Windows Analysis Report
LisectAVT_2403002A_163.exe

Overview

General Information

Sample name: LisectAVT_2403002A_163.exe
Analysis ID: 1482474
MD5: a472afb64b5c6f61ac63639fbd778001
SHA1: def8afce906aa4094c8a564ae9b9c886955c16b3
SHA256: 9582e561631b18bad3ef23b24a57636ef1d48b05535962dc0b19ab27e9351276
Tags: exe
Infos:

Detection

RisePro Stealer
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Detected unpacking (changes PE section rights)
Yara detected RisePro Stealer
AI detected suspicious sample
Connects to many ports of the same IP (likely port scanning)
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
Hides threads from debuggers
Machine Learning detection for dropped file
Machine Learning detection for sample
PE file contains section with special chars
Potentially malicious time measurement code found
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Uses schtasks.exe or at.exe to add and modify task schedules
Abnormal high CPU Usage
Checks for debuggers (devices)
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to read the PEB
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Entry point lies outside standard sections
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains an invalid checksum
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: CurrentVersion Autorun Keys Modification
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: LisectAVT_2403002A_163.exe Avira: detected
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Joe Sandbox ML: detected
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: LisectAVT_2403002A_163.exe Joe Sandbox ML: detected
Uses 32bit PE files
Source: LisectAVT_2403002A_163.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Networking
barindex
Connects to many ports of the same IP (likely port scanning)
Source: global traffic TCP traffic: 193.233.132.74 ports 0,5,7,8,58709,9
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.5:49704 -> 193.233.132.74:58709
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 193.233.132.74 193.233.132.74
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: FREE-NET-ASFREEnetEU FREE-NET-ASFREEnetEU
Source: unknown TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe Code function: 0_2_0003E0A0 recv,setsockopt,WSAStartup,closesocket,socket,connect,closesocket, 0_2_0003E0A0
Source: LisectAVT_2403002A_163.exe, 00000000.00000002.4496519840.0000000000021000.00000040.00000001.01000000.00000003.sdmp, LisectAVT_2403002A_163.exe, 00000000.00000003.2036461002.0000000004A10000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2098792181.00000000052C0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.4496522566.00000000001D1000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000007.00000002.4496541525.00000000001D1000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000007.00000003.2097834723.0000000004AA0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.2174447764.0000000004A00000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.4496594215.0000000000131000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 0000000A.00000002.4496595662.0000000000131000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 0000000A.00000003.2257587629.0000000004E30000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.winimage.com/zLibDll
Source: LisectAVT_2403002A_163.exe, 00000000.00000002.4496519840.0000000000021000.00000040.00000001.01000000.00000003.sdmp, LisectAVT_2403002A_163.exe, 00000000.00000003.2036461002.0000000004A10000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2098792181.00000000052C0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.4496522566.00000000001D1000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000007.00000002.4496541525.00000000001D1000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000007.00000003.2097834723.0000000004AA0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.2174447764.0000000004A00000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.4496594215.0000000000131000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 0000000A.00000002.4496595662.0000000000131000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 0000000A.00000003.2257587629.0000000004E30000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll
Source: LisectAVT_2403002A_163.exe, 00000000.00000002.4499442748.0000000000E7E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.4499466734.00000000015BD000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.4499103991.0000000000BEA000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.4498783291.0000000000B3E000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000002.4499262309.00000000011AB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t.me/RiseProSUPPORT

System Summary
barindex
PE file contains section with special chars
Source: LisectAVT_2403002A_163.exe Static PE information: section name:
Source: LisectAVT_2403002A_163.exe Static PE information: section name: .idata
Source: LisectAVT_2403002A_163.exe Static PE information: section name:
Source: RageMP131.exe.0.dr Static PE information: section name:
Source: RageMP131.exe.0.dr Static PE information: section name: .idata
Source: RageMP131.exe.0.dr Static PE information: section name:
Source: MPGPH131.exe.0.dr Static PE information: section name:
Source: MPGPH131.exe.0.dr Static PE information: section name: .idata
Source: MPGPH131.exe.0.dr Static PE information: section name:
Abnormal high CPU Usage
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe Process Stats: CPU usage > 49%
Detected potential crypto function
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe Code function: 0_2_00119824 0_2_00119824
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe Code function: 0_2_000A9880 0_2_000A9880
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe Code function: 0_2_000950B0 0_2_000950B0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe Code function: 0_2_000291A0 0_2_000291A0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe Code function: 0_2_000973F0 0_2_000973F0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe Code function: 0_2_0010646A 0_2_0010646A
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe Code function: 0_2_001084A0 0_2_001084A0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe Code function: 0_2_00102CE0 0_2_00102CE0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe Code function: 0_2_000224F0 0_2_000224F0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe Code function: 0_2_000A6550 0_2_000A6550
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe Code function: 0_2_00028D70 0_2_00028D70
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe Code function: 0_2_000A55B0 0_2_000A55B0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe Code function: 0_2_0010BEAF 0_2_0010BEAF
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe Code function: 0_2_00039F50 0_2_00039F50
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 6_2_002C9824 6_2_002C9824
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 6_2_002450B0 6_2_002450B0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 6_2_00259880 6_2_00259880
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 6_2_001D91A0 6_2_001D91A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 6_2_002473F0 6_2_002473F0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 6_2_002B646A 6_2_002B646A
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 6_2_002B84A0 6_2_002B84A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 6_2_002B2CE0 6_2_002B2CE0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 6_2_001D24F0 6_2_001D24F0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 6_2_001D8D70 6_2_001D8D70
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 6_2_00256550 6_2_00256550
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 6_2_002555B0 6_2_002555B0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 6_2_002BBEAF 6_2_002BBEAF
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 6_2_001E9F50 6_2_001E9F50
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 6_2_002CF771 6_2_002CF771
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 7_2_002C9824 7_2_002C9824
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 7_2_002450B0 7_2_002450B0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 7_2_00259880 7_2_00259880
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 7_2_001D91A0 7_2_001D91A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 7_2_002473F0 7_2_002473F0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 7_2_002B646A 7_2_002B646A
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 7_2_002B84A0 7_2_002B84A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 7_2_002B2CE0 7_2_002B2CE0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 7_2_001D24F0 7_2_001D24F0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 7_2_001D8D70 7_2_001D8D70
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 7_2_00256550 7_2_00256550
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 7_2_002555B0 7_2_002555B0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 7_2_002BBEAF 7_2_002BBEAF
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 7_2_001E9F50 7_2_001E9F50
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 7_2_002CF771 7_2_002CF771
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Code function: 8_2_00229824 8_2_00229824
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Code function: 8_2_001B9880 8_2_001B9880
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Code function: 8_2_001A50B0 8_2_001A50B0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Code function: 8_2_001391A0 8_2_001391A0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Code function: 8_2_001A73F0 8_2_001A73F0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Code function: 8_2_0021646A 8_2_0021646A
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Code function: 8_2_002184A0 8_2_002184A0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Code function: 8_2_00212CE0 8_2_00212CE0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Code function: 8_2_001324F0 8_2_001324F0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Code function: 8_2_001B6550 8_2_001B6550
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Code function: 8_2_00138D70 8_2_00138D70
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Code function: 8_2_001B55B0 8_2_001B55B0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Code function: 8_2_0021BEAF 8_2_0021BEAF
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Code function: 8_2_00149F50 8_2_00149F50
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Code function: 8_2_0022F771 8_2_0022F771
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Code function: 10_2_00229824 10_2_00229824
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Code function: 10_2_001B9880 10_2_001B9880
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Code function: 10_2_001A50B0 10_2_001A50B0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Code function: 10_2_001391A0 10_2_001391A0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Code function: 10_2_001A73F0 10_2_001A73F0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Code function: 10_2_0021646A 10_2_0021646A
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Code function: 10_2_002184A0 10_2_002184A0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Code function: 10_2_00212CE0 10_2_00212CE0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Code function: 10_2_001324F0 10_2_001324F0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Code function: 10_2_001B6550 10_2_001B6550
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Code function: 10_2_00138D70 10_2_00138D70
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Code function: 10_2_001B55B0 10_2_001B55B0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Code function: 10_2_0021BEAF 10_2_0021BEAF
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Code function: 10_2_00149F50 10_2_00149F50
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Code function: 10_2_0022F771 10_2_0022F771
Found potential string decryption / allocating functions
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: String function: 002AFED0 appears 52 times
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Code function: String function: 0020FED0 appears 52 times
Sample file is different than original file name gathered from version info
Source: LisectAVT_2403002A_163.exe, 00000000.00000002.4496955708.0000000000158000.00000004.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenamefilezilla.exe4 vs LisectAVT_2403002A_163.exe
Source: LisectAVT_2403002A_163.exe, 00000000.00000002.4499034537.0000000000C90000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamefilezilla.exe4 vs LisectAVT_2403002A_163.exe
Source: LisectAVT_2403002A_163.exe Binary or memory string: OriginalFilenamefilezilla.exe4 vs LisectAVT_2403002A_163.exe
Uses 32bit PE files
Source: LisectAVT_2403002A_163.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: LisectAVT_2403002A_163.exe Static PE information: Section: ZLIB complexity 0.9988822375541125
Source: LisectAVT_2403002A_163.exe Static PE information: Section: jgtpuhbl ZLIB complexity 0.9899673103726526
Source: RageMP131.exe.0.dr Static PE information: Section: ZLIB complexity 0.9988822375541125
Source: RageMP131.exe.0.dr Static PE information: Section: jgtpuhbl ZLIB complexity 0.9899673103726526
Source: MPGPH131.exe.0.dr Static PE information: Section: ZLIB complexity 0.9988822375541125
Source: MPGPH131.exe.0.dr Static PE information: Section: jgtpuhbl ZLIB complexity 0.9899673103726526
Source: classification engine Classification label: mal100.troj.evad.winEXE@11/5@0/1
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe File created: C:\Users\user\AppData\Local\RageMP131 Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2380:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5800:120:WilError_03
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe File created: C:\Users\user\AppData\Local\Temp\rage131MP.tmp Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Command line argument: nI- 6_2_002D48C0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Command line argument: nI- 7_2_002D48C0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Command line argument: nI# 8_2_002348C0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Command line argument: nI# 10_2_002348C0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: LisectAVT_2403002A_163.exe, 00000000.00000002.4496519840.0000000000021000.00000040.00000001.01000000.00000003.sdmp, LisectAVT_2403002A_163.exe, 00000000.00000003.2036461002.0000000004A10000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2098792181.00000000052C0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.4496522566.00000000001D1000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000007.00000002.4496541525.00000000001D1000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000007.00000003.2097834723.0000000004AA0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.2174447764.0000000004A00000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.4496594215.0000000000131000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 0000000A.00000002.4496595662.0000000000131000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 0000000A.00000003.2257587629.0000000004E30000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: LisectAVT_2403002A_163.exe, 00000000.00000002.4496519840.0000000000021000.00000040.00000001.01000000.00000003.sdmp, LisectAVT_2403002A_163.exe, 00000000.00000003.2036461002.0000000004A10000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2098792181.00000000052C0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.4496522566.00000000001D1000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000007.00000002.4496541525.00000000001D1000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000007.00000003.2097834723.0000000004AA0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.2174447764.0000000004A00000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.4496594215.0000000000131000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 0000000A.00000002.4496595662.0000000000131000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 0000000A.00000003.2257587629.0000000004E30000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q), tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
Source: LisectAVT_2403002A_163.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: MPGPH131.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: MPGPH131.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: RageMP131.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: RageMP131.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe File read: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe "C:\Users\user\Desktop\LisectAVT_2403002A_163.exe"
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\ProgramData\MPGPH131\MPGPH131.exe C:\ProgramData\MPGPH131\MPGPH131.exe
Source: unknown Process created: C:\ProgramData\MPGPH131\MPGPH131.exe C:\ProgramData\MPGPH131\MPGPH131.exe
Source: unknown Process created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe Section loaded: rstrtmgr.dll Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe Section loaded: devobj.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: winmm.dll Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: rstrtmgr.dll Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: wininet.dll Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: devobj.dll Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: winmm.dll Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: rstrtmgr.dll Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: wininet.dll Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: devobj.dll Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: rstrtmgr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: devobj.dll Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: rstrtmgr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: devobj.dll Jump to behavior
