00000014 popfd 0x00000015 pushfd 0x00000016 jmp 00007F78ECFA4DE0h 0x0000001b or cx, B9B8h 0x00000020 jmp 00007F78ECFA4DDBh 0x00000025 popfd 0x00000026 popad 0x00000027 pop edx 0x00000028 pop eax 0x00000029 xchg eax, ebx 0x0000002a pushad 0x0000002b mov al, FAh 0x0000002d movsx edx, ax 0x00000030 popad 0x00000031 xchg eax, esi 0x00000032 jmp 00007F78ECFA4DE8h 0x00000037 push eax 0x00000038 push eax 0x00000039 push edx 0x0000003a jmp 00007F78ECFA4DDEh 0x0000003f rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 53403AD second address: 53403B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\5yCKVE324w.exe RDTSC instruction interceptor: First address: 53403B3 second address: 53403B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Tries to evade debugger and weak emulator (self modifying code)
Source: C:\Users\user\Desktop\5yCKVE324w.exe Special instruction interceptor: First address: 9C2C80 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\5yCKVE324w.exe Special instruction interceptor: First address: B5F29B instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\5yCKVE324w.exe Special instruction interceptor: First address: B5DC9F instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\5yCKVE324w.exe Special instruction interceptor: First address: B8B84F instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\5yCKVE324w.exe Special instruction interceptor: First address: BEEFDB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Special instruction interceptor: First address: EB2C80 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Special instruction interceptor: First address: 104F29B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Special instruction interceptor: First address: 104DC9F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Special instruction interceptor: First address: 107B84F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Special instruction interceptor: First address: 10DEFDB instructions caused by: Self-modifying code
Contains capabilities to detect virtual machines
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\5yCKVE324w.exe Code function: 0_2_0536054A rdtsc 0_2_0536054A
Contains long sleeps (>= 3 min)
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Thread delayed: delay time: 180000 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Window / User API: threadDelayed 1256 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Window / User API: threadDelayed 487 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Window / User API: threadDelayed 1257 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Window / User API: threadDelayed 1269 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 5612 Thread sleep count: 48 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 5612 Thread sleep time: -96048s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 4092 Thread sleep count: 1256 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 4092 Thread sleep time: -2513256s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 5200 Thread sleep count: 487 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 5200 