Windows Analysis Report
file.exe

Overview

General Information

Sample name: file.exe
Analysis ID: 1532740
MD5: fc4912bd840edb6289e5e387ca8fa299
SHA1: cb67b24cb712a88985ca63ccf18d15cc135908ba
SHA256: c1df7516de3589e7b784d1c92514eed70b346d5f3bb6097d2b02f21268bdfedb
Tags: exeuser-Bitsight
Infos:

Detection

Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Detected unpacking (changes PE section rights)
AI detected suspicious sample
Disable Windows Defender notifications (registry)
Disable Windows Defender real time protection (registry)
Disables Windows Defender Tamper protection
Hides threads from debuggers
Machine Learning detection for sample
Modifies windows update settings
PE file contains section with special chars
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Allocates memory with a write watch (potentially for evading sandboxes)
Checks for debuggers (devices)
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains long sleeps (>= 3 min)
Detected potential crypto function
Enables debug privileges
Entry point lies outside standard sections
Found potential string decryption / allocating functions
May sleep (evasive loops) to hinder dynamic analysis
PE file contains an invalid checksum
PE file contains sections with non-standard names
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: file.exe Avira: detected
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for sample
Source: file.exe Joe Sandbox ML: detected
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00984700 CryptVerifySignatureA, 0_2_00984700
Source: Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: file.exe, 00000000.00000002.2239978807.00000000007A2000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2106981900.0000000005160000.00000004.00001000.00020000.00000000.sdmp

System Summary
barindex
PE file contains section with special chars
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name: .idata
Source: file.exe Static PE information: section name:
Detected potential crypto function
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0085408D 0_2_0085408D
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0086809C 0_2_0086809C
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008D6092 0_2_008D6092
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0083C0A3 0_2_0083C0A3
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009040BD 0_2_009040BD
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0081A0BB 0_2_0081A0BB
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007F803D 0_2_007F803D
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0090A0CF 0_2_0090A0CF
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008B40EE 0_2_008B40EE
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007F6015 0_2_007F6015
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008E20F5 0_2_008E20F5
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009080ED 0_2_009080ED
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008C4009 0_2_008C4009
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007BE0EA 0_2_007BE0EA
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008C2017 0_2_008C2017
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0084C041 0_2_0084C041
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00836048 0_2_00836048
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007F20AE 0_2_007F20AE
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0089005D 0_2_0089005D
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007C60AB 0_2_007C60AB
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0081E06B 0_2_0081E06B
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0083A079 0_2_0083A079
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007EA085 0_2_007EA085
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0084E07F 0_2_0084E07F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0080E189 0_2_0080E189
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007E6175 0_2_007E6175
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00828189 0_2_00828189
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007DC16D 0_2_007DC16D
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007FA16C 0_2_007FA16C
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00852199 0_2_00852199
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00888196 0_2_00888196
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007D2158 0_2_007D2158
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008501B4 0_2_008501B4
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008021C0 0_2_008021C0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008841C2 0_2_008841C2
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008B01C1 0_2_008B01C1
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0081C1CF 0_2_0081C1CF
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008DE1DD 0_2_008DE1DD
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008601D1 0_2_008601D1
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0082C1E2 0_2_0082C1E2
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008EC1E1 0_2_008EC1E1
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007B6108 0_2_007B6108
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008A01FD 0_2_008A01FD
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0086E109 0_2_0086E109
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00848116 0_2_00848116
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0087E113 0_2_0087E113
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008F8118 0_2_008F8118
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0092613D 0_2_0092613D
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008E613E 0_2_008E613E
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008C615C 0_2_008C615C
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0082615C 0_2_0082615C
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0091014E 0_2_0091014E
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008A816A 0_2_008A816A
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0082216E 0_2_0082216E
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00886172 0_2_00886172
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008D8173 0_2_008D8173
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0088A28A 0_2_0088A28A
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008A6288 0_2_008A6288
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007C427A 0_2_007C427A
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007C827A 0_2_007C827A
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007E0270 0_2_007E0270
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009102B0 0_2_009102B0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008E42AD 0_2_008E42AD
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007D6256 0_2_007D6256
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0086A2C4 0_2_0086A2C4
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008622C5 0_2_008622C5
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0085A2CD 0_2_0085A2CD
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0082A2CB 0_2_0082A2CB
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008EA2E4 0_2_008EA2E4
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008C82E0 0_2_008C82E0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008542EA 0_2_008542EA
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0081E2FC 0_2_0081E2FC
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007DE2F4 0_2_007DE2F4
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0082020B 0_2_0082020B