Source: LisectAVT_2403002A_163.exe Static file information: File size 2345480 > 1048576
Source: LisectAVT_2403002A_163.exe Static PE information: Raw size of jgtpuhbl is bigger than: 0x100000 < 0x1aa000

Data Obfuscation
barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe Unpacked PE file: 0.2.LisectAVT_2403002A_163.exe.20000.0.unpack :EW;.rsrc:W;.idata :W; :EW;jgtpuhbl:EW;ikxokzqh:EW; vs :ER;.rsrc:W;.idata :W; :EW;jgtpuhbl:EW;ikxokzqh:EW;
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Unpacked PE file: 6.2.MPGPH131.exe.1d0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;jgtpuhbl:EW;ikxokzqh:EW; vs :ER;.rsrc:W;.idata :W; :EW;jgtpuhbl:EW;ikxokzqh:EW;
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Unpacked PE file: 7.2.MPGPH131.exe.1d0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;jgtpuhbl:EW;ikxokzqh:EW; vs :ER;.rsrc:W;.idata :W; :EW;jgtpuhbl:EW;ikxokzqh:EW;
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Unpacked PE file: 8.2.RageMP131.exe.130000.0.unpack :EW;.rsrc:W;.idata :W; :EW;jgtpuhbl:EW;ikxokzqh:EW; vs :ER;.rsrc:W;.idata :W; :EW;jgtpuhbl:EW;ikxokzqh:EW;
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Unpacked PE file: 10.2.RageMP131.exe.130000.0.unpack :EW;.rsrc:W;.idata :W; :EW;jgtpuhbl:EW;ikxokzqh:EW; vs :ER;.rsrc:W;.idata :W; :EW;jgtpuhbl:EW;ikxokzqh:EW;
Entry point lies outside standard sections
Source: initial sample Static PE information: section where entry point is pointing to: ikxokzqh
PE file contains an invalid checksum
Source: LisectAVT_2403002A_163.exe Static PE information: real checksum: 0x242f5b should be: 0x242f63
Source: RageMP131.exe.0.dr Static PE information: real checksum: 0x242f5b should be: 0x242f63
Source: MPGPH131.exe.0.dr Static PE information: real checksum: 0x242f5b should be: 0x242f63
PE file contains sections with non-standard names
Source: LisectAVT_2403002A_163.exe Static PE information: section name:
Source: LisectAVT_2403002A_163.exe Static PE information: section name: .idata
Source: LisectAVT_2403002A_163.exe Static PE information: section name:
Source: LisectAVT_2403002A_163.exe Static PE information: section name: jgtpuhbl
Source: LisectAVT_2403002A_163.exe Static PE information: section name: ikxokzqh
Source: RageMP131.exe.0.dr Static PE information: section name:
Source: RageMP131.exe.0.dr Static PE information: section name: .idata
Source: RageMP131.exe.0.dr Static PE information: section name:
Source: RageMP131.exe.0.dr Static PE information: section name: jgtpuhbl
Source: RageMP131.exe.0.dr Static PE information: section name: ikxokzqh
Source: MPGPH131.exe.0.dr Static PE information: section name:
Source: MPGPH131.exe.0.dr Static PE information: section name: .idata
Source: MPGPH131.exe.0.dr Static PE information: section name:
Source: MPGPH131.exe.0.dr Static PE information: section name: jgtpuhbl
Source: MPGPH131.exe.0.dr Static PE information: section name: ikxokzqh
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe Code function: 0_2_005C904D push ebp; mov dword ptr [esp], 3FDD6DE1h 0_2_005C9113
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe Code function: 0_2_005C904D push 384CB050h; mov dword ptr [esp], ebx 0_2_005C9149
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe Code function: 0_2_005C904D push 5C863602h; mov dword ptr [esp], ebx 0_2_005C918C
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe Code function: 0_2_005C904D push 05098334h; mov dword ptr [esp], esi 0_2_005C91BA
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe Code function: 0_2_005C9000 push edi; mov dword ptr [esp], 53F78224h 0_2_005C9001
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe Code function: 0_2_005C9000 push edi; mov dword ptr [esp], edx 0_2_005C9041
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe Code function: 0_2_005C9000 push ebp; mov dword ptr [esp], 3FDD6DE1h 0_2_005C9113
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe Code function: 0_2_005C9000 push 384CB050h; mov dword ptr [esp], ebx 0_2_005C9149
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe Code function: 0_2_005C9000 push 5C863602h; mov dword ptr [esp], ebx 0_2_005C918C
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe Code function: 0_2_005C9000 push 05098334h; mov dword ptr [esp], esi 0_2_005C91BA
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe Code function: 0_2_005C91CD push 491E841Dh; mov dword ptr [esp], eax 0_2_005C91F3
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe Code function: 0_2_005C91CD push esi; mov dword ptr [esp], eax 0_2_005C92D1
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe Code function: 0_2_005C91CD push edi; mov dword ptr [esp], eax 0_2_005C92FA
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe Code function: 0_2_000FFA97 push ecx; ret 0_2_000FFAAA
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 6_2_0077904D push ebp; mov dword ptr [esp], 3FDD6DE1h 6_2_00779113
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 6_2_0077904D push 384CB050h; mov dword ptr [esp], ebx 6_2_00779149
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 6_2_0077904D push 5C863602h; mov dword ptr [esp], ebx 6_2_0077918C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 6_2_0077904D push 05098334h; mov dword ptr [esp], esi 6_2_007791BA
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 6_2_00779000 push edi; mov dword ptr [esp], 53F78224h 6_2_00779001
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 6_2_00779000 push edi; mov dword ptr [esp], edx 6_2_00779041
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 6_2_00779000 push ebp; mov dword ptr [esp], 3FDD6DE1h 6_2_00779113
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 6_2_00779000 push 384CB050h; mov dword ptr [esp], ebx 6_2_00779149
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 6_2_00779000 push 5C863602h; mov dword ptr [esp], ebx 6_2_0077918C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 6_2_00779000 push 05098334h; mov dword ptr [esp], esi 6_2_007791BA
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 6_2_007791CD push 491E841Dh; mov dword ptr [esp], eax 6_2_007791F3
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 6_2_007791CD push esi; mov dword ptr [esp], eax 6_2_007792D1
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 6_2_007791CD push edi; mov dword ptr [esp], eax 6_2_007792FA
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 6_2_002AFA97 push ecx; ret 6_2_002AFAAA
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 7_2_0077904D push ebp; mov dword ptr [esp], 3FDD6DE1h 7_2_00779113
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 7_2_0077904D push 384CB050h; mov dword ptr [esp], ebx 7_2_00779149
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 7_2_0077904D push 5C863602h; mov dword ptr [esp], ebx 7_2_0077918C
Source: LisectAVT_2403002A_163.exe Static PE information: section name: entropy: 7.977067116075123
Source: LisectAVT_2403002A_163.exe Static PE information: section name: jgtpuhbl entropy: 7.950675403597083
Source: RageMP131.exe.0.dr Static PE information: section name: entropy: 7.977067116075123
Source: RageMP131.exe.0.dr Static PE information: section name: jgtpuhbl entropy: 7.950675403597083
Source: MPGPH131.exe.0.dr Static PE information: section name: entropy: 7.977067116075123
Source: MPGPH131.exe.0.dr Static PE information: section name: jgtpuhbl entropy: 7.950675403597083
Drops PE files
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe File created: C:\ProgramData\MPGPH131\MPGPH131.exe Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe File created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Jump to dropped file
Drops PE files to the application program directory (C:\ProgramData)
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe File created: C:\ProgramData\MPGPH131\MPGPH131.exe Jump to dropped file

Boot Survival
barindex
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe Window searched: window name: Filemonclass Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Window searched: window name: Filemonclass Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Window searched: window name: Filemonclass Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Window searched: window name: Filemonclass Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Window searched: window name: Filemonclass Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Window searched: window name: Regmonclass Jump to behavior
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131 Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131 Jump to behavior

Malware Analysis System Evasion
barindex
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Evasive API call chain: GetPEB, DecisionNodes, Sleep
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Evasive API call chain: GetPEB, DecisionNodes, Sleep
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe Evasive API call chain: GetPEB, DecisionNodes, Sleep
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 1602B5 second address: 1602BF instructions: 0x00000000 rdtsc 0x00000002 jno 00007FFBA56586D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 1602BF second address: 1602C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 2E531E second address: 2E5324 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 2E5324 second address: 2E5339 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 jmp 00007FFBA4B43D9Bh 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 2E44EF second address: 2E44F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 2E44F4 second address: 2E44FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 2E44FA second address: 2E4500 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 2E4684 second address: 2E468E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 2E4A9D second address: 2E4AB9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA56586DEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jp 00007FFBA56586D6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 2E4AB9 second address: 2E4AD4 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007FFBA4B43DA5h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 2E4AD4 second address: 2E4ADE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007FFBA56586D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 2DAEE6 second address: 2DAEFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 jmp 00007FFBA4B43D9Dh 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 2E82BD second address: 2E82D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FFBA56586E5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 2E82D6 second address: 2E82DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 2E82DA second address: 2E82F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FFBA56586E4h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 2E82F9 second address: 2E8328 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007FFBA4B43D96h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 push ecx 0x00000013 push eax 0x00000014 pushad 0x00000015 popad 0x00000016 pop eax 0x00000017 pop ecx 0x00000018 mov eax, dword ptr [eax] 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d jp 00007FFBA4B43D96h 0x00000023 jmp 00007FFBA4B43D9Bh 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 2E839E second address: 2E83A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 2E83A4 second address: 2E83A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 2E84F4 second address: 2E84FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 2E84FA second address: 2E84FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 2E84FE second address: 2E854C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push edi 0x0000000c call 00007FFBA56586D8h 0x00000011 pop edi 0x00000012 mov dword ptr [esp+04h], edi 0x00000016 add dword ptr [esp+04h], 0000001Ch 0x0000001e inc edi 0x0000001f push edi 0x00000020 ret 0x00000021 pop edi 0x00000022 ret 0x00000023 mov dx, 734Fh 0x00000027 mov dword ptr [ebp+122D1936h], edx 0x0000002d push 00000000h 0x0000002f mov dword ptr [ebp+122D21C3h], edi 0x00000035 push D79DC504h 0x0000003a push eax 0x0000003b push edx 0x0000003c js 00007FFBA56586D8h 0x00000042 pushad 0x00000043 popad 0x00000044 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 2E854C second address: 2E85B8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 add dword ptr [esp], 28623B7Ch 0x0000000f push 00000000h 0x00000011 push ebx 0x00000012 call 00007FFBA4B43D98h 0x00000017 pop ebx 0x00000018 mov dword ptr [esp+04h], ebx 0x0000001c add dword ptr [esp+04h], 0000001Bh 0x00000024 inc ebx 0x00000025 push ebx 0x00000026 ret 0x00000027 pop ebx 0x00000028 ret 0x00000029 and edi, dword ptr [ebp+122D227Fh] 0x0000002f push 00000003h 0x00000031 push ecx 0x00000032 mov cx, 6852h 0x00000036 pop edi 0x00000037 xor dword ptr [ebp+122D182Ah], ecx 0x0000003d push 00000000h 0x0000003f jmp 00007FFBA4B43DA2h 0x00000044 push 00000003h 0x00000046 or edi, dword ptr [ebp+122D38F2h] 0x0000004c push A696F425h 0x00000051 pushad 0x00000052 push eax 0x00000053 push edx 0x00000054 push ebx 0x00000055 pop ebx 0x00000056 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 2E85B8 second address: 2E85CE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA56586DEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 2E85CE second address: 2E8600 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xor dword ptr [esp], 6696F425h 0x0000000e mov edx, esi 0x00000010 lea ebx, dword ptr [ebp+1245C21Ch] 0x00000016 jmp 00007FFBA4B43DA6h 0x0000001b push eax 0x0000001c push eax 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 2E8600 second address: 2E8604 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 309BBC second address: 309BC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 307A46 second address: 307A51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push ebx 0x00000006 pushad 0x00000007 popad 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 307A51 second address: 307A59 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 307A59 second address: 307A9D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007FFBA56586E7h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push esi 0x0000000e jmp 00007FFBA56586DEh 0x00000013 pushad 0x00000014 jmp 00007FFBA56586E3h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 307A9D second address: 307AA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FFBA4B43D96h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 307C24 second address: 307C31 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FFBA56586D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 308188 second address: 308192 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FFBA4B43D96h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 308192 second address: 308198 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 308198 second address: 3081B0 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007FFBA4B43D9Eh 0x00000008 pushad 0x00000009 popad 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3081B0 second address: 3081BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FFBA56586D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3089B6 second address: 3089D8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA4B43DA6h 0x00000007 push eax 0x00000008 push edx 0x00000009 jg 00007FFBA4B43D96h 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3089D8 second address: 3089DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3089DC second address: 3089E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 308B10 second address: 308B14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 308B14 second address: 308B18 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 308B18 second address: 308B1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 2FFC5A second address: 2FFC78 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FFBA4B43DA0h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push esi 0x00000010 pop esi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 2FFC78 second address: 2FFC7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3093F8 second address: 309408 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop ebx 0x00000007 jg 00007FFBA4B43D9Eh 0x0000000d push ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 309542 second address: 309546 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 309546 second address: 30954A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 30954A second address: 309578 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFBA56586DDh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FFBA56586E3h 0x00000010 push eax 0x00000011 push edx 0x00000012 jng 00007FFBA56586D6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 309578 second address: 309584 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 309584 second address: 30959A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FFBA56586D6h 0x0000000a jmp 00007FFBA56586DBh 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 30959A second address: 3095B6 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007FFBA4B43DA7h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 30AFBC second address: 30AFC6 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FFBA56586D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 30AFC6 second address: 30AFCB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 30BF94 second address: 30BF9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 2D28D4 second address: 2D28E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FFBA4B43D96h 0x0000000a pushad 0x0000000b popad 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e popad 0x0000000f push edi 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 2D28E8 second address: 2D28ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 315180 second address: 315191 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FFBA4B43D96h 