Thread sleep time: -14610000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 7228 Thread sleep time: -180000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 2168 Thread sleep count: 1257 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 2168 Thread sleep time: -2515257s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 1420 Thread sleep count: 1269 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 1420 Thread sleep time: -2539269s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\5yCKVE324w.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Thread delayed: delay time: 30000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Thread delayed: delay time: 180000 Jump to behavior
Source: rapes.exe, rapes.exe, 0000000A.00000002.3349887207.000000000102F000.00000040.00000001.01000000.00000007.sdmp Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: rapes.exe, 0000000A.00000002.3348235431.00000000009DB000.00000004.00000020.00020000.00000000.sdmp, rapes.exe, 0000000A.00000002.3348235431.0000000000A0A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: 5yCKVE324w.exe, 00000000.00000002.938273046.0000000000B3F000.00000040.00000001.01000000.00000003.sdmp, rapes.exe, 00000001.00000002.971346080.000000000102F000.00000040.00000001.01000000.00000007.sdmp, rapes.exe, 0000000A.00000002.3349887207.000000000102F000.00000040.00000001.01000000.00000007.sdmp Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: C:\Users\user\Desktop\5yCKVE324w.exe System information queried: ModuleInformation Jump to behavior
Source: C:\Users\user\Desktop\5yCKVE324w.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging
barindex
Hides threads from debuggers
Source: C:\Users\user\Desktop\5yCKVE324w.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Thread information set: HideFromDebugger Jump to behavior
Tries to detect sandboxes and other dynamic analysis tools (window names)
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Open window title or class name: file monitor - sysinternals: www.sysinternals.com
Checks for debuggers (devices)
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe File opened: SIWVID
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\5yCKVE324w.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\5yCKVE324w.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\5yCKVE324w.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\5yCKVE324w.exe Code function: 0_2_0536054A rdtsc 0_2_0536054A
Contains functionality to read the PEB
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Code function: 10_2_00E75FF2 mov eax, dword ptr fs:[00000030h] 10_2_00E75FF2
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Code function: 10_2_00E6DB60 mov eax, dword ptr fs:[00000030h] 10_2_00E6DB60
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\5yCKVE324w.exe Process created: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe "C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe" Jump to behavior
Source: rapes.exe, rapes.exe, 0000000A.00000002.3349887207.000000000102F000.00000040.00000001.01000000.00000007.sdmp Binary or memory string: mProgram Manager