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0085C20F 0_2_0085C20F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008FA222 0_2_008FA222
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00866236 0_2_00866236
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00912222 0_2_00912222
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0089C23F 0_2_0089C23F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007E22C7 0_2_007E22C7
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007EE2C1 0_2_007EE2C1
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007F42B4 0_2_007F42B4
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0080C24C 0_2_0080C24C
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00842249 0_2_00842249
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008BA258 0_2_008BA258
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0083425B 0_2_0083425B
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0083025F 0_2_0083025F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00852267 0_2_00852267
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0088C261 0_2_0088C261
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008AE260 0_2_008AE260
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008CA27F 0_2_008CA27F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008AC272 0_2_008AC272
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0081227C 0_2_0081227C
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0090E26F 0_2_0090E26F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0084C38B 0_2_0084C38B
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008BC398 0_2_008BC398
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008E0399 0_2_008E0399
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009023D0 0_2_009023D0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007F6330 0_2_007F6330
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008D23DC 0_2_008D23DC
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007F0326 0_2_007F0326
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007BC31B 0_2_007BC31B
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008F63E7 0_2_008F63E7
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008B63F0 0_2_008B63F0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0080A3FE 0_2_0080A3FE
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0088030A 0_2_0088030A
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008F430C 0_2_008F430C
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00838319 0_2_00838319
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008A2326 0_2_008A2326
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0083E343 0_2_0083E343
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0087A35C 0_2_0087A35C
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007FE39A 0_2_007FE39A
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0081037D 0_2_0081037D
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00892489 0_2_00892489
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00824488 0_2_00824488
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008D4486 0_2_008D4486
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007D0472 0_2_007D0472
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007EC442 0_2_007EC442
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007C2441 0_2_007C2441
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008CC4B1 0_2_008CC4B1
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008EC4B1 0_2_008EC4B1
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009044D6 0_2_009044D6
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008E64D5 0_2_008E64D5
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0089E4F8 0_2_0089E4F8
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008084FD 0_2_008084FD
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007D44FC 0_2_007D44FC
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007FA4FE 0_2_007FA4FE
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00844400 0_2_00844400
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00884405 0_2_00884405
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007B64E8 0_2_007B64E8
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008B442B 0_2_008B442B
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0085E421 0_2_0085E421
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008B2433 0_2_008B2433
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00800445 0_2_00800445
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007E44B9 0_2_007E44B9
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007DA4B5 0_2_007DA4B5
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007F84B0 0_2_007F84B0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0085445D 0_2_0085445D
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0090A448 0_2_0090A448
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008A4456 0_2_008A4456
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008FC453 0_2_008FC453
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00830463 0_2_00830463
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0081E463 0_2_0081E463
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0086E475 0_2_0086E475
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00814475 0_2_00814475
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007C6483 0_2_007C6483
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0082E580 0_2_0082E580
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007CA57A 0_2_007CA57A
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007BC573 0_2_007BC573
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00834588 0_2_00834588
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00874597 0_2_00874597
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00818595 0_2_00818595
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007E8566 0_2_007E8566
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008605A0 0_2_008605A0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008A05B2 0_2_008A05B2
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0082A5BB 0_2_0082A5BB
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009065AF 0_2_009065AF
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008205C8 0_2_008205C8
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008A65DB 0_2_008A65DB
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008785E6 0_2_008785E6
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009105FA 0_2_009105FA
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007FC513 0_2_007FC513
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0088C5F3 0_2_0088C5F3
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0086450C 0_2_0086450C
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007D65F7 0_2_007D65F7
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0090251B 0_2_0090251B
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008D6502 0_2_008D6502
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008AA519 0_2_008AA519
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008E2515 0_2_008E2515
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00908533 0_2_00908533
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00836525 0_2_00836525
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0086C52F 0_2_0086C52F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008F8533 0_2_008F8533
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008DC541 0_2_008DC541
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008B655D 0_2_008B655D