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 315191 second address: 315195 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 315195 second address: 31519B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 31519B second address: 3151A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pop edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3151A7 second address: 3151AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3151AD second address: 3151B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FFBA56586D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 31455C second address: 314561 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 314561 second address: 3145A1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FFBA56586E9h 0x0000000a jmp 00007FFBA56586E5h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 jnl 00007FFBA56586D6h 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3145A1 second address: 3145BB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA4B43D9Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3145BB second address: 3145C0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3145C0 second address: 3145C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3145C6 second address: 3145CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 314701 second address: 314712 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007FFBA4B43D96h 0x00000009 jng 00007FFBA4B43D96h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 31482C second address: 314831 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 31497C second address: 3149CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007FFBA4B43DA9h 0x0000000c pop edi 0x0000000d push eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 pushad 0x00000011 popad 0x00000012 jmp 00007FFBA4B43DA1h 0x00000017 pop ecx 0x00000018 jmp 00007FFBA4B43DA9h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 314FF9 second address: 315001 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3170EF second address: 317101 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007FFBA4B43D9Ch 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 31715F second address: 31717B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA56586E8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 317574 second address: 317579 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 31765D second address: 317686 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jg 00007FFBA56586D6h 0x00000009 jmp 00007FFBA56586E6h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 317D18 second address: 317D1E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 317DF0 second address: 317DF4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3186DE second address: 318767 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FFBA4B43D9Eh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d nop 0x0000000e cmc 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push eax 0x00000014 call 00007FFBA4B43D98h 0x00000019 pop eax 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e add dword ptr [esp+04h], 0000001Ah 0x00000026 inc eax 0x00000027 push eax 0x00000028 ret 0x00000029 pop eax 0x0000002a ret 0x0000002b mov dword ptr [ebp+122D29BFh], esi 0x00000031 pushad 0x00000032 mov dword ptr [ebp+122D1A60h], eax 0x00000038 mov dword ptr [ebp+122D277Bh], ebx 0x0000003e popad 0x0000003f push 00000000h 0x00000041 add dword ptr [ebp+122D22E1h], ecx 0x00000047 push eax 0x00000048 pushad 0x00000049 pushad 0x0000004a jnl 00007FFBA4B43D96h 0x00000050 jmp 00007FFBA4B43D9Ch 0x00000055 popad 0x00000056 push eax 0x00000057 push edx 0x00000058 jmp 00007FFBA4B43DA9h 0x0000005d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 2CA1C7 second address: 2CA21B instructions: 0x00000000 rdtsc 0x00000002 jc 00007FFBA56586D6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007FFBA56586E2h 0x00000012 pushad 0x00000013 popad 0x00000014 jmp 00007FFBA56586DDh 0x00000019 popad 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d jg 00007FFBA56586E2h 0x00000023 pushad 0x00000024 jo 00007FFBA56586D6h 0x0000002a jnc 00007FFBA56586D6h 0x00000030 push esi 0x00000031 pop esi 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 319018 second address: 319025 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 31A851 second address: 31A855 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 31B8FF second address: 31B95F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 mov dword ptr [esp], eax 0x0000000a push eax 0x0000000b mov esi, 48738222h 0x00000010 pop esi 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push ebp 0x00000016 call 00007FFBA4B43D98h 0x0000001b pop ebp 0x0000001c mov dword ptr [esp+04h], ebp 0x00000020 add dword ptr [esp+04h], 0000001Ch 0x00000028 inc ebp 0x00000029 push ebp 0x0000002a ret 0x0000002b pop ebp 0x0000002c ret 0x0000002d mov esi, dword ptr [ebp+122D3966h] 0x00000033 mov di, dx 0x00000036 push 00000000h 0x00000038 mov si, 765Ch 0x0000003c push eax 0x0000003d pushad 0x0000003e push eax 0x0000003f push edx 0x00000040 jmp 00007FFBA4B43DA6h 0x00000045 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 31B038 second address: 31B041 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 31B041 second address: 31B045 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 31C3A5 second address: 31C3BC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA56586E3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 31E3AD second address: 31E420 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edi 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push ebp 0x0000000a call 00007FFBA4B43D98h 0x0000000f pop ebp 0x00000010 mov dword ptr [esp+04h], ebp 0x00000014 add dword ptr [esp+04h], 00000016h 0x0000001c inc ebp 0x0000001d push ebp 0x0000001e ret 0x0000001f pop ebp 0x00000020 ret 0x00000021 jno 00007FFBA4B43D9Ch 0x00000027 push 00000000h 0x00000029 push 00000000h 0x0000002b push eax 0x0000002c call 00007FFBA4B43D98h 0x00000031 pop eax 0x00000032 mov dword ptr [esp+04h], eax 0x00000036 add dword ptr [esp+04h], 0000001Ah 0x0000003e inc eax 0x0000003f push eax 0x00000040 ret 0x00000041 pop eax 0x00000042 ret 0x00000043 movsx edi, ax 0x00000046 push 00000000h 0x00000048 mov edi, dword ptr [ebp+122D3942h] 0x0000004e xchg eax, ebx 0x0000004f push eax 0x00000050 push edx 0x00000051 push ebx 0x00000052 jmp 00007FFBA4B43D9Eh 0x00000057 pop ebx 0x00000058 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 31EF14 second address: 31EF18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 31EF18 second address: 31EF52 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push ebp 0x0000000d call 00007FFBA4B43D98h 0x00000012 pop ebp 0x00000013 mov dword ptr [esp+04h], ebp 0x00000017 add dword ptr [esp+04h], 00000014h 0x0000001f inc ebp 0x00000020 push ebp 0x00000021 ret 0x00000022 pop ebp 0x00000023 ret 0x00000024 push 00000000h 0x00000026 mov si, FE8Ah 0x0000002a push 00000000h 0x0000002c jl 00007FFBA4B43D97h 0x00000032 cmc 0x00000033 push eax 0x00000034 push esi 0x00000035 pushad 0x00000036 push eax 0x00000037 push edx 0x00000038 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 323B39 second address: 323B3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 324A14 second address: 324A1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 324A1D second address: 324AB9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA56586E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push edi 0x0000000e call 00007FFBA56586D8h 0x00000013 pop edi 0x00000014 mov dword ptr [esp+04h], edi 0x00000018 add dword ptr [esp+04h], 00000015h 0x00000020 inc edi 0x00000021 push edi 0x00000022 ret 0x00000023 pop edi 0x00000024 ret 0x00000025 jmp 00007FFBA56586E0h 0x0000002a push 00000000h 0x0000002c push 00000000h 0x0000002e push edx 0x0000002f call 00007FFBA56586D8h 0x00000034 pop edx 0x00000035 mov dword ptr [esp+04h], edx 0x00000039 add dword ptr [esp+04h], 00000014h 0x00000041 inc edx 0x00000042 push edx 0x00000043 ret 0x00000044 pop edx 0x00000045 ret 0x00000046 jmp 00007FFBA56586DFh 0x0000004b mov edi, dword ptr [ebp+122D3205h] 0x00000051 push 00000000h 0x00000053 or ebx, dword ptr [ebp+122D390Eh] 0x00000059 push eax 0x0000005a push edi 0x0000005b pushad 0x0000005c jmp 00007FFBA56586E0h 0x00000061 push eax 0x00000062 push edx 0x00000063 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 324C4E second address: 324C52 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 324C52 second address: 324C58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 324C58 second address: 324C62 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007FFBA4B43D96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 324C62 second address: 324CEE instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b sub dword ptr [ebp+122D1ED9h], ecx 0x00000011 push dword ptr fs:[00000000h] 0x00000018 push 00000000h 0x0000001a push esi 0x0000001b call 00007FFBA56586D8h 0x00000020 pop esi 0x00000021 mov dword ptr [esp+04h], esi 0x00000025 add dword ptr [esp+04h], 00000014h 0x0000002d inc esi 0x0000002e push esi 0x0000002f ret 0x00000030 pop esi 0x00000031 ret 0x00000032 ja 00007FFBA56586DEh 0x00000038 mov dword ptr fs:[00000000h], esp 0x0000003f push 00000000h 0x00000041 push ebx 0x00000042 call 00007FFBA56586D8h 0x00000047 pop ebx 0x00000048 mov dword ptr [esp+04h], ebx 0x0000004c add dword ptr [esp+04h], 0000001Ah 0x00000054 inc ebx 0x00000055 push ebx 0x00000056 ret 0x00000057 pop ebx 0x00000058 ret 0x00000059 mov eax, dword ptr [ebp+122D0321h] 0x0000005f jmp 00007FFBA56586DEh 0x00000064 push FFFFFFFFh 0x00000066 push edi 0x00000067 mov di, ax 0x0000006a pop ebx 0x0000006b nop 0x0000006c push edx 0x0000006d push eax 0x0000006e push edx 0x0000006f push ebx 0x00000070 pop ebx 0x00000071 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 326BA4 second address: 326BBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFBA4B43DA2h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 326BBB second address: 326C45 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jnc 00007FFBA56586D6h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f mov bl, cl 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push eax 0x00000016 call 00007FFBA56586D8h 0x0000001b pop eax 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 add dword ptr [esp+04h], 0000001Ah 0x00000028 inc eax 0x00000029 push eax 0x0000002a ret 0x0000002b pop eax 0x0000002c ret 0x0000002d jp 00007FFBA56586DCh 0x00000033 call 00007FFBA56586E2h 0x00000038 xor ebx, dword ptr [ebp+122D1B94h] 0x0000003e pop ebx 0x0000003f push 00000000h 0x00000041 push 00000000h 0x00000043 push esi 0x00000044 call 00007FFBA56586D8h 0x00000049 pop esi 0x0000004a mov dword ptr [esp+04h], esi 0x0000004e add dword ptr [esp+04h], 0000001Bh 0x00000056 inc esi 0x00000057 push esi 0x00000058 ret 0x00000059 pop esi 0x0000005a ret 0x0000005b cld 0x0000005c push eax 0x0000005d pushad 0x0000005e push eax 0x0000005f push edx 0x00000060 js 00007FFBA56586D6h 0x00000066 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 327DB6 second address: 327DBD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 326E86 second address: 326E8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 326E8A second address: 326E8E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 328DA9 second address: 328DAE instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 329C5C second address: 329CF9 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FFBA4B43D9Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push ebp 0x00000010 call 00007FFBA4B43D98h 0x00000015 pop ebp 0x00000016 mov dword ptr [esp+04h], ebp 0x0000001a add dword ptr [esp+04h], 0000001Bh 0x00000022 inc ebp 0x00000023 push ebp 0x00000024 ret 0x00000025 pop ebp 0x00000026 ret 0x00000027 push 00000000h 0x00000029 push 00000000h 0x0000002b push ecx 0x0000002c call 00007FFBA4B43D98h 0x00000031 pop ecx 0x00000032 mov dword ptr [esp+04h], ecx 0x00000036 add dword ptr [esp+04h], 00000018h 0x0000003e inc ecx 0x0000003f push ecx 0x00000040 ret 0x00000041 pop ecx 0x00000042 ret 0x00000043 mov dword ptr [ebp+122D1DF0h], eax 0x00000049 add dword ptr [ebp+1246EAA4h], edi 0x0000004f push 00000000h 0x00000051 push 00000000h 0x00000053 push edi 0x00000054 call 00007FFBA4B43D98h 0x00000059 pop edi 0x0000005a mov dword ptr [esp+04h], edi 0x0000005e add dword ptr [esp+04h], 00000016h 0x00000066 inc edi 0x00000067 push edi 0x00000068 ret 0x00000069 pop edi 0x0000006a ret 0x0000006b and bx, 07D1h 0x00000070 mov edi, 62C3974Bh 0x00000075 push eax 0x00000076 pushad 0x00000077 push eax 0x00000078 push edx 0x00000079 jmp 00007FFBA4B43D9Bh 0x0000007e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 32AB97 second address: 32AB9B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 32AD64 second address: 32AE0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FFBA4B43D96h 0x0000000a popad 0x0000000b popad 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push ebp 0x00000012 call 00007FFBA4B43D98h 0x00000017 pop ebp 0x00000018 mov dword ptr [esp+04h], ebp 0x0000001c add dword ptr [esp+04h], 0000001Ch 0x00000024 inc ebp 0x00000025 push ebp 0x00000026 ret 0x00000027 pop ebp 0x00000028 ret 0x00000029 push dword ptr fs:[00000000h] 0x00000030 push 00000000h 0x00000032 push edi 0x00000033 call 00007FFBA4B43D98h 0x00000038 pop edi 0x00000039 mov dword ptr [esp+04h], edi 0x0000003d add dword ptr [esp+04h], 0000001Ah 0x00000045 inc edi 0x00000046 push edi 0x00000047 ret 0x00000048 pop edi 0x00000049 ret 0x0000004a jmp 00007FFBA4B43D9Ch 0x0000004f mov dword ptr fs:[00000000h], esp 0x00000056 mov dword ptr [ebp+122D1895h], eax 0x0000005c mov eax, dword ptr [ebp+122D0AB1h] 0x00000062 sub edi, 47259E6Dh 0x00000068 push FFFFFFFFh 0x0000006a call 00007FFBA4B43DA4h 0x0000006f mov ebx, dword ptr [ebp+122D233Eh] 0x00000075 pop edi 0x00000076 mov bx, dx 0x00000079 nop 0x0000007a pushad 0x0000007b push eax 0x0000007c push edx 0x0000007d jne 00007FFBA4B43D96h 0x00000083 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 32CA86 second address: 32CA90 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007FFBA56586D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 32CA90 second address: 32CADA instructions: 0x00000000 rdtsc 0x00000002 ja 00007FFBA4B43D96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jng 00007FFBA4B43DA8h 0x00000013 nop 0x00000014 mov dword ptr [ebp+122D2821h], esi 0x0000001a push 00000000h 0x0000001c clc 0x0000001d push 00000000h 0x0000001f sbb edi, 63CCE357h 0x00000025 xchg eax, esi 0x00000026 jmp 00007FFBA4B43D9Ch 0x0000002b push eax 0x0000002c push eax 0x0000002d push eax 0x0000002e push edx 0x0000002f pushad 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 328F27 second address: 328F2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 32BCF5 second address: 32BCFC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 32EB5F second address: 32EB64 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 32DCB8 second address: 32DCD1 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jbe 00007FFBA4B43D96h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 jnl 00007FFBA4B43D96h 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 32ECD8 second address: 32ECDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 32ECDC second address: 32ED66 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA4B43D9Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a mov dword ptr [esp], eax 0x0000000d push dword ptr fs:[00000000h] 0x00000014 jp 00007FFBA4B43D9Ch 0x0000001a mov dword ptr fs:[00000000h], esp 0x00000021 push 00000000h 0x00000023 push edx 0x00000024 call 00007FFBA4B43D98h 0x00000029 pop edx 0x0000002a mov dword ptr [esp+04h], edx 0x0000002e add dword ptr [esp+04h], 00000016h 0x00000036 inc edx 0x00000037 push edx 0x00000038 ret 0x00000039 pop edx 0x0000003a ret 0x0000003b mov eax, dword ptr [ebp+122D0191h] 0x00000041 mov bh, D5h 0x00000043 push FFFFFFFFh 0x00000045 push 00000000h 0x00000047 push esi 0x00000048 call 00007FFBA4B43D98h 0x0000004d pop esi 0x0000004e mov dword ptr [esp+04h], esi 0x00000052 add dword ptr [esp+04h], 0000001Bh 0x0000005a inc esi 0x0000005b push esi 0x0000005c ret 0x0000005d pop esi 0x0000005e ret 0x0000005f stc 0x00000060 push eax 0x00000061 push eax 0x00000062 push edx 0x00000063 jmp 00007FFBA4B43D9Ah 0x00000068 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 32ED66 second address: 32ED6D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 336252 second address: 33625D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push esi 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 33625D second address: 336263 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 339355 second address: 33935A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 33E9C4 second address: 33E9CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 33E9CA second address: 33E9CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 33E9CF second address: 33E9EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FFBA56586E7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 33E9EA second address: 33EA0E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA4B43D9Bh 0x00000007 jmp 00007FFBA4B43D9Ch 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 33EA0E second address: 33EA12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 33EA12 second address: 33EA16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 2C6AE3 second address: 2C6AF6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA56586DCh 0x00000007 pushad 0x00000008 push edx 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 2C6AF6 second address: 2C6AFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3400B2 second address: 3400D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFBA56586E7h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3400D4 second address: 340102 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA4B43DA3h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ecx 0x0000000c push esi 0x0000000d