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Code function: 10_2_00E69AB5 cpuid 10_2_00E69AB5
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Code function: 10_2_00E693A7 GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime, 10_2_00E693A7
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Code function: 10_2_00E461F0 RegOpenKeyExA,RegQueryValueExA,RegCloseKey,RegOpenKeyExA,RegEnumValueA,DeleteObject,DeleteObject,DeleteObject,LookupAccountNameA, 10_2_00E461F0

Stealing of Sensitive Information
barindex
Yara detected Amadey
Source: Yara match File source: decrypted.memstr, type: MEMORYSTR
Yara detected Amadeys Clipper DLL
Source: Yara match File source: 00000000.00000002.938169753.0000000000951000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000003.1297610885.0000000004C90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.971269603.0000000000E41000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.897858235.0000000005130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.3349572345.0000000000E41000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.930944384.0000000005190000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality
barindex
Contains functionality to start a terminal service
Source: 5yCKVE324w.exe String found in binary or memory: net start termservice
Source: 5yCKVE324w.exe, 00000000.00000002.938169753.0000000000951000.00000040.00000001.01000000.00000003.sdmp String found in binary or memory: net start termservice
Source: 5yCKVE324w.exe, 00000000.00000002.938169753.0000000000951000.00000040.00000001.01000000.00000003.sdmp String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit seta131b127e996a898cd19ffb2d92e481b006700e5a2ab05704bbb0c589b88924d0921553d1dc176b36780331821e85866812981MJ5SM vtQw2sMQSrPj==LQXfPMklgFTVLZjr1JL2QsCffy==NIWoNG==UoSbcxLpJITieG==LINieG==YcAROJQf3kWVYN==ccxm0NDq3VfgUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMyMZVkZG==UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3WNEhggzOaDTpdFrEg7yb2VADUTJ8ddIXgy==UcNjYSTaJs0zMDHIRBjPKFZxQ8F8UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMycdNk0wooQxGbUxBl0TAdfVK=UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3VS9hfEubRj7p1JLwhB==JLNJSLAMYi7BSRvCLT==Xuxmdq==Uu1JWq==RQNKaMIWddEWcSIWbTEWYccWYNAWcwEWdMWWZwSWYNQWbxQWbS5Wc S=YTBb0sWgfEv3YZvmeFVigLyZYTBb0sWgfEu=YSpfdsWgfEu=Ztw=ZJw=ZJA=ZJE=TMxfc7==axJQdtfrPu==axJQdxD2Pw6=ZN bZwpiYSTacxEnbNFfecdmLTxRbMMWPwE+PwI+LRtieM5lflKqKokhIm==fq==JdNkbNH5PG==cS bcwnvQg3fbDu=aSNoccMoQxGpZDvpRSNQUcwWeVXgU0jwfJLrX16deu==UxBl0TAdfSPcdDD QLRrVRHcY07hdEbeepK=QNRfdcv=SSxpdwMug0r0IBve0j==RLFvWq==Uwxk0wvcY0TedUHmfKa=Rw1 ew0uMDbgYd==QLRxMpQmWw0W2UvOZTLYepbYjV==QcdQ0wMi3U3fZUG=Tc1oew0qUS1mbw0vQS1jcSIrVSdkSwMi3U3fZUG=MtwoNpHXRhaZON==ccA=dSA=QS1kewMqhAZPeUziQlrri1yRdVsl6kGwZc1ocISg2VPcOvzfd6Ls4LGphRRxEPQuLISjMIRpDGhtcSWW3U3VLRPme6rth7mRdU0yHfrnbTBjMMIdhEC2ID3edZK7NrS9gEvmHvrnaMpbccwp3RYdI7SARS0qhETpdzZRg0rjTnC9fFsw4TDidwdlc90r21PgdzZwfKzj311EFeRODGgjMIRpPQY=LISDD7==PTF d RtLchm0m==QS1kewMqhAZPeUziQlrfhMCjdUEl7Dbwb91UMN5ZhwZhb0HqN0LwgLWl100oSTG=URdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8QZ7qeKLY42KF1USpQBDwbNtRewMuXkDoZN==QS1jdxMW3VHJYTZiYMB 