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00876565 0_2_00876565
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0088057B 0_2_0088057B
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00898572 0_2_00898572
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007CE581 0_2_007CE581
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00822685 0_2_00822685
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00872689 0_2_00872689
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0083C6A0 0_2_0083C6A0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008B06A3 0_2_008B06A3
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008706AC 0_2_008706AC
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008DA6A1 0_2_008DA6A1
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008846B7 0_2_008846B7
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0082C6C3 0_2_0082C6C3
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009246D9 0_2_009246D9
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007C0629 0_2_007C0629
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007F861D 0_2_007F861D
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008506EC 0_2_008506EC
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008046F1 0_2_008046F1
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008E46F6 0_2_008E46F6
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0090A6EA 0_2_0090A6EA
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00828606 0_2_00828606
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008BA603 0_2_008BA603
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007D26EE 0_2_007D26EE
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00858625 0_2_00858625
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007DE6DF 0_2_007DE6DF
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008FA62C 0_2_008FA62C
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007EC6D4 0_2_007EC6D4
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007E26CE 0_2_007E26CE
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00842635 0_2_00842635
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008B863F 0_2_008B863F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008F464E 0_2_008F464E
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0088864A 0_2_0088864A
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0090C656 0_2_0090C656
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00830650 0_2_00830650
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0090E648 0_2_0090E648
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008CA653 0_2_008CA653
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0085C672 0_2_0085C672
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007BA685 0_2_007BA685
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008D0673 0_2_008D0673
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0084C785 0_2_0084C785
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007FE772 0_2_007FE772
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008AC799 0_2_008AC799
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0086479D 0_2_0086479D
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008F87AF 0_2_008F87AF
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008127A0 0_2_008127A0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007F274B 0_2_007F274B
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008927CD 0_2_008927CD
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0086E7C2 0_2_0086E7C2
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008C07CA 0_2_008C07CA
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008A27DB 0_2_008A27DB
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008FC7D4 0_2_008FC7D4
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008A071D 0_2_008A071D
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008F2713 0_2_008F2713
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0089072B 0_2_0089072B
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007EE7D9 0_2_007EE7D9
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007CC7CB 0_2_007CC7CB
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008AE736 0_2_008AE736
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008C4733 0_2_008C4733
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00896749 0_2_00896749
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007BA7B2 0_2_007BA7B2
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008DE75E 0_2_008DE75E
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00844750 0_2_00844750
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007BC7AD 0_2_007BC7AD
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00894750 0_2_00894750
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00856765 0_2_00856765
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008EA768 0_2_008EA768
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007C8797 0_2_007C8797
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0085A768 0_2_0085A768
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007C2785 0_2_007C2785
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008A4882 0_2_008A4882
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008B2881 0_2_008B2881
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0084688A 0_2_0084688A
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00826894 0_2_00826894
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0087C8AE 0_2_0087C8AE
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009048BB 0_2_009048BB
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008DC8A1 0_2_008DC8A1
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007B6856 0_2_007B6856
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0081A8B4 0_2_0081A8B4
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008088BA 0_2_008088BA
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008A68CB 0_2_008A68CB
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008388C9 0_2_008388C9
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007D4833 0_2_007D4833
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008D88C2 0_2_008D88C2
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007D082C 0_2_007D082C
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008A88D2 0_2_008A88D2
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008E88E5 0_2_008E88E5
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0082E8F7 0_2_0082E8F7
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008EE80F 0_2_008EE80F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007E88F6 0_2_007E88F6
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007FA8F7 0_2_007FA8F7
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0080E80C 0_2_0080E80C
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0090083E 0_2_0090083E
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0087283D 0_2_0087283D
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0083E850 0_2_0083E850
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0088285D 0_2_0088285D
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007F289E 0_2_007F289E
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0089886B 0_2_0089886B
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007C689F 0_2_007C689F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0084E868 0_2_0084E868
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0084E86A 0_2_0084E86A
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007EC88C 0_2_007EC88C
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0083698B 0_2_0083698B