pop esi 0x0000000e push eax 0x0000000f pop eax 0x00000010 pop ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FFBA4B43D9Dh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 340D24 second address: 340D2A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 340D2A second address: 340D35 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007FFBA4B43D96h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 340F20 second address: 340F25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 347934 second address: 347942 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 jbe 00007FFBA4B43D96h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3470AA second address: 3470AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3470AE second address: 3470C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFBA4B43DA0h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3470C8 second address: 3470D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FFBA56586D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 347391 second address: 347397 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3474C6 second address: 3474E9 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FFBA56586D6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FFBA56586DFh 0x00000011 js 00007FFBA56586DEh 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 34F7E2 second address: 34F7E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 34F7E8 second address: 34F80B instructions: 0x00000000 rdtsc 0x00000002 jno 00007FFBA56586D6h 0x00000008 jmp 00007FFBA56586E4h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push ecx 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 34F80B second address: 34F816 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push esi 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 34F816 second address: 34F834 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FFBA56586E7h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 34F834 second address: 34F866 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA4B43DA7h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jne 00007FFBA4B43D96h 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FFBA4B43D9Bh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 34FB06 second address: 34FB2A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA56586E8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jc 00007FFBA56586E2h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 34FB2A second address: 34FB30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 34FFED second address: 34FFFA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edi 0x00000008 pop edi 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 35024D second address: 35025F instructions: 0x00000000 rdtsc 0x00000002 jl 00007FFBA4B43D96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jbe 00007FFBA4B43D98h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3503D9 second address: 3503DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3503DD second address: 3503E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3503E8 second address: 3503EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3503EC second address: 3503F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3507E5 second address: 3507EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3507EB second address: 3507F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3507F1 second address: 3507F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 35721C second address: 357233 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FFBA4B43DA3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 355D06 second address: 355D12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pushad 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 355D12 second address: 355D25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FFBA4B43D9Ah 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 355D25 second address: 355D33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFBA56586DAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 35606A second address: 35606E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 35606E second address: 35607E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jne 00007FFBA56586D6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 35607E second address: 356082 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 356082 second address: 356095 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jg 00007FFBA56586D6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 356095 second address: 3560BF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA4B43D9Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d jmp 00007FFBA4B43DA8h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3560BF second address: 3560C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3560C5 second address: 3560CF instructions: 0x00000000 rdtsc 0x00000002 jc 00007FFBA4B43D9Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 35650A second address: 35650E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 35650E second address: 356516 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3568FD second address: 356903 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 356903 second address: 356923 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA4B43DA8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 356923 second address: 356927 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 356927 second address: 35692B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 35692B second address: 356931 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 2CA207 second address: 2CA21B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jo 00007FFBA4B43D96h 0x0000000b jnc 00007FFBA4B43D96h 0x00000011 push esi 0x00000012 pop esi 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 31594D second address: 315963 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jno 00007FFBA56586D6h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jbe 00007FFBA56586D6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 315963 second address: 3159B2 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 nop 0x00000008 push esi 0x00000009 mov dword ptr [ebp+122D1BB2h], edx 0x0000000f pop edx 0x00000010 lea eax, dword ptr [ebp+124896CCh] 0x00000016 push 00000000h 0x00000018 push ebx 0x00000019 call 00007FFBA4B43D98h 0x0000001e pop ebx 0x0000001f mov dword ptr [esp+04h], ebx 0x00000023 add dword ptr [esp+04h], 0000001Ch 0x0000002b inc ebx 0x0000002c push ebx 0x0000002d ret 0x0000002e pop ebx 0x0000002f ret 0x00000030 add dword ptr [ebp+122D2A32h], esi 0x00000036 push eax 0x00000037 push eax 0x00000038 push edx 0x00000039 jng 00007FFBA4B43D9Ch 0x0000003f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3159B2 second address: 2FFC5A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007FFBA56586D6h 0x00000009 jc 00007FFBA56586D6h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 mov dword ptr [esp], eax 0x00000015 mov ch, A2h 0x00000017 call dword ptr [ebp+122D1DEBh] 0x0000001d push ebx 0x0000001e push eax 0x0000001f push edx 0x00000020 jp 00007FFBA56586D6h 0x00000026 jne 00007FFBA56586D6h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 315B1A second address: 315B31 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FFBA4B43DA3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 31605F second address: 31608F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edi 0x00000006 add dword ptr [esp], 0C07AFBBh 0x0000000d sub dword ptr [ebp+122D1C25h], esi 0x00000013 call 00007FFBA56586D9h 0x00000018 push ecx 0x00000019 jns 00007FFBA56586D8h 0x0000001f pushad 0x00000020 popad 0x00000021 pop ecx 0x00000022 push eax 0x00000023 pushad 0x00000024 push eax 0x00000025 push edx 0x00000026 jng 00007FFBA56586D6h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 31608F second address: 316093 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 316093 second address: 31609D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 31609D second address: 3160A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3160A1 second address: 3160B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3160B1 second address: 3160CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jno 00007FFBA4B43D96h 0x0000000d jnp 00007FFBA4B43D96h 0x00000013 popad 0x00000014 popad 0x00000015 mov eax, dword ptr [eax] 0x00000017 push eax 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 316190 second address: 31619A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3165C1 second address: 3165E6 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007FFBA4B43D9Dh 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d pushad 0x0000000e jmp 00007FFBA4B43D9Dh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 35AC67 second address: 35AC6B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 35AC6B second address: 35AC71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 35AFCC second address: 35B001 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 je 00007FFBA56586D6h 0x0000000b jno 00007FFBA56586D6h 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FFBA56586DDh 0x0000001b jnp 00007FFBA56586E2h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 35B15E second address: 35B198 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFBA4B43DA3h 0x00000009 push esi 0x0000000a pop esi 0x0000000b jnc 00007FFBA4B43D96h 0x00000011 popad 0x00000012 je 00007FFBA4B43DAAh 0x00000018 pushad 0x00000019 popad 0x0000001a jmp 00007FFBA4B43DA2h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 35B198 second address: 35B19D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 35B438 second address: 35B43E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 35B43E second address: 35B444 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 35B444 second address: 35B47E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 je 00007FFBA4B43D96h 0x0000000c ja 00007FFBA4B43D96h 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 pop esi 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 push eax 0x0000001a pop eax 0x0000001b jl 00007FFBA4B43D96h 0x00000021 pushad 0x00000022 popad 0x00000023 popad 0x00000024 jmp 00007FFBA4B43DA6h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 35B47E second address: 35B494 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FFBA56586DAh 0x00000008 push eax 0x00000009 push edx 0x0000000a js 00007FFBA56586D6h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 35B723 second address: 35B733 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 js 00007FFBA4B43D96h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 35EE95 second address: 35EEB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop ebx 0x00000007 jng 00007FFBA56586E9h 0x0000000d jmp 00007FFBA56586DDh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 35EEB1 second address: 35EEBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jng 00007FFBA4B43D96h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 35EEBE second address: 35EEE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFBA56586E7h 0x00000009 popad 0x0000000a jo 00007FFBA56586DEh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 35EEE2 second address: 35EEEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 35EEEE second address: 35EEF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 35EEF2 second address: 35EEF6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3617FA second address: 3617FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 361994 second address: 3619A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jo 00007FFBA4B43D96h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 361C47 second address: 361C55 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 push edx 0x00000006 pop edx 0x00000007 pop ecx 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3643E1 second address: 364459 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA4B43DA2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d jmp 00007FFBA4B43DA7h 0x00000012 popad 0x00000013 pushad 0x00000014 jmp 00007FFBA4B43DA7h 0x00000019 pushad 0x0000001a popad 0x0000001b push ebx 0x0000001c pop ebx 0x0000001d jmp 00007FFBA4B43DA9h 0x00000022 popad 0x00000023 jns 00007FFBA4B43D9Ch 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 364459 second address: 36445D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 363F4E second address: 363F75 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FFBA4B43DADh 0x00000008 jmp 00007FFBA4B43DA1h 0x0000000d jc 00007FFBA4B43D96h 0x00000013 push eax 0x00000014 push edx 0x00000015 ja 00007FFBA4B43D96h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 363F75 second address: 363F79 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 368265 second address: 368277 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007FFBA4B43D9Dh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 368277 second address: 3682BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jp 00007FFBA56586DCh 0x0000000b jnl 00007FFBA56586D6h 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 jmp 00007FFBA56586E8h 0x0000001b pushad 0x0000001c popad 0x0000001d push esi 0x0000001e pop esi 0x0000001f jc 00007FFBA56586D6h 0x00000025 popad 0x00000026 jmp 00007FFBA56586DEh 0x0000002b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3682BE second address: 3682CE instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 jns 00007FFBA4B43D96h 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3682CE second address: 3682D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3682D4 second address: 3682D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 2DE40A second address: 2DE424 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FFBA56586E4h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 2DE424 second address: 2DE429 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 367C54 second address: 367C58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 367C58 second address: 367C73 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA4B43D9Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jbe 00007FFBA4B43D9Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 367C73 second address: 367C77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 367C77 second address: 367C9B instructions: 0x00000000 rdtsc 0x00000002 jp 00007FFBA4B43D98h 0x00000008 push eax 0x00000009 jmp 00007FFBA4B43DA7h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 367F8C second address: 367F91 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 36BD02 second address: 36BD0C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FFBA4B43D96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 36BD0C second address: 36BD10 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 371D19 second address: 371D28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FFBA4B43D96h 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 371D28 second address: 371D38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFBA56586DCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 371D38 second address: 371D56 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 jmp 00007FFBA4B43DA5h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 371D56 second address: 371D65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jg 00007FFBA56586D6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 371D65 second address: 371D69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3706A5 second address: 3706AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3706AB second address: 3706AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 370C8F second address: 370C99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FFBA56586D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3160E2 second address: 3160E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3160E6 second address: 3160EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 370E36 second address: 370E3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 370F95 second address: 370F9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 370F9B second address: 370FC4 instructions: 0x00000000 rdtsc 0x00000002 js 00007FFBA4B43D96h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f pop esi 0x00000010 jmp 00007FFBA4B43DA9h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 370FC4 second address: 370FC8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3780B3 second address: 3780C7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA4B43D9Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a pushad 0x0000000b popad 0x0000000c push edx 0x0000000d pop edx 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3780C7 second address: 3780D9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA56586DDh 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3787A6 second address: 3787B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FFBA4B43D96h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3787B1 second address: 3787CB instructions: 0x00000000 rdtsc 0x00000002 jns 00007FFBA56586DCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b push edx 0x0000000c jg 00007FFBA56586D6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 378D0E second address: 378D17 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 378D17 second address: 378D1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 378D1D second address: 378D31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFBA4B43D9Fh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 37908F second address: 379095 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 37E04C second address: 37E052 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 2C86C0 second address: 2C86C6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 386948 second address: 386964 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA4B43D9Ch 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f jp 