0wMi30fkajrpdZVthMGpf1I57k45eNgmNJzvRBSXNwe2NYY=LNNkbMEr3ESoURdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8VT3mfJLi0rmb2U0gJXZPVvBFUvoSWSPATYu=URdJWuMJ1CLqbkPvd5nR42RnPBwgNZLzdcd 0NE9UkDuaTLBc0DugLGW0DQtSDLwVcda0M0FVy==XtsmNtr=RwNcZNMohDLgdEPmdp4xQqiJ2VEz5EL1aM1kRwNcZNMohDLgdEPmdp4xQqmJ2VEz5EL1aM1kUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTE7UbI9U1TtcjTrfIPjhsOge0V=UxBl0xMfhC3cbTS=M snPG==M soN7==M snO7==M soOG==QTNodcMqhCHWaTvhXq==O gWcdNk0wooQxGpZUfiLSk7IdJ8dSkneUvnIz7jKFZngXB I9scK9sWeUZgb0TXKGueOnZ82EMwBx==J9Q7SN9lhAG=I9scK9su3U2bIsQcJq==Uw1T0NAveETnbz3igJK=LMNU0MEXhEjqbkzsdJbhjXCp2USz7DLAaM6k0MHcPSXkbDSdKj==I7==cS RewIrh02bLUKdN0GeRF==cTIZdm==ccxk0w0pSSNVZc0dgkObTDD2d6LY2KCp2UozRTG=MtsmNtrWQRi=MtsmNtrWQhG=MtsmNtrWQhK=MtsmNtrWQ0W=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice
Source: 5yCKVE324w.exe, 00000000.00000003.897858235.0000000005130000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: net start termservice
Source: 5yCKVE324w.exe, 00000000.00000003.897858235.0000000005130000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit seta131b127e996a898cd19ffb2d92e481b006700e5a2ab05704bbb0c589b88924d0921553d1dc176b36780331821e85866812981MJ5SM vtQw2sMQSrPj==LQXfPMklgFTVLZjr1JL2QsCffy==NIWoNG==UoSbcxLpJITieG==LINieG==YcAROJQf3kWVYN==ccxm0NDq3VfgUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMyMZVkZG==UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3WNEhggzOaDTpdFrEg7yb2VADUTJ8ddIXgy==UcNjYSTaJs0zMDHIRBjPKFZxQ8F8UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMycdNk0wooQxGbUxBl0TAdfVK=UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3VS9hfEubRj7p1JLwhB==JLNJSLAMYi7BSRvCLT==Xuxmdq==Uu1JWq==RQNKaMIWddEWcSIWbTEWYccWYNAWcwEWdMWWZwSWYNQWbxQWbS5Wc S=YTBb0sWgfEv3YZvmeFVigLyZYTBb0sWgfEu=YSpfdsWgfEu=Ztw=ZJw=ZJA=ZJE=TMxfc7==axJQdtfrPu==axJQdxD2Pw6=ZN bZwpiYSTacxEnbNFfecdmLTxRbMMWPwE+PwI+LRtieM5lflKqKokhIm==fq==JdNkbNH5PG==cS bcwnvQg3fbDu=aSNoccMoQxGpZDvpRSNQUcwWeVXgU0jwfJLrX16deu==UxBl0TAdfSPcdDD QLRrVRHcY07hdEbeepK=QNRfdcv=SSxpdwMug0r0IBve0j==RLFvWq==Uwxk0wvcY0TedUHmfKa=Rw1 ew0uMDbgYd==QLRxMpQmWw0W2UvOZTLYepbYjV==QcdQ0wMi3U3fZUG=Tc1oew0qUS1mbw0vQS1jcSIrVSdkSwMi3U3fZUG=MtwoNpHXRhaZON==ccA=dSA=QS1kewMqhAZPeUziQlrri1yRdVsl6kGwZc1ocISg2VPcOvzfd6Ls4LGphRRxEPQuLISjMIRpDGhtcSWW3U3VLRPme6rth7mRdU0yHfrnbTBjMMIdhEC2ID3edZK7NrS9gEvmHvrnaMpbccwp3RYdI7SARS0qhETpdzZRg0rjTnC9fFsw4TDidwdlc90r21PgdzZwfKzj311EFeRODGgjMIRpPQY=LISDD7==PTF d RtLchm0m==QS1kewMqhAZPeUziQlrfhMCjdUEl7Dbwb91UMN5ZhwZhb0HqN0LwgLWl100oSTG=URdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8QZ7qeKLY42KF1USpQBDwbNtRewMuXkDoZN==QS1jdxMW3VHJYTZiYMB 0wMi30fkajrpdZVthMGpf1I57k45eNgmNJzvRBSXNwe2NYY=LNNkbMEr3ESoURdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8VT3mfJLi0rmb2U0gJXZPVvBFUvoSWSPATYu=URdJWuMJ1CLqbkPvd5nR42RnPBwgNZLzdcd 0NE9UkDuaTLBc0DugLGW0DQtSDLwVcda0M0FVy==XtsmNtr=RwNcZNMohDLgdEPmdp4xQqiJ2VEz5EL1aM1kRwNcZNMohDLgdEPmdp4xQqmJ2VEz5EL1aM1kUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTE7UbI9U1TtcjTrfIPjhsOge0V=UxBl0xMfhC3cbTS=M snPG==M soN7==M snO7==M soOG==QTNodcMqhCHWaTvhXq==O gWcdNk0wooQxGpZUfiLSk7IdJ8dSkneUvnIz7jKFZngXB I9scK9sWeUZgb0TXKGueOnZ82EMwBx==J9Q7SN9lhAG=I9scK9su3U2bIsQcJq==Uw1T0NAveETnbz3igJK=LMNU0MEXhEjqbkzsdJbhjXCp2USz7DLAaM6k0MHcPSXkbDSdKj==I7==cS RewIrh02bLUKdN0GeRF==cTIZdm==ccxk0w0pSSNVZc0dgkObTDD2d6LY2KCp2UozRTG=MtsmNtrWQRi=MtsmNtrWQhG=MtsmNtrWQhK=MtsmNtrWQ0W=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice