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0084A988 0_2_0084A988
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007B8969 0_2_007B8969
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007EE96C 0_2_007EE96C
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009089BE 0_2_009089BE
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007FC947 0_2_007FC947
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008789B9 0_2_008789B9
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0081E9C3 0_2_0081E9C3
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007CA92F 0_2_007CA92F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008589D6 0_2_008589D6
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008B69DE 0_2_008B69DE
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008BC9D7 0_2_008BC9D7
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008609D9 0_2_008609D9
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008649D9 0_2_008649D9
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008429E7 0_2_008429E7
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008CC9E8 0_2_008CC9E8
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008269EA 0_2_008269EA
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008629EE 0_2_008629EE
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007B69E1 0_2_007B69E1
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0083C91F 0_2_0083C91F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A0A93D 0_2_00A0A93D
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0085291B 0_2_0085291B
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007C29DB 0_2_007C29DB
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00802927 0_2_00802927
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007E09C0 0_2_007E09C0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0080C943 0_2_0080C943
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0082A94B 0_2_0082A94B
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0083094E 0_2_0083094E
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0089295B 0_2_0089295B
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007F49A4 0_2_007F49A4
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008CA96D 0_2_008CA96D
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0089A96D 0_2_0089A96D
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00876962 0_2_00876962
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00832971 0_2_00832971
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0088097E 0_2_0088097E
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007E2A64 0_2_007E2A64
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007DEA60 0_2_007DEA60
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00814AC6 0_2_00814AC6
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0090EAC0 0_2_0090EAC0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00806AE0 0_2_00806AE0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007D6A0B 0_2_007D6A0B
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00844AF2 0_2_00844AF2
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007DAA05 0_2_007DAA05
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00816A0C 0_2_00816A0C
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00846A0B 0_2_00846A0B
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00866A17 0_2_00866A17
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00888A1C 0_2_00888A1C
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00854A12 0_2_00854A12
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00804A1C 0_2_00804A1C
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008B0A17 0_2_008B0A17
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00824A24 0_2_00824A24
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008BAA38 0_2_008BAA38
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007F6A9E 0_2_007F6A9E
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00820A6F 0_2_00820A6F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00822A71 0_2_00822A71
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008BEA7E 0_2_008BEA7E
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008B8B8A 0_2_008B8B8A
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007D2B6F 0_2_007D2B6F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00802B9D 0_2_00802B9D
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008FCBA3 0_2_008FCBA3
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008F8BCB 0_2_008F8BCB
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0085ABE0 0_2_0085ABE0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00884BE4 0_2_00884BE4
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008FEB01 0_2_008FEB01
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0086CB16 0_2_0086CB16
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007D4BE9 0_2_007D4BE9
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008E2B1B 0_2_008E2B1B
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007EABD7 0_2_007EABD7
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007C6BD3 0_2_007C6BD3
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0090AB3F 0_2_0090AB3F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007CCBC7 0_2_007CCBC7
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00870B46 0_2_00870B46
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00838B4F 0_2_00838B4F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008D4B5E 0_2_008D4B5E
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008DAB5E 0_2_008DAB5E
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007F8B9E 0_2_007F8B9E
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0084EB68 0_2_0084EB68
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0088AB7D 0_2_0088AB7D
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00904B68 0_2_00904B68
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007BEB80 0_2_007BEB80
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007D8B86 0_2_007D8B86
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0091AB6D 0_2_0091AB6D
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00882C98 0_2_00882C98
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00894C9D 0_2_00894C9D
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007CAC65 0_2_007CAC65
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008D4CAE 0_2_008D4CAE
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007F0C4C 0_2_007F0C4C
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00824CB6 0_2_00824CB6
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00922CA7 0_2_00922CA7
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0087ACBE 0_2_0087ACBE
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00900CD0 0_2_00900CD0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00848CCD 0_2_00848CCD
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007C8C31 0_2_007C8C31
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007E4C2F 0_2_007E4C2F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0088CCD9 0_2_0088CCD9
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00832CDC 0_2_00832CDC
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008F6CD0 0_2_008F6CD0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007B8C1B 0_2_007B8C1B
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00918CF3 0_2_00918CF3
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00830CE0 0_2_00830CE0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0081ACF6 0_2_0081ACF6
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00822C00 0_2_00822C00