00007FFBA4B43D96h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 386964 second address: 386968 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 385A8C second address: 385A9C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 pushad 0x00000008 popad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 385A9C second address: 385AA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 385C43 second address: 385C61 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FFBA4B43D96h 0x00000008 jno 00007FFBA4B43D96h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 js 00007FFBA4B43D98h 0x00000016 push edi 0x00000017 pop edi 0x00000018 push eax 0x00000019 push edx 0x0000001a push edx 0x0000001b pop edx 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 385EF9 second address: 385F02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 385F02 second address: 385F1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFBA4B43DA4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 385F1A second address: 385F26 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 385F26 second address: 385F2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 38609A second address: 3860A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 386204 second address: 386208 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3865FD second address: 386602 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 386602 second address: 386607 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 38D5EA second address: 38D5EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 38D5EF second address: 38D5F4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 38D5F4 second address: 38D608 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFBA56586DCh 0x00000009 push eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 38DC96 second address: 38DC9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 38F0D2 second address: 38F0D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 38F0D6 second address: 38F0DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 38D04B second address: 38D05D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push edx 0x00000006 jmp 00007FFBA56586DAh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 395D0C second address: 395D12 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 395D12 second address: 395D22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jp 00007FFBA56586D6h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 395D22 second address: 395D2C instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FFBA4B43D96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 2DFF52 second address: 2DFF5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FFBA56586D6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 39568C second address: 3956B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA4B43DA5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FFBA4B43DA1h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3956B6 second address: 3956D7 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FFBA56586EBh 0x00000008 jmp 00007FFBA56586E5h 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3956D7 second address: 3956DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 39582E second address: 39585A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA56586E4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jno 00007FFBA56586D8h 0x0000000f popad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 je 00007FFBA56586D6h 0x00000019 push edx 0x0000001a pop edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3959A6 second address: 3959CB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA4B43D9Ah 0x00000007 jmp 00007FFBA4B43DA4h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3959CB second address: 3959D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3A146D second address: 3A149A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FFBA4B43DA6h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jbe 00007FFBA4B43DA1h 0x00000011 jmp 00007FFBA4B43D9Bh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3A149A second address: 3A14E4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA56586E8h 0x00000007 jmp 00007FFBA56586E4h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jnp 00007FFBA56586F9h 0x00000014 jmp 00007FFBA56586E1h 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3A14E4 second address: 3A14EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3A1660 second address: 3A167B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFBA56586E6h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3A545F second address: 3A5492 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jl 00007FFBA4B43D96h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jno 00007FFBA4B43D9Ch 0x00000012 pushad 0x00000013 jo 00007FFBA4B43D96h 0x00000019 jnl 00007FFBA4B43D96h 0x0000001f push edi 0x00000020 pop edi 0x00000021 pushad 0x00000022 popad 0x00000023 popad 0x00000024 push ecx 0x00000025 jnp 00007FFBA4B43D96h 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3A5492 second address: 3A549C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 push eax 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3B08BF second address: 3B08C6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3B08C6 second address: 3B08CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3B5737 second address: 3B573B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3BF94A second address: 3BF950 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3BE6D0 second address: 3BE6DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FFBA4B43D96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3BE9C8 second address: 3BE9EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFBA56586E6h 0x00000009 jbe 00007FFBA56586D6h 0x0000000f push edx 0x00000010 pop edx 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3BE9EB second address: 3BEA04 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FFBA4B43DA4h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3BEA04 second address: 3BEA12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jnp 00007FFBA56586D6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3BEB93 second address: 3BEBA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FFBA4B43D96h 0x0000000a popad 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3BEBA4 second address: 3BEBC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FFBA56586D6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FFBA56586E5h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3BEBC8 second address: 3BEBCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3BEBCC second address: 3BEBD2 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3C32AE second address: 3C32B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3C32B2 second address: 3C32EF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 jc 00007FFBA56586D6h 0x0000000b jmp 00007FFBA56586DDh 0x00000010 popad 0x00000011 jmp 00007FFBA56586E7h 0x00000016 pop edx 0x00000017 pop eax 0x00000018 push eax 0x00000019 push edx 0x0000001a push edx 0x0000001b jg 00007FFBA56586D6h 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3C32EF second address: 3C32F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3C2E03 second address: 3C2E07 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3C2F99 second address: 3C2FA9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007FFBA4B43D9Ah 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3C2FA9 second address: 3C2FDC instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b pop ecx 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jng 00007FFBA56586DCh 0x00000015 push eax 0x00000016 push edx 0x00000017 push ecx 0x00000018 pop ecx 0x00000019 jmp 00007FFBA56586E4h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3C2FDC second address: 3C2FE0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3C2FE0 second address: 3C2FEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3C57B5 second address: 3C57E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFBA4B43DA2h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FFBA4B43DA6h 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3C57E6 second address: 3C57EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3C57EA second address: 3C57F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3C57F0 second address: 3C57F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3C57F6 second address: 3C57FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3D7416 second address: 3D7427 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push edx 0x00000007 pop edx 0x00000008 popad 0x00000009 ja 00007FFBA56586DEh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3D8A03 second address: 3D8A19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFBA4B43DA2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3D8A19 second address: 3D8A28 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA56586DBh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3D34F9 second address: 3D34FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3D34FD second address: 3D3503 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3D3503 second address: 3D3510 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jg 00007FFBA4B43D96h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3E574E second address: 3E5775 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA56586DEh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jo 00007FFBA56586E0h 0x00000014 jmp 00007FFBA56586DAh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3E5775 second address: 3E5790 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007FFBA4B43D96h 0x00000009 jmp 00007FFBA4B43DA0h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3E84B0 second address: 3E84BE instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 3E84BE second address: 3E84C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 40C957 second address: 40C967 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FFBA56586D6h 0x00000008 jnl 00007FFBA56586D6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 40C967 second address: 40C985 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA4B43D9Dh 0x00000007 pushad 0x00000008 jne 00007FFBA4B43D96h 0x0000000e js 00007FFBA4B43D96h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 40C985 second address: 40C99C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a jng 00007FFBA56586D6h 0x00000010 jne 00007FFBA56586D6h 0x00000016 pop ecx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 40C99C second address: 40C9A7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jg 00007FFBA4B43D96h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 40CC50 second address: 40CC65 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA56586DFh 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 40CC65 second address: 40CC6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 40CFA9 second address: 40CFB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 40CFB4 second address: 40CFBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FFBA4B43D96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 40D169 second address: 40D175 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FFBA56586D6h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 40D175 second address: 40D17A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 40D2FC second address: 40D302 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 411B63 second address: 411B80 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA4B43D9Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FFBA4B43D9Bh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 411F46 second address: 411F4D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 41372D second address: 413739 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007FFBA4B43D96h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 413739 second address: 41373D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4B9003C second address: 4B90060 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA4B43DA1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FFBA4B43D9Ch 0x00000011 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4B90060 second address: 4B90099 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, 5A64h 0x00000007 mov edx, 0D8CB8D0h 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f xchg eax, ebp 0x00000010 pushad 0x00000011 movsx edi, si 0x00000014 mov cl, DBh 0x00000016 popad 0x00000017 mov ebp, esp 0x00000019 jmp 00007FFBA56586E9h 0x0000001e pop ebp 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4B90099 second address: 4B9009D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4B9009D second address: 4B900A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4B900A1 second address: 4B900A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4B900A7 second address: 4B900AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C00606 second address: 4C0060C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C0060C second address: 4C00610 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4B80CB5 second address: 4B80CC7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FFBA4B43D9Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4B80CC7 second address: 4B80CE5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007FFBA56586DFh 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4B80CE5 second address: 4B80D26 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA4B43DA9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FFBA4B43D9Ch 0x00000013 and cl, 00000038h 0x00000016 jmp 00007FFBA4B43D9Bh 0x0000001b popfd 0x0000001c push eax 0x0000001d push edx 0x0000001e mov al, 1Fh 0x00000020 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4B80D26 second address: 4B80D3B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov ebp, esp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FFBA56586DAh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4B80D3B second address: 4B80D41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4B80D41 second address: 4B80D45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4B80D45 second address: 4B80D78 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA4B43D9Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push dword ptr [ebp+04h] 0x0000000e pushad 0x0000000f movzx ecx, di 0x00000012 mov ebx, 340EBF0Ch 0x00000017 popad 0x00000018 push dword ptr [ebp+0Ch] 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FFBA4B43D9Eh 0x00000022 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4B80DC0 second address: 4B80DC6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4B80DC6 second address: 4B80DCA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C003A2 second address: 4C003BF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA56586E2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C003BF second address: 4C003DC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA4B43DA9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4BD0BE4 second address: 4BD0BFE instructions: 0x00000000 rdtsc 0x00000002 mov cx, bx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FFBA56586DFh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4BD0BFE second address: 4BD0C22 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA4B43DA9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4BD0C22 second address: 4BD0C26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4BD0C26 second address: 4BD0C2C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4BD0C2C second address: 4BD0C87 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA56586E5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b push esi 0x0000000c movsx ebx, si 0x0000000f pop ecx 0x00000010 pushfd 0x00000011 jmp 00007FFBA56586E5h 0x00000016 sbb esi, 7D3783C6h 0x0000001c jmp 00007FFBA56586E1h 0x00000021 popfd 0x00000022 popad 0x00000023 mov ebp, esp 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 mov si, di 0x0000002b mov ax, di 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C202FB second address: 4C20301 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C20301 second address: 4C20379 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FFBA56586DCh 0x00000008 pop esi 0x00000009 mov ch, dh 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, ebp 0x0000000f pushad 0x00000010 pushad 0x00000011 jmp 00007FFBA56586E6h 0x00000016 mov ax, D1F1h 0x0000001a popad 0x0000001b mov dh, ch 0x0000001d popad 0x0000001e push eax 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 call 00007FFBA56586E5h 0x00000027 pop esi 0x00000028 pushfd 0x00000029 jmp 00007FFBA56586E1h 0x0000002e and ah, FFFFFFE6h 0x00000031 jmp 00007FFBA56586E1h 0x00000036 popfd 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C20379 second address: 4C20389 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FFBA4B43D9Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C20389 second address: 4C2038D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C2038D second address: 4C203CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007FFBA4B43D9Dh 0x00000010 xor ecx, 1306F5F6h 0x00000016 jmp 00007FFBA4B43DA1h 0x0000001b popfd 0x0000001c mov bh, ah 0x0000001e popad 0x0000001f mov ebp, esp 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 mov edi, ecx 0x00000026 pushad 0x00000027 popad 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C203CA second address: 4C20402 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dl, 19h 0x00000005 jmp 00007FFBA56586E6h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pop ebp 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FFBA56586E7h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C00DB1 second address: 4C00DB5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C00DB5 second address: 4C00DBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C00DBB second address: 4C00DC1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C00DC1 second address: 