Source: rapes.exe String found in binary or memory: net start termservice
Source: rapes.exe, 00000001.00000002.971269603.0000000000E41000.00000040.00000001.01000000.00000007.sdmp String found in binary or memory: net start termservice
Source: rapes.exe, 00000001.00000002.971269603.0000000000E41000.00000040.00000001.01000000.00000007.sdmp String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit seta131b127e996a898cd19ffb2d92e481b006700e5a2ab05704bbb0c589b88924d0921553d1dc176b36780331821e85866812981MJ5SM vtQw2sMQSrPj==LQXfPMklgFTVLZjr1JL2QsCffy==NIWoNG==UoSbcxLpJITieG==LINieG==YcAROJQf3kWVYN==ccxm0NDq3VfgUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMyMZVkZG==UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3WNEhggzOaDTpdFrEg7yb2VADUTJ8ddIXgy==UcNjYSTaJs0zMDHIRBjPKFZxQ8F8UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMycdNk0wooQxGbUxBl0TAdfVK=UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3VS9hfEubRj7p1JLwhB==JLNJSLAMYi7BSRvCLT==Xuxmdq==Uu1JWq==RQNKaMIWddEWcSIWbTEWYccWYNAWcwEWdMWWZwSWYNQWbxQWbS5Wc S=YTBb0sWgfEv3YZvmeFVigLyZYTBb0sWgfEu=YSpfdsWgfEu=Ztw=ZJw=ZJA=ZJE=TMxfc7==axJQdtfrPu==axJQdxD2Pw6=ZN bZwpiYSTacxEnbNFfecdmLTxRbMMWPwE+PwI+LRtieM5lflKqKokhIm==fq==JdNkbNH5PG==cS bcwnvQg3fbDu=aSNoccMoQxGpZDvpRSNQUcwWeVXgU0jwfJLrX16deu==UxBl0TAdfSPcdDD QLRrVRHcY07hdEbeepK=QNRfdcv=SSxpdwMug0r0IBve0j==RLFvWq==Uwxk0wvcY0TedUHmfKa=Rw1 ew0uMDbgYd==QLRxMpQmWw0W2UvOZTLYepbYjV==QcdQ0wMi3U3fZUG=Tc1oew0qUS1mbw0vQS1jcSIrVSdkSwMi3U3fZUG=MtwoNpHXRhaZON==ccA=dSA=QS1kewMqhAZPeUziQlrri1yRdVsl6kGwZc1ocISg2VPcOvzfd6Ls4LGphRRxEPQuLISjMIRpDGhtcSWW3U3VLRPme6rth7mRdU0yHfrnbTBjMMIdhEC2ID3edZK7NrS9gEvmHvrnaMpbccwp3RYdI7SARS0qhETpdzZRg0rjTnC9fFsw4TDidwdlc90r21PgdzZwfKzj311EFeRODGgjMIRpPQY=LISDD7==PTF d RtLchm0m==QS1kewMqhAZPeUziQlrfhMCjdUEl7Dbwb91UMN5ZhwZhb0HqN0LwgLWl100oSTG=URdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8QZ7qeKLY42KF1USpQBDwbNtRewMuXkDoZN==QS1jdxMW3VHJYTZiYMB 0wMi30fkajrpdZVthMGpf1I57k45eNgmNJzvRBSXNwe2NYY=LNNkbMEr3ESoURdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8VT3mfJLi0rmb2U0gJXZPVvBFUvoSWSPATYu=URdJWuMJ1CLqbkPvd5nR42RnPBwgNZLzdcd 0NE9UkDuaTLBc0DugLGW0DQtSDLwVcda0M0FVy==XtsmNtr=RwNcZNMohDLgdEPmdp4xQqiJ2VEz5EL1aM1kRwNcZNMohDLgdEPmdp4xQqmJ2VEz5EL1aM1kUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTE7UbI9U1TtcjTrfIPjhsOge0V=UxBl0xMfhC3cbTS=M snPG==M soN7==M snO7==M soOG==QTNodcMqhCHWaTvhXq==O gWcdNk0wooQxGpZUfiLSk7IdJ8dSkneUvnIz7jKFZngXB I9scK9sWeUZgb0TXKGueOnZ82EMwBx==J9Q7SN9lhAG=I9scK9su3U2bIsQcJq==Uw1T0NAveETnbz3igJK=LMNU0MEXhEjqbkzsdJbhjXCp2USz7DLAaM6k0MHcPSXkbDSdKj==I7==cS RewIrh02bLUKdN0GeRF==cTIZdm==ccxk0w0pSSNVZc0dgkObTDD2d6LY2KCp2UozRTG=MtsmNtrWQRi=MtsmNtrWQhG=MtsmNtrWQhK=MtsmNtrWQ0W=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice
Source: rapes.exe, 00000001.00000003.930944384.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: net start termservice
Source: rapes.exe, 00000001.00000003.930944384.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit seta131b127e996a898cd19ffb2d92e481b006700e5a2ab05704bbb0c589b88924d0921553d1dc176b36780331821e85866812981MJ5SM vtQw2sMQSrPj==LQXfPMklgFTVLZjr1JL2QsCffy==NIWoNG==UoSbcxLpJITieG==LINieG==YcAROJQf3kWVYN==ccxm0NDq3VfgUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMyMZVkZG==UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3WNEhggzOaDTpdFrEg7yb2VADUTJ8ddIXgy==UcNjYSTaJs0zMDHIRBjPKFZxQ8F8UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMycdNk0wooQxGbUxBl0TAdfVK=UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3VS9hfEubRj7p1JLwhB==JLNJSLAMYi7BSRvCLT==Xuxmdq==Uu1JWq==RQNKaMIWddEWcSIWbTEWYccWYNAWcwEWdMWWZwSWYNQWbxQWbS5Wc S=YTBb0sWgfEv3YZvmeFVigLyZYTBb0sWgfEu=YSpfdsWgfEu=Ztw=ZJw=ZJA=ZJE=TMxfc7==axJQdtfrPu==axJQdxD2Pw6=ZN bZwpiYSTacxEnbNFfecdmLTxRbMMWPwE+PwI+LRtieM5lflKqKokhIm==fq==JdNkbNH5PG==cS bcwnvQg3fbDu=aSNoccMoQxGpZDvpRSNQUcwWeVXgU0jwfJLrX16deu==UxBl0TAdfSPcdDD QLRrVRHcY07hdEbeepK=QNRfdcv=SSxpdwMug0r0IBve0j==RLFvWq==Uwxk0wvcY0TedUHmfKa=Rw1 ew0uMDbgYd==QLRxMpQmWw0W2UvOZTLYepbYjV==QcdQ0wMi3U3fZUG=Tc1oew0qUS1mbw0vQS1jcSIrVSdkSwMi3U3fZUG=MtwoNpHXRhaZON==ccA=dSA=QS1kewMqhAZPeUziQlrri1yRdVsl6kGwZc1ocISg2VPcOvzfd6Ls4LGphRRxEPQuLISjMIRpDGhtcSWW3U3VLRPme6rth7mRdU0yHfrnbTBjMMIdhEC2ID3edZK7NrS9gEvmHvrnaMpbccwp3RYdI7SARS0qhETpdzZRg0rjTnC9fFsw4TDidwdlc90r21PgdzZwfKzj311EFeRODGgjMIRpPQY=LISDD7==PTF d RtLchm0m==QS1kewMqhAZPeUziQlrfhMCjdUEl7Dbwb91UMN5ZhwZhb0HqN0LwgLWl100oSTG=URdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8QZ7qeKLY42KF1USpQBDwbNtRewMuXkDoZN==QS1jdxMW3VHJYTZiYMB 0wMi30fkajrpdZVthMGpf1I57k45eNgmNJzvRBSXNwe2NYY=LNNkbMEr3ESoURdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8VT3mfJLi0rmb2U0gJXZPVvBFUvoSWSPATYu=URdJWuMJ1CLqbkPvd5nR42RnPBwgNZLzdcd 0NE9UkDuaTLBc0DugLGW0DQtSDLwVcda0M0FVy==XtsmNtr=RwNcZNMohDLgdEPmdp4xQqiJ2VEz5EL1aM1kRwNcZNMohDLgdEPmdp4xQqmJ2VEz5EL1aM1kUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTE7UbI9U1TtcjTrfIPjhsOge0V=UxBl0xMfhC3cbTS=M snPG==M soN7==M snO7==M soOG==QTNodcMqhCHWaTvhXq==O gWcdNk0wooQxGpZUfiLSk7IdJ8dSkneUvnIz7jKFZngXB I9scK9sWeUZgb0TXKGueOnZ82EMwBx==J9Q7SN9lhAG=I9scK9su3U2bIsQcJq==Uw1T0NAveETnbz3igJK=LMNU0MEXhEjqbkzsdJbhjXCp2USz7DLAaM6k0MHcPSXkbDSdKj==I7==cS RewIrh02bLUKdN0GeRF==cTIZdm==ccxk0w0pSSNVZc0dgkObTDD2d6LY2KCp2UozRTG=MtsmNtrWQRi=MtsmNtrWQhG=MtsmNtrWQhK=MtsmNtrWQ0W=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice
Source: rapes.exe String found in binary or memory: net start termservice
Source: rapes.exe, 0000000A.00000003.1297610885.0000000004C90000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: net start termservice