4C00DFB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007FFBA56586E5h 0x00000012 or al, FFFFFFC6h 0x00000015 jmp 00007FFBA56586E1h 0x0000001a popfd 0x0000001b mov ebx, ecx 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C00DFB second address: 4C00E9A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA4B43D9Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007FFBA4B43DA7h 0x00000011 xor eax, 0E85C5AEh 0x00000017 jmp 00007FFBA4B43DA9h 0x0000001c popfd 0x0000001d pushfd 0x0000001e jmp 00007FFBA4B43DA0h 0x00000023 adc esi, 67B00728h 0x00000029 jmp 00007FFBA4B43D9Bh 0x0000002e popfd 0x0000002f popad 0x00000030 xchg eax, ebp 0x00000031 jmp 00007FFBA4B43DA6h 0x00000036 mov ebp, esp 0x00000038 jmp 00007FFBA4B43DA0h 0x0000003d pop ebp 0x0000003e push eax 0x0000003f push edx 0x00000040 push eax 0x00000041 push edx 0x00000042 pushad 0x00000043 popad 0x00000044 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C00E9A second address: 4C00EA0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C00EA0 second address: 4C00EA5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4B90751 second address: 4B90757 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4B90757 second address: 4B9075D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4B9075D second address: 4B9078D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007FFBA56586E2h 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 call 00007FFBA56586DCh 0x00000017 pop esi 0x00000018 movsx ebx, ax 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4B9078D second address: 4B907F6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA4B43D9Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007FFBA4B43D9Ch 0x00000011 adc al, FFFFFF88h 0x00000014 jmp 00007FFBA4B43D9Bh 0x00000019 popfd 0x0000001a jmp 00007FFBA4B43DA8h 0x0000001f popad 0x00000020 mov ebp, esp 0x00000022 jmp 00007FFBA4B43DA0h 0x00000027 pop ebp 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007FFBA4B43D9Ah 0x00000031 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4B907F6 second address: 4B90805 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA56586DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C004A0 second address: 4C004A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C00B4C second address: 4C00B52 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C00B52 second address: 4C00B86 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA4B43DA4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FFBA4B43DA7h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C00B86 second address: 4C00BB2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov ah, bl 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov ebp, esp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007FFBA56586E9h 0x00000014 movzx eax, bx 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C00BB2 second address: 4C00C22 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, 9C3Fh 0x00000007 pushfd 0x00000008 jmp 00007FFBA4B43DA4h 0x0000000d and ecx, 32EA6128h 0x00000013 jmp 00007FFBA4B43D9Bh 0x00000018 popfd 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c mov eax, dword ptr [ebp+08h] 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 pushfd 0x00000023 jmp 00007FFBA4B43D9Bh 0x00000028 jmp 00007FFBA4B43DA3h 0x0000002d popfd 0x0000002e jmp 00007FFBA4B43DA8h 0x00000033 popad 0x00000034 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C00C22 second address: 4C00C67 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FFBA56586E1h 0x00000008 mov si, D5D7h 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f and dword ptr [eax], 00000000h 0x00000012 jmp 00007FFBA56586DAh 0x00000017 and dword ptr [eax+04h], 00000000h 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FFBA56586E7h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4BD0B1C second address: 4BD0B6C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, 7741E6FAh 0x00000008 pushfd 0x00000009 jmp 00007FFBA4B43D9Bh 0x0000000e sub cl, FFFFFF9Eh 0x00000011 jmp 00007FFBA4B43DA9h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push eax 0x0000001b jmp 00007FFBA4B43DA1h 0x00000020 xchg eax, ebp 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 mov cx, bx 0x00000027 mov dl, 1Dh 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4BB07F5 second address: 4BB0804 instructions: 0x00000000 rdtsc 0x00000002 movsx edx, cx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4BB0804 second address: 4BB0808 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4BB0808 second address: 4BB080E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C10C32 second address: 4C10C38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C10C38 second address: 4C10C3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C10C3C second address: 4C10D4A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA4B43D9Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007FFBA4B43DA6h 0x00000011 push eax 0x00000012 jmp 00007FFBA4B43D9Bh 0x00000017 xchg eax, ebp 0x00000018 jmp 00007FFBA4B43DA6h 0x0000001d mov ebp, esp 0x0000001f pushad 0x00000020 call 00007FFBA4B43D9Eh 0x00000025 jmp 00007FFBA4B43DA2h 0x0000002a pop ecx 0x0000002b call 00007FFBA4B43D9Bh 0x00000030 movzx eax, di 0x00000033 pop edi 0x00000034 popad 0x00000035 xchg eax, ecx 0x00000036 pushad 0x00000037 pushfd 0x00000038 jmp 00007FFBA4B43D9Eh 0x0000003d add ch, 00000038h 0x00000040 jmp 00007FFBA4B43D9Bh 0x00000045 popfd 0x00000046 jmp 00007FFBA4B43DA8h 0x0000004b popad 0x0000004c push eax 0x0000004d jmp 00007FFBA4B43D9Bh 0x00000052 xchg eax, ecx 0x00000053 jmp 00007FFBA4B43DA6h 0x00000058 mov eax, dword ptr [76FA65FCh] 0x0000005d jmp 00007FFBA4B43DA0h 0x00000062 test eax, eax 0x00000064 jmp 00007FFBA4B43DA0h 0x00000069 je 00007FFC16E569BEh 0x0000006f push eax 0x00000070 push edx 0x00000071 push eax 0x00000072 push edx 0x00000073 push eax 0x00000074 push edx 0x00000075 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C10D4A second address: 4C10D4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C10D4E second address: 4C10D54 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C10262 second address: 4C1028B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FFBA56586E4h 0x00000009 or al, 00000028h 0x0000000c jmp 00007FFBA56586DBh 0x00000011 popfd 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C1028B second address: 4C102A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xchg eax, ebp 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FFBA4B43D9Eh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C102A5 second address: 4C102B4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA56586DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C102B4 second address: 4C102E2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA4B43DA9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FFBA4B43D9Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C102E2 second address: 4C102F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FFBA56586DCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C102F2 second address: 4C1034D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [ebp+08h] 0x0000000b jmp 00007FFBA4B43DA7h 0x00000010 and dword ptr [eax], 00000000h 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007FFBA4B43DA4h 0x0000001a xor cx, 8CD8h 0x0000001f jmp 00007FFBA4B43D9Bh 0x00000024 popfd 0x00000025 pushad 0x00000026 mov ebx, esi 0x00000028 popad 0x00000029 popad 0x0000002a pop ebp 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e movzx esi, dx 0x00000031 push edx 0x00000032 pop ecx 0x00000033 popad 0x00000034 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C1034D second address: 4C10353 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C10353 second address: 4C10357 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4BD0068 second address: 4BD0079 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, eax 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4BD0079 second address: 4BD007D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4BD007D second address: 4BD008C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA56586DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4BD008C second address: 4BD00D5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA4B43DA9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007FFBA4B43D9Eh 0x00000010 and esp, FFFFFFF8h 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FFBA4B43DA7h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4BD00D5 second address: 4BD00DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4BD00DB second address: 4BD00DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4BD00DF second address: 4BD00FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FFBA56586E3h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4BD00FD second address: 4BD018E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, 4370E17Ah 0x00000008 pushfd 0x00000009 jmp 00007FFBA4B43D9Bh 0x0000000e adc si, CD1Eh 0x00000013 jmp 00007FFBA4B43DA9h 0x00000018 popfd 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c mov dword ptr [esp], ecx 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 pushfd 0x00000023 jmp 00007FFBA4B43DA3h 0x00000028 and ah, 0000002Eh 0x0000002b jmp 00007FFBA4B43DA9h 0x00000030 popfd 0x00000031 pushfd 0x00000032 jmp 00007FFBA4B43DA0h 0x00000037 sub eax, 2788ACA8h 0x0000003d jmp 00007FFBA4B43D9Bh 0x00000042 popfd 0x00000043 popad 0x00000044 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4BD018E second address: 4BD0194 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4BD0194 second address: 4BD0198 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4BD0198 second address: 4BD01DF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushad 0x0000000b call 00007FFBA56586E8h 0x00000010 pop esi 0x00000011 mov dx, 4776h 0x00000015 popad 0x00000016 movsx edi, si 0x00000019 popad 0x0000001a mov dword ptr [esp], ebx 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007FFBA56586E5h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4BD01DF second address: 4BD0257 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FFBA4B43DA7h 0x00000009 sbb ch, 0000005Eh 0x0000000c jmp 00007FFBA4B43DA9h 0x00000011 popfd 0x00000012 pushfd 0x00000013 jmp 00007FFBA4B43DA0h 0x00000018 or esi, 7431D958h 0x0000001e jmp 00007FFBA4B43D9Bh 0x00000023 popfd 0x00000024 popad 0x00000025 pop edx 0x00000026 pop eax 0x00000027 mov ebx, dword ptr [ebp+10h] 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007FFBA4B43DA5h 0x00000031 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4BD0257 second address: 4BD0314 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FFBA56586E7h 0x00000009 or ah, 0000007Eh 0x0000000c jmp 00007FFBA56586E9h 0x00000011 popfd 0x00000012 pushfd 0x00000013 jmp 00007FFBA56586E0h 0x00000018 or esi, 26B10878h 0x0000001e jmp 00007FFBA56586DBh 0x00000023 popfd 0x00000024 popad 0x00000025 pop edx 0x00000026 pop eax 0x00000027 xchg eax, esi 0x00000028 jmp 00007FFBA56586E6h 0x0000002d push eax 0x0000002e pushad 0x0000002f pushad 0x00000030 mov bl, 68h 0x00000032 mov di, si 0x00000035 popad 0x00000036 mov ebx, ecx 0x00000038 popad 0x00000039 xchg eax, esi 0x0000003a jmp 00007FFBA56586DEh 0x0000003f mov esi, dword ptr [ebp+08h] 0x00000042 jmp 00007FFBA56586E0h 0x00000047 xchg eax, edi 0x00000048 push eax 0x00000049 push edx 0x0000004a jmp 00007FFBA56586E7h 0x0000004f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4BD0314 second address: 4BD03AE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FFBA4B43D9Fh 0x00000009 sub esi, 1F45685Eh 0x0000000f jmp 00007FFBA4B43DA9h 0x00000014 popfd 0x00000015 mov di, cx 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b push eax 0x0000001c pushad 0x0000001d call 00007FFBA4B43DA3h 0x00000022 mov ebx, esi 0x00000024 pop ecx 0x00000025 pushfd 0x00000026 jmp 00007FFBA4B43DA5h 0x0000002b and si, F7F6h 0x00000030 jmp 00007FFBA4B43DA1h 0x00000035 popfd 0x00000036 popad 0x00000037 xchg eax, edi 0x00000038 pushad 0x00000039 push eax 0x0000003a push edx 0x0000003b call 00007FFBA4B43DA6h 0x00000040 pop esi 0x00000041 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4BD03AE second address: 4BD03DE instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 test esi, esi 0x00000009 pushad 0x0000000a push eax 0x0000000b movsx ebx, ax 0x0000000e pop ecx 0x0000000f popad 0x00000010 je 00007FFC179A692Dh 0x00000016 jmp 00007FFBA56586DDh 0x0000001b cmp dword ptr [esi+08h], DDEEDDEEh 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4BD03DE second address: 4BD03E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4BD03E2 second address: 4BD03F5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA56586DFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4BE002E second address: 4BE0071 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FFBA4B43D9Fh 0x00000008 or si, 6FEEh 0x0000000d jmp 00007FFBA4B43DA9h 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 popad 0x00000016 push eax 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FFBA4B43D9Ch 0x0000001e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4BE0071 second address: 4BE00C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FFBA56586E1h 0x00000009 and cx, A6D6h 0x0000000e jmp 00007FFBA56586E1h 0x00000013 popfd 0x00000014 mov cx, 5A47h 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b xchg eax, ebp 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f pushad 0x00000020 popad 0x00000021 call 00007FFBA56586E5h 0x00000026 pop eax 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4BE00C1 second address: 4BE00D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FFBA4B43D9Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4BE00D2 second address: 4BE0103 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b call 00007FFBA56586DFh 0x00000010 mov edi, eax 0x00000012 pop esi 0x00000013 popad 0x00000014 and esp, FFFFFFF8h 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FFBA56586DEh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4BE0103 second address: 4BE019E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop eax 0x00000005 movsx edx, ax 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebx 0x0000000c pushad 0x0000000d pushad 0x0000000e mov dx, ax 0x00000011 pushfd 0x00000012 jmp 00007FFBA4B43D9Ch 0x00000017 sbb ax, FB48h 0x0000001c jmp 00007FFBA4B43D9Bh 0x00000021 popfd 0x00000022 popad 0x00000023 pushfd 0x00000024 jmp 00007FFBA4B43DA8h 0x00000029 add si, BDA8h 0x0000002e jmp 00007FFBA4B43D9Bh 0x00000033 popfd 0x00000034 popad 0x00000035 push eax 0x00000036 jmp 00007FFBA4B43DA9h 0x0000003b xchg eax, ebx 0x0000003c pushad 0x0000003d movzx ecx, bx 0x00000040 jmp 00007FFBA4B43DA9h 0x00000045 popad 0x00000046 xchg eax, esi 0x00000047 push eax 0x00000048 push edx 0x00000049 push eax 0x0000004a push edx 0x0000004b pushad 0x0000004c popad 0x0000004d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4BE019E second address: 4BE01A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4BE01A2 second address: 4BE01A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4BE01A8 second address: 4BE021A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA56586E2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b mov si, dx 0x0000000e call 00007FFBA56586DDh 0x00000013 call 00007FFBA56586E0h 0x00000018 pop esi 0x00000019 pop edx 0x0000001a popad 0x0000001b xchg eax, esi 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f pushfd 0x00000020 jmp 00007FFBA56586E3h 0x00000025 sub al, 0000006Eh 0x00000028 jmp 00007FFBA56586E9h 0x0000002d popfd 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4BE021A second address: 4BE021F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4BE021F second address: 4BE022D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FFBA56586DAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4BE022D second address: 4BE0265 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA4B43D9Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov esi, dword ptr [ebp+08h] 0x0000000e pushad 0x0000000f mov ax, 02FBh 0x00000013 mov cx, D3D7h 0x00000017 popad 0x00000018 sub ebx, ebx 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007FFBA4B43DA6h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4BE0265 second address: 4BE029F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA56586DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test esi, esi 0x0000000b pushad 0x0000000c mov bx, cx 0x0000000f mov si, CEA7h 0x00000013 popad 0x00000014 je 00007FFC1798E7E5h 0x0000001a jmp 00007FFBA56586DAh 0x0000001f cmp dword ptr [esi+08h], DDEEDDEEh 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 push edx 0x0000002a pop eax 0x0000002b mov si, bx 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4BE029F second address: 4BE0327 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA4B43DA2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, esi 0x0000000b pushad 0x0000000c call 00007FFBA4B43D9Eh 0x00000011 pushfd 0x00000012 jmp 00007FFBA4B43DA2h 0x00000017 add eax, 47E8B898h 0x0000001d jmp 00007FFBA4B43D9Bh 0x00000022 popfd 0x00000023 pop esi 0x00000024 jmp 00007FFBA4B43DA9h 0x00000029 popad 0x0000002a je 00007FFC16E79E33h 0x00000030 jmp 00007FFBA4B43D9Eh 0x00000035 test byte ptr [76FA6968h], 00000002h 0x0000003c push eax 0x0000003d push edx 0x0000003e push eax 0x0000003f push edx 0x00000040 pushad 0x00000041 popad 0x00000042 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4BE0327 second address: 4BE0344 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA56586E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4BE0344 second address: 4BE03D7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FFBA4B43DA7h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jne 00007FFC16E79DEBh 0x00000011 jmp 00007FFBA4B43DA5h 0x00000016 mov edx, dword ptr [ebp+0Ch] 0x00000019 pushad 0x0000001a pushfd 0x0000001b jmp 00007FFBA4B43D9Ch 0x00000020 adc eax, 2497A148h 0x00000026 jmp 00007FFBA4B43D9Bh 0x0000002b popfd 0x0000002c popad 0x0000002d xchg eax, ebx 0x0000002e jmp 