Source: rapes.exe, 0000000A.00000003.1297610885.0000000004C90000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit seta131b127e996a898cd19ffb2d92e481b006700e5a2ab05704bbb0c589b88924d0921553d1dc176b36780331821e85866812981MJ5SM vtQw2sMQSrPj==LQXfPMklgFTVLZjr1JL2QsCffy==NIWoNG==UoSbcxLpJITieG==LINieG==YcAROJQf3kWVYN==ccxm0NDq3VfgUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMyMZVkZG==UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3WNEhggzOaDTpdFrEg7yb2VADUTJ8ddIXgy==UcNjYSTaJs0zMDHIRBjPKFZxQ8F8UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMycdNk0wooQxGbUxBl0TAdfVK=UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3VS9hfEubRj7p1JLwhB==JLNJSLAMYi7BSRvCLT==Xuxmdq==Uu1JWq==RQNKaMIWddEWcSIWbTEWYccWYNAWcwEWdMWWZwSWYNQWbxQWbS5Wc S=YTBb0sWgfEv3YZvmeFVigLyZYTBb0sWgfEu=YSpfdsWgfEu=Ztw=ZJw=ZJA=ZJE=TMxfc7==axJQdtfrPu==axJQdxD2Pw6=ZN bZwpiYSTacxEnbNFfecdmLTxRbMMWPwE+PwI+LRtieM5lflKqKokhIm==fq==JdNkbNH5PG==cS bcwnvQg3fbDu=aSNoccMoQxGpZDvpRSNQUcwWeVXgU0jwfJLrX16deu==UxBl0TAdfSPcdDD QLRrVRHcY07hdEbeepK=QNRfdcv=SSxpdwMug0r0IBve0j==RLFvWq==Uwxk0wvcY0TedUHmfKa=Rw1 ew0uMDbgYd==QLRxMpQmWw0W2UvOZTLYepbYjV==QcdQ0wMi3U3fZUG=Tc1oew0qUS1mbw0vQS1jcSIrVSdkSwMi3U3fZUG=MtwoNpHXRhaZON==ccA=dSA=QS1kewMqhAZPeUziQlrri1yRdVsl6kGwZc1ocISg2VPcOvzfd6Ls4LGphRRxEPQuLISjMIRpDGhtcSWW3U3VLRPme6rth7mRdU0yHfrnbTBjMMIdhEC2ID3edZK7NrS9gEvmHvrnaMpbccwp3RYdI7SARS0qhETpdzZRg0rjTnC9fFsw4TDidwdlc90r21PgdzZwfKzj311EFeRODGgjMIRpPQY=LISDD7==PTF d RtLchm0m==QS1kewMqhAZPeUziQlrfhMCjdUEl7Dbwb91UMN5ZhwZhb0HqN0LwgLWl100oSTG=URdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8QZ7qeKLY42KF1USpQBDwbNtRewMuXkDoZN==QS1jdxMW3VHJYTZiYMB 0wMi30fkajrpdZVthMGpf1I57k45eNgmNJzvRBSXNwe2NYY=LNNkbMEr3ESoURdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8VT3mfJLi0rmb2U0gJXZPVvBFUvoSWSPATYu=URdJWuMJ1CLqbkPvd5nR42RnPBwgNZLzdcd 0NE9UkDuaTLBc0DugLGW0DQtSDLwVcda0M0FVy==XtsmNtr=RwNcZNMohDLgdEPmdp4xQqiJ2VEz5EL1aM1kRwNcZNMohDLgdEPmdp4xQqmJ2VEz5EL1aM1kUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTE7UbI9U1TtcjTrfIPjhsOge0V=UxBl0xMfhC3cbTS=M snPG==M soN7==M snO7==M soOG==QTNodcMqhCHWaTvhXq==O gWcdNk0wooQxGpZUfiLSk7IdJ8dSkneUvnIz7jKFZngXB I9scK9sWeUZgb0TXKGueOnZ82EMwBx==J9Q7SN9lhAG=I9scK9su3U2bIsQcJq==Uw1T0NAveETnbz3igJK=LMNU0MEXhEjqbkzsdJbhjXCp2USz7DLAaM6k0MHcPSXkbDSdKj==I7==cS RewIrh02bLUKdN0GeRF==cTIZdm==ccxk0w0pSSNVZc0dgkObTDD2d6LY2KCp2UozRTG=MtsmNtrWQRi=MtsmNtrWQhG=MtsmNtrWQhK=MtsmNtrWQ0W=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice
Source: rapes.exe, 0000000A.00000002.3349572345.0000000000E41000.00000040.00000001.01000000.00000007.sdmp String found in binary or memory: net start termservice
Source: rapes.exe, 0000000A.00000002.3349572345.0000000000E41000.00000040.00000001.01000000.00000007.sdmp String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit seta131b127e996a898cd19ffb2d92e481b006700e5a2ab05704bbb0c589b88924d0921553d1dc176b36780331821e85866812981MJ5SM vtQw2sMQSrPj==LQXfPMklgFTVLZjr1JL2QsCffy==NIWoNG==UoSbcxLpJITieG==LINieG==YcAROJQf3kWVYN==ccxm0NDq3VfgUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMyMZVkZG==UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3WNEhggzOaDTpdFrEg7yb2VADUTJ8ddIXgy==UcNjYSTaJs0zMDHIRBjPKFZxQ8F8UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMycdNk0wooQxGbUxBl0TAdfVK=UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3VS9hfEubRj7p1JLwhB==JLNJSLAMYi7BSRvCLT==Xuxmdq==Uu1JWq==RQNKaMIWddEWcSIWbTEWYccWYNAWcwEWdMWWZwSWYNQWbxQWbS5Wc S=YTBb0sWgfEv3YZvmeFVigLyZYTBb0sWgfEu=YSpfdsWgfEu=Ztw=ZJw=ZJA=ZJE=TMxfc7==axJQdtfrPu==axJQdxD2Pw6=ZN bZwpiYSTacxEnbNFfecdmLTxRbMMWPwE+PwI+LRtieM5lflKqKokhIm==fq==JdNkbNH5PG==cS bcwnvQg3fbDu=aSNoccMoQxGpZDvpRSNQUcwWeVXgU0jwfJLrX16deu==UxBl0TAdfSPcdDD QLRrVRHcY07hdEbeepK=QNRfdcv=SSxpdwMug0r0IBve0j==RLFvWq==Uwxk0wvcY0TedUHmfKa=Rw1 ew0uMDbgYd==QLRxMpQmWw0W2UvOZTLYepbYjV==QcdQ0wMi3U3fZUG=Tc1oew0qUS1mbw0vQS1jcSIrVSdkSwMi3U3fZUG=MtwoNpHXRhaZON==ccA=dSA=QS1kewMqhAZPeUziQlrri1yRdVsl6kGwZc1ocISg2VPcOvzfd6Ls4LGphRRxEPQuLISjMIRpDGhtcSWW3U3VLRPme6rth7mRdU0yHfrnbTBjMMIdhEC2ID3edZK7NrS9gEvmHvrnaMpbccwp3RYdI7SARS0qhETpdzZRg0rjTnC9fFsw4TDidwdlc90r21PgdzZwfKzj311EFeRODGgjMIRpPQY=LISDD7==PTF d RtLchm0m==QS1kewMqhAZPeUziQlrfhMCjdUEl7Dbwb91UMN5ZhwZhb0HqN0LwgLWl100oSTG=URdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8QZ7qeKLY42KF1USpQBDwbNtRewMuXkDoZN==QS1jdxMW3VHJYTZiYMB 0wMi30fkajrpdZVthMGpf1I57k45eNgmNJzvRBSXNwe2NYY=LNNkbMEr3ESoURdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8VT3mfJLi0rmb2U0gJXZPVvBFUvoSWSPATYu=URdJWuMJ1CLqbkPvd5nR42RnPBwgNZLzdcd 0NE9UkDuaTLBc0DugLGW0DQtSDLwVcda0M0FVy==XtsmNtr=RwNcZNMohDLgdEPmdp4xQqiJ2VEz5EL1aM1kRwNcZNMohDLgdEPmdp4xQqmJ2VEz5EL1aM1kUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTE7UbI9U1TtcjTrfIPjhsOge0V=UxBl0xMfhC3cbTS=M snPG==M soN7==M snO7==M soOG==QTNodcMqhCHWaTvhXq==O gWcdNk0wooQxGpZUfiLSk7IdJ8dSkneUvnIz7jKFZngXB I9scK9sWeUZgb0TXKGueOnZ82EMwBx==J9Q7SN9lhAG=I9scK9su3U2bIsQcJq==Uw1T0NAveETnbz3igJK=LMNU0MEXhEjqbkzsdJbhjXCp2USz7DLAaM6k0MHcPSXkbDSdKj==I7==cS RewIrh02bLUKdN0GeRF==cTIZdm==ccxk0w0pSSNVZc0dgkObTDD2d6LY2KCp2UozRTG=MtsmNtrWQRi=MtsmNtrWQhG=MtsmNtrWQhK=MtsmNtrWQ0W=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice
windows-stand
Behavior
Click here to start
Slideshow Behavior Animation
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1646788 Sample: 5yCKVE324w.exe Startdate: 24/03/2025 Architecture: WINDOWS Score: 100 22 Found malware configuration 2->22 24 Antivirus detection for URL or domain 2->24 26 Antivirus / Scanner detection for submitted sample 2->26 28 8 other signatures 2->28 6 5yCKVE324w.exe 5 2->6         started        10 rapes.exe 12 2->10         started        process3 dnsIp4 16 C:\Users\user\AppData\Local\...\rapes.exe, PE32 6->16 dropped 18 C:\Users\user\...\rapes.exe:Zone.Identifier, ASCII 6->18 dropped 30 Detected unpacking (changes PE section rights) 6->30 32 Contains functionality to start a terminal service 6->32 34 Tries to evade debugger and weak emulator (self modifying code) 6->34 36 Tries to detect virtualization through RDTSC time measurements 6->36 13 rapes.exe 6->13         started        20 176.113.115.6, 80 SELECTELRU Russian Federation 10->20 38 Hides threads from debuggers 10->38 40 Tries to detect sandboxes / dynamic malware analysis system (registry check) 10->40 42 Tries to detect process monitoring tools (Task Manager, Process Explorer etc.) 10->42 file5 signatures6 process7 signatures8 44 Antivirus detection for dropped file 13->44 46 Multi AV Scanner detection for dropped file 13->46 48 Detected unpacking (changes PE section rights) 13->48 50 6 other signatures 13->50
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
176.113.115.6
 unknown Russian Federation
49505 SELECTELRU true