00007FFBA4B43DA2h 0x00000033 push eax 0x00000034 jmp 00007FFBA4B43D9Bh 0x00000039 xchg eax, ebx 0x0000003a push eax 0x0000003b push edx 0x0000003c jmp 00007FFBA4B43DA5h 0x00000041 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4BE03D7 second address: 4BE047B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, bx 0x00000006 jmp 00007FFBA56586E3h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, ebx 0x0000000f pushad 0x00000010 mov eax, 60C31F8Bh 0x00000015 pushfd 0x00000016 jmp 00007FFBA56586E0h 0x0000001b sub ecx, 12494B98h 0x00000021 jmp 00007FFBA56586DBh 0x00000026 popfd 0x00000027 popad 0x00000028 push eax 0x00000029 pushad 0x0000002a pushfd 0x0000002b jmp 00007FFBA56586DFh 0x00000030 add ecx, 691E6C5Eh 0x00000036 jmp 00007FFBA56586E9h 0x0000003b popfd 0x0000003c pushfd 0x0000003d jmp 00007FFBA56586E0h 0x00000042 add ecx, 4B805058h 0x00000048 jmp 00007FFBA56586DBh 0x0000004d popfd 0x0000004e popad 0x0000004f xchg eax, ebx 0x00000050 push eax 0x00000051 push edx 0x00000052 push eax 0x00000053 push edx 0x00000054 pushad 0x00000055 popad 0x00000056 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4BE047B second address: 4BE0496 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA4B43DA7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4BE0496 second address: 4BE049C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4BE049C second address: 4BE04A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4BE04A0 second address: 4BE04A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4BE04A4 second address: 4BE04CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push dword ptr [ebp+14h] 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FFBA4B43DA9h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4BE04CC second address: 4BE04D2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4BE04D2 second address: 4BE04E7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ch, 4Dh 0x00000005 mov bx, FDEAh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push dword ptr [ebp+10h] 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4BE04E7 second address: 4BE04EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4BE04EB second address: 4BE04F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4BE04F1 second address: 4BE04F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4BE04F7 second address: 4BE04FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C418A3 second address: 4C418FA instructions: 0x00000000 rdtsc 0x00000002 mov ax, di 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 push esp 0x00000009 jmp 00007FFBA56586E4h 0x0000000e mov dword ptr [esp], ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 pushfd 0x00000017 jmp 00007FFBA56586E3h 0x0000001c adc al, FFFFFFBEh 0x0000001f jmp 00007FFBA56586E9h 0x00000024 popfd 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C418FA second address: 4C4195E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, si 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007FFBA4B43DA2h 0x00000012 sub eax, 7EACABE8h 0x00000018 jmp 00007FFBA4B43D9Bh 0x0000001d popfd 0x0000001e mov eax, 01A277DFh 0x00000023 popad 0x00000024 push 0000007Fh 0x00000026 pushad 0x00000027 mov ecx, 55FD83D7h 0x0000002c popad 0x0000002d push 00000001h 0x0000002f jmp 00007FFBA4B43DA9h 0x00000034 push dword ptr [ebp+08h] 0x00000037 push eax 0x00000038 push edx 0x00000039 push eax 0x0000003a push edx 0x0000003b pushad 0x0000003c popad 0x0000003d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C4195E second address: 4C41962 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C41962 second address: 4C41968 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C41991 second address: 4C41997 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C41997 second address: 4C418A3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov ah, FCh 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebp 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007FFBA4B43D9Bh 0x00000012 sub si, 434Eh 0x00000017 jmp 00007FFBA4B43DA9h 0x0000001c popfd 0x0000001d pushad 0x0000001e push eax 0x0000001f pop ebx 0x00000020 mov eax, 3B722529h 0x00000025 popad 0x00000026 popad 0x00000027 retn 0004h 0x0000002a lea eax, dword ptr [ebp-10h] 0x0000002d push eax 0x0000002e call ebx 0x00000030 mov edi, edi 0x00000032 pushad 0x00000033 pushfd 0x00000034 jmp 00007FFBA4B43D9Ch 0x00000039 jmp 00007FFBA4B43DA5h 0x0000003e popfd 0x0000003f push eax 0x00000040 push edx 0x00000041 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 31B320 second address: 31B337 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnc 00007FFBA56586DCh 0x0000000b popad 0x0000000c push eax 0x0000000d push ebx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 31B526 second address: 31B52A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C00788 second address: 4C0078C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C0078C second address: 4C00792 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C60140 second address: 4C60146 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C60146 second address: 4C60158 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, 5ECEh 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov ebp, esp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C60158 second address: 4C6015C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C6015C second address: 4C60160 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C60160 second address: 4C60166 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C60166 second address: 4C601DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FFBA4B43D9Fh 0x00000009 jmp 00007FFBA4B43DA3h 0x0000000e popfd 0x0000000f pushfd 0x00000010 jmp 00007FFBA4B43DA8h 0x00000015 adc cx, 29A8h 0x0000001a jmp 00007FFBA4B43D9Bh 0x0000001f popfd 0x00000020 popad 0x00000021 pop edx 0x00000022 pop eax 0x00000023 push dword ptr [ebp+0Ch] 0x00000026 jmp 00007FFBA4B43DA6h 0x0000002b push dword ptr [ebp+08h] 0x0000002e push eax 0x0000002f push edx 0x00000030 pushad 0x00000031 mov cx, F27Fh 0x00000035 popad 0x00000036 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C106D4 second address: 4C106D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C106D8 second address: 4C106F4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA4B43DA8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C106F4 second address: 4C10706 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FFBA56586DEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C10706 second address: 4C1070A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C1070A second address: 4C10771 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007FFBA56586E7h 0x0000000e mov ebp, esp 0x00000010 jmp 00007FFBA56586E6h 0x00000015 and esp, FFFFFFF0h 0x00000018 jmp 00007FFBA56586E0h 0x0000001d sub esp, 44h 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007FFBA56586E7h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C10771 second address: 4C10797 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA4B43DA9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d mov esi, 7C695AA9h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C10797 second address: 4C107C3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 mov edi, 1D0E2F06h 0x0000000c pop ebx 0x0000000d popad 0x0000000e push eax 0x0000000f jmp 00007FFBA56586DDh 0x00000014 xchg eax, ebx 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007FFBA56586DDh 0x0000001c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C107C3 second address: 4C107EB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, edi 0x00000005 push edx 0x00000006 pop eax 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebp 0x0000000b jmp 00007FFBA4B43DA2h 0x00000010 mov dword ptr [esp], esi 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 pushad 0x00000017 popad 0x00000018 pushad 0x00000019 popad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C107EB second address: 4C10831 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA56586E6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, edi 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007FFBA56586DEh 0x00000011 add ch, FFFFFF98h 0x00000014 jmp 00007FFBA56586DBh 0x00000019 popfd 0x0000001a mov di, ax 0x0000001d popad 0x0000001e push eax 0x0000001f pushad 0x00000020 mov eax, ebx 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C10831 second address: 4C10835 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C10835 second address: 4C10864 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, edi 0x00000008 jmp 00007FFBA56586E5h 0x0000000d mov edi, dword ptr [ebp+08h] 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FFBA56586DDh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C10864 second address: 4C1087D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov al, bh 0x00000005 mov ax, EB0Fh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp+24h], 00000000h 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C1087D second address: 4C10883 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C10883 second address: 4C10888 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C10888 second address: 4C108AF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA56586E8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lock bts dword ptr [edi], 00000000h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C108AF second address: 4C108B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C108B3 second address: 4C108B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C108B7 second address: 4C108BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C108BD second address: 4C10918 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA56586E4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jc 00007FFC1790A234h 0x0000000f jmp 00007FFBA56586E0h 0x00000014 pop edi 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 pushfd 0x00000019 jmp 00007FFBA56586DDh 0x0000001e sub eax, 3CF43366h 0x00000024 jmp 00007FFBA56586E1h 0x00000029 popfd 0x0000002a push eax 0x0000002b pop edi 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C10918 second address: 4C10934 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FFBA4B43DA8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C10934 second address: 4C1096C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e pushfd 0x0000000f jmp 00007FFBA56586E6h 0x00000014 add ecx, 110FB098h 0x0000001a jmp 00007FFBA56586DBh 0x0000001f popfd 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C1096C second address: 4C1099E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA4B43DA9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a jmp 00007FFBA4B43D9Eh 0x0000000f mov esp, ebp 0x00000011 pushad 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C10393 second address: 4C10399 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C10399 second address: 4C103C0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dl, al 0x00000005 movsx edx, si 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], ebp 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FFBA4B43DA7h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C103C0 second address: 4C103C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C103C6 second address: 4C103CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C103CA second address: 4C10413 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a jmp 00007FFBA56586E7h 0x0000000f xchg eax, ebx 0x00000010 jmp 00007FFBA56586E6h 0x00000015 push eax 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FFBA56586DEh 0x0000001d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C10413 second address: 4C1042F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA4B43D9Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov edx, 2B8104B6h 0x00000012 mov si, dx 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C1042F second address: 4C10496 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FFBA56586E6h 0x00000009 or esi, 15801FD8h 0x0000000f jmp 00007FFBA56586DBh 0x00000014 popfd 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xchg eax, esi 0x0000001b jmp 00007FFBA56586E4h 0x00000020 push eax 0x00000021 jmp 00007FFBA56586DBh 0x00000026 xchg eax, esi 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007FFBA56586E0h 0x00000030 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C10496 second address: 4C1049A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C1049A second address: 4C104A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C104A0 second address: 4C104A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C104A6 second address: 4C104BE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov esi, dword ptr [ebp+08h] 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FFBA56586DBh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C104BE second address: 4C10524 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA4B43DA9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub ecx, ecx 0x0000000b jmp 00007FFBA4B43DA7h 0x00000010 xchg eax, edi 0x00000011 jmp 00007FFBA4B43DA6h 0x00000016 push eax 0x00000017 pushad 0x00000018 push eax 0x00000019 pop edi 0x0000001a popad 0x0000001b xchg eax, edi 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007FFBA4B43DA1h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C10524 second address: 4C1052A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C1052A second address: 4C1052E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C1052E second address: 4C10545 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, 00000001h 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 mov cx, ABC7h 0x00000014 mov cl, 3Dh 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C10545 second address: 4C1055E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FFBA4B43DA5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C1055E second address: 4C1062C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA56586E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b lock cmpxchg dword ptr [esi], ecx 0x0000000f pushad 0x00000010 push ecx 0x00000011 pushfd 0x00000012 jmp 00007FFBA56586DFh 0x00000017 add esi, 74EDFD9Eh 0x0000001d jmp 00007FFBA56586E9h 0x00000022 popfd 0x00000023 pop eax 0x00000024 popad 0x00000025 mov ecx, eax 0x00000027 jmp 00007FFBA56586E7h 0x0000002c cmp ecx, 01h 0x0000002f jmp 00007FFBA56586E6h 0x00000034 jne 00007FFC1790A6C5h 0x0000003a jmp 00007FFBA56586E0h 0x0000003f pop edi 0x00000040 pushad 0x00000041 pushfd 0x00000042 jmp 00007FFBA56586DEh 0x00000047 and si, FC58h 0x0000004c jmp 00007FFBA56586DBh 0x00000051 popfd 0x00000052 movzx ecx, dx 0x00000055 popad 0x00000056 pop esi 0x00000057 push eax 0x00000058 push edx 0x00000059 jmp 00007FFBA56586DEh 0x0000005e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C1062C second address: 4C10666 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FFBA4B43DA1h 0x00000009 adc ax, 5AA6h 0x0000000e jmp 00007FFBA4B43DA1h 0x00000013 popfd 0x00000014 mov ax, 4DD7h 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b pop ebx 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C10666 second address: 4C1066A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C1066A second address: 4C10670 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4C10670 second address: 4C10681 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FFBA56586DDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4B70834 second address: 4B70858 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA4B43DA9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4B70858 second address: 4B7085C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe RDTSC instruction interceptor: First address: 4B7085C second address: 4B70862 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Tries to evade debugger and weak emulator (self modifying code)
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe Special instruction interceptor: First address: 15FAE8 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe Special instruction interceptor: First address: 15D362 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe Special instruction interceptor: First address: 315AA2 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe Special instruction interceptor: First address: 39AD00 instructions caused by: Self-modifying code
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Special instruction interceptor: First address: 30FAE8 instructions caused by: Self-modifying code
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Special instruction interceptor: First address: 30D362 instructions caused by: Self-modifying code
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Special instruction interceptor: First address: 4C5AA2 instructions caused by: Self-modifying code
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Special instruction interceptor: First address: 54AD00 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Special instruction interceptor: First address: 26FAE8 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Special instruction interceptor: First address: 26D362 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Special instruction interceptor: First address: 425AA2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Special instruction interceptor: First address: 4AAD00 instructions caused by: Self-modifying code
Contains capabilities to detect virtual machines
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe Code function: 0_2_04C50833 rdtsc 0_2_04C50833
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe Window / User API: threadDelayed 1870 Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe Window / User API: threadDelayed 1674 Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Window / User API: threadDelayed 1145 Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Window / User API: threadDelayed 1124 Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Window / User API: threadDelayed 726 Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Window / User API: threadDelayed 1161 Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Window / User API: threadDelayed 1087 Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Window / User API: threadDelayed 728 Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Window / User API: threadDelayed 1107 Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Window / User API: threadDelayed 1080 Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Window / User API: threadDelayed 1045 Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Window / User API: threadDelayed 1147 Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Window / User API: threadDelayed 1150 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe TID: 3208 Thread sleep time: -40020s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe TID: 1788 Thread sleep count: 1870 > 30 Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe TID: 1788 Thread sleep time: -3741870s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe TID: 6976 Thread sleep count: 81 > 30 Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe TID: 6976 Thread sleep count: 241 > 30 Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe TID: 6184 Thread sleep count: 241 > 30 Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe TID: 6188 Thread sleep count: 1674 > 30 Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe TID: 6188 Thread sleep time: -3349674s >= -30000s Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 3184 Thread sleep count: 94 > 30 Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 3184 Thread sleep time: -188094s >= -30000s Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 3192 Thread sleep count: 119 > 30 Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 3192 Thread sleep time: -238119s >= -30000s Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 1164 Thread sleep count: 86 > 30 Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 1164 Thread sleep count: 1145 > 30 Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 1164 Thread sleep time: -115645s >= -30000s Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7236 Thread sleep count: 1124 > 30 Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7236 Thread sleep count: 726 > 30 Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7236 Thread sleep time: -72600s >= -30000s Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 3172 Thread sleep count: 86 > 30 Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 3172 Thread sleep time: -172086s >= -30000s Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 6204 Thread sleep count: 118 > 30 Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 6204 Thread sleep time: -236118s >= -30000s Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 4448 Thread sleep count: 125 > 30 Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 4448 Thread sleep time: -250125s >= -30000s Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 3748 Thread sleep count: 124 > 30 Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 3748 Thread sleep time: -248124s >= -30000s Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 320 Thread sleep count: 88 > 30 Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 320 Thread sleep count: 1161 > 30 Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 320 Thread sleep time: -117261s >= -30000s Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7232 Thread sleep count: 1087 > 30 Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7232 Thread sleep count: 728 > 30 Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7232 Thread sleep time: -72800s >= -30000s Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 6780 Thread sleep count: 87 > 30 Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 6780 Thread sleep time: -174087s >= -30000s Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 760 Thread sleep count: 130 > 30 Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 760 Thread sleep time: -260130s >= -30000s Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 4268 Thread sleep count: 124 > 30 Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 4268 Thread sleep time: -248124s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7300 Thread sleep time: -42021s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7280 Thread sleep count: 1107 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7280 Thread sleep time: -2215107s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7276 Thread sleep count: 1080 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7276 Thread sleep time: -2161080s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7256 Thread sleep count: 249 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7376 Thread sleep count: 246 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7292 Thread sleep count: 1045 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7292 Thread sleep time: -2091045s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7612 Thread sleep time: -56028s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7592 Thread sleep count: 1147 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7592 Thread sleep time: -2295147s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7572 Thread sleep count: 282 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7700 Thread sleep count: 250 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7584 Thread sleep count: 1150 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7584 Thread sleep time: -2301150s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Last function: Thread delayed
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Last function: Thread delayed
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Last function: Thread delayed
Source: RageMP131.exe, RageMP131.exe, 0000000A.00000002.4497054948.00000000003FC000.00000040.00000001.01000000.00000006.sdmp Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: RageMP131.exe, 0000000A.00000002.4499262309.00000000011AB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&
Source: MPGPH131.exe, 00000007.00000002.4499103991.0000000000C25000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}DPRm
Source: LisectAVT_2403002A_163.exe, 00000000.00000002.4499442748.0000000000E7E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}g
Source: MPGPH131.exe, 00000006.00000002.4499466734.00000000015F2000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&T
Source: RageMP131.exe, 0000000A.00000002.4499262309.00000000011E1000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: 3c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_57359524
Source: MPGPH131.exe, 00000007.00000002.4499103991.0000000000C11000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: RageMP131.exe, 00000008.00000002.4498783291.0000000000B73000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: #disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: RageMP131.exe, 0000000A.00000002.4498642794.0000000000EFD000.00000004.00000010.00020000.00000000.sdmp Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: MPGPH131.exe, 00000007.00000002.4499103991.0000000000BEA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}a
Source: MPGPH131.exe, 00000006.00000002.4499466734.00000000015BD000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}.e
Source: RageMP131.exe, 0000000A.00000002.4499262309.00000000011AB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}^
Source: MPGPH131.exe, 00000006.00000002.4498818545.000000000133D000.00000004.00000010.00020000.00000000.sdmp Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}[
Source: MPGPH131.exe, 00000007.00000002.4499103991.0000000000C1B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: -c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_57359524
Source: MPGPH131.exe, 00000007.00000002.4499103991.0000000000C11000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllT
Source: RageMP131.exe, 0000000A.00000003.2270670697.00000000011E1000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: MPGPH131.exe, 00000007.00000002.4499103991.0000000000C11000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&fQRNhy
Source: LisectAVT_2403002A_163.exe, 00000000.00000002.4497020630.00000000002EC000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000006.00000002.4497069031.000000000049C000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000007.00000002.4497101175.000000000049C000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.4497056945.00000000003FC000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 0000000A.00000002.4497054948.00000000003FC000.00000040.00000001.01000000.00000006.sdmp Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: MPGPH131.exe, 00000006.00000003.2125439054.0000000001604000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}v
Source: RageMP131.exe, 0000000A.00000002.4499262309.00000000011AB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}N
Source: LisectAVT_2403002A_163.exe, 00000000.00000002.4499442748.0000000000EB5000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.4498783291.0000000000B73000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000002.4499262309.00000000011AB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: MPGPH131.exe, 00000006.00000002.4499466734.00000000015F2000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllzz
Source: MPGPH131.exe, 00000006.00000003.2125439054.0000000001604000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}l
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe System information queried: ModuleInformation Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging
barindex
Hides threads from debuggers
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Thread information set: HideFromDebugger Jump to behavior
Potentially malicious time measurement code found
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 7_2_04D40545 Start: 04D40530 End: 04D4051B 7_2_04D40545
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 7_2_04D40207 Start: 04D40235 End: 04D4023F 7_2_04D40207
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Code function: 8_2_04C80699 Start: 04C80749 End: 04C806FD 8_2_04C80699
Tries to detect sandboxes and other dynamic analysis tools (window names)
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Open window title or class name: file monitor - sysinternals: www.sysinternals.com
Checks for debuggers (devices)
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe File opened: NTICE
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe File opened: SICE
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe File opened: SIWVID
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe Process queried: DebugPort Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Process queried: DebugPort Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Process queried: DebugPort Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Process queried: DebugPort Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Process queried: DebugPort Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Process queried: DebugPort Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe Code function: 0_2_04C50833 rdtsc 0_2_04C50833
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe Code function: 0_2_00083A40 mov eax, dword ptr fs:[00000030h] 0_2_00083A40
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe Code function: 0_2_00083A40 mov eax, dword ptr fs:[00000030h] 0_2_00083A40
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe Code function: 0_2_00034100 mov eax, dword ptr fs:[00000030h] 0_2_00034100
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 6_2_00233A40 mov eax, dword ptr fs:[00000030h] 6_2_00233A40
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 6_2_00233A40 mov eax, dword ptr fs:[00000030h] 6_2_00233A40
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 6_2_001E4100 mov eax, dword ptr fs:[00000030h] 6_2_001E4100
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 7_2_00233A40 mov eax, dword ptr fs:[00000030h] 7_2_00233A40
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 7_2_00233A40 mov eax, dword ptr fs:[00000030h] 7_2_00233A40
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 7_2_001E4100 mov eax, dword ptr fs:[00000030h] 7_2_001E4100
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Code function: 8_2_00193A40 mov eax, dword ptr fs:[00000030h] 8_2_00193A40
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Code function: 8_2_00193A40 mov eax, dword ptr fs:[00000030h] 8_2_00193A40
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Code function: 8_2_00144100 mov eax, dword ptr fs:[00000030h] 8_2_00144100
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Code function: 10_2_00193A40 mov eax, dword ptr fs:[00000030h] 10_2_00193A40
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Code function: 10_2_00193A40 mov eax, dword ptr fs:[00000030h] 10_2_00193A40
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Code function: 10_2_00144100 mov eax, dword ptr fs:[00000030h] 10_2_00144100
Source: MPGPH131.exe, MPGPH131.exe, 00000007.00000002.4497101175.000000000049C000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, RageMP131.exe, 0000000A.00000002.4497054948.00000000003FC000.00000040.00000001.01000000.00000006.sdmp Binary or memory string: :Program Manager
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe Code function: 0_2_000FF26A GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime, 0_2_000FF26A
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected RisePro Stealer
Source: Yara match File source: 00000006.00000003.2098792181.00000000052C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000003.2097834723.0000000004AA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.4496541525.00000000001D1000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000003.2174447764.0000000004A00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.4496595662.0000000000131000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.4496594215.0000000000131000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.2036461002.0000000004A10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.4496519840.0000000000021000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000003.2257587629.0000000004E30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.4496522566.00000000001D1000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: LisectAVT_2403002A_163.exe PID: 3140, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: MPGPH131.exe PID: 5044, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: MPGPH131.exe PID: 5012, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RageMP131.exe PID: 7252, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RageMP131.exe PID: 7568, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected RisePro Stealer
Source: Yara match File source: 00000006.00000003.2098792181.00000000052C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000003.2097834723.0000000004AA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.4496541525.00000000001D1000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000003.2174447764.0000000004A00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.4496595662.0000000000131000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.4496594215.0000000000131000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.2036461002.0000000004A10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.4496519840.0000000000021000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000003.2257587629.0000000004E30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.4496522566.00000000001D1000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: LisectAVT_2403002A_163.exe PID: 3140, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: MPGPH131.exe PID: 5044, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: MPGPH131.exe PID: 5012, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RageMP131.exe PID: 7252, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RageMP131.exe PID: 7568, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1482474 Sample: LisectAVT_2403002A_163.exe Startdate: 25/07/2024 Architecture: WINDOWS Score: 100 36 Antivirus / Scanner detection for submitted sample 2->36 38 Yara detected RisePro Stealer 2->38 40 Machine Learning detection for sample 2->40 42 3 other signatures 2->42 7 LisectAVT_2403002A_163.exe 1 9 2->7         started        12 RageMP131.exe 2 2->12         started        14 MPGPH131.exe 2 2->14         started        16 2 other processes 2->16 process3 dnsIp4 34 193.233.132.74, 49704, 49705, 49706 FREE-NET-ASFREEnetEU Russian Federation 7->34 26 C:\Users\user\AppData\Local\...\RageMP131.exe, PE32 7->26 dropped 28 C:\ProgramData\MPGPH131\MPGPH131.exe, PE32 7->28 dropped 30 C:\Users\...\RageMP131.exe:Zone.Identifier, ASCII 7->30 dropped 32 C:\...\MPGPH131.exe:Zone.Identifier, ASCII 7->32 dropped 44 Detected unpacking (changes PE section rights) 7->44 46 Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors) 7->46 48 Uses schtasks.exe or at.exe to add and modify task schedules 7->48 50 Tries to detect virtualization through RDTSC time measurements 7->50 18 schtasks.exe 1 7->18         started        20 schtasks.exe 1 7->20         started        52 Antivirus detection for dropped file 12->52 54 Tries to detect sandboxes and other dynamic analysis tools (window names) 12->54 56 Machine Learning detection for dropped file 12->56 58 Tries to evade debugger and weak emulator (self modifying code) 14->58 60 Hides threads from debuggers 14->60 62 Potentially malicious time measurement code found 14->62 64 Tries to detect sandboxes / dynamic malware analysis system (registry check) 16->64 66 Tries to detect process monitoring tools (Task Manager, Process Explorer etc.) 16->66 file5 signatures6 process7 process8 22 conhost.exe 18->22         started        24 conhost.exe 20->24         started       
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
193.233.132.74
 unknown Russian Federation
2895 FREE-NET-ASFREEnetEU true