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0083EC07 0_2_0083EC07
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00816C10 0_2_00816C10
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00896C12 0_2_00896C12
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008C6C3C 0_2_008C6C3C
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00812C40 0_2_00812C40
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008CCC48 0_2_008CCC48
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0080AC4F 0_2_0080AC4F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00840C52 0_2_00840C52
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0084CC52 0_2_0084CC52
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0086AC51 0_2_0086AC51
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008B4C54 0_2_008B4C54
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008A8C61 0_2_008A8C61
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008E4C75 0_2_008E4C75
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0089CC77 0_2_0089CC77
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00906D9D 0_2_00906D9D
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007FAD69 0_2_007FAD69
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0089ADA2 0_2_0089ADA2
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00908DBD 0_2_00908DBD
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00892DA7 0_2_00892DA7
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008A2DA4 0_2_008A2DA4
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00852DBC 0_2_00852DBC
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008BCDC1 0_2_008BCDC1
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008BEDC0 0_2_008BEDC0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00896DF8 0_2_00896DF8
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00886DFC 0_2_00886DFC
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0080CDF7 0_2_0080CDF7
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008DEDF0 0_2_008DEDF0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00874D03 0_2_00874D03
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007D6DE2 0_2_007D6DE2
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007F4DDB 0_2_007F4DDB
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007BCDDD 0_2_007BCDDD
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007D0DA9 0_2_007D0DA9
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00828D54 0_2_00828D54
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008CAD51 0_2_008CAD51
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0088ED6F 0_2_0088ED6F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00868D6C 0_2_00868D6C
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007E8D91 0_2_007E8D91
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00878D73 0_2_00878D73
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008F4D75 0_2_008F4D75
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00858E8B 0_2_00858E8B
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00866E94 0_2_00866E94
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0090CE89 0_2_0090CE89
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008FEE95 0_2_008FEE95
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00848EAB 0_2_00848EAB
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0081EEB6 0_2_0081EEB6
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008CAEC9 0_2_008CAEC9
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00806ECB 0_2_00806ECB
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008DAEC3 0_2_008DAEC3
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00800EFC 0_2_00800EFC
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007C0EF9 0_2_007C0EF9
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008D6E02 0_2_008D6E02
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008AAE18 0_2_008AAE18
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00854E18 0_2_00854E18
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00838E25 0_2_00838E25
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008A4E27 0_2_008A4E27
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0082AE32 0_2_0082AE32
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008E8E3E 0_2_008E8E3E
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0085EE46 0_2_0085EE46
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008F2E5F 0_2_008F2E5F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007B6E99 0_2_007B6E99
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008CEE6F 0_2_008CEE6F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0086EE60 0_2_0086EE60
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007E4F75 0_2_007E4F75
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00860F89 0_2_00860F89
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00840F93 0_2_00840F93
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00904F8B 0_2_00904F8B
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0084EFA2 0_2_0084EFA2
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00908FAE 0_2_00908FAE
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0080AFCF 0_2_0080AFCF
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0082CFD3 0_2_0082CFD3
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008A8FDD 0_2_008A8FDD
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008FCFD2 0_2_008FCFD2
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007D4F19 0_2_007D4F19
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007C2F0D 0_2_007C2F0D
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008FEFF2 0_2_008FEFF2
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008E2FF1 0_2_008E2FF1
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00856F01 0_2_00856F01
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00842F0B 0_2_00842F0B
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007BAFEA 0_2_007BAFEA
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008EEF1D 0_2_008EEF1D
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00876F10 0_2_00876F10
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0089CF11 0_2_0089CF11
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008C4F15 0_2_008C4F15
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007C4FDC 0_2_007C4FDC
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00864F27 0_2_00864F27
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007B8FD6 0_2_007B8FD6
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00814F31 0_2_00814F31
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008BCF37 0_2_008BCF37
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007CCFAD 0_2_007CCFAD
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008C0F5A 0_2_008C0F5A
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008FAF51 0_2_008FAF51
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007C9074 0_2_007C9074
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00819096 0_2_00819096
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007BD053 0_2_007BD053
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008E70B8 0_2_008E70B8
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008F90B1 0_2_008F90B1
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008130C3 0_2_008130C3
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008830CB 0_2_008830CB
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007EB01E 0_2_007EB01E
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008E500D 0_2_008E500D
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0085B011 0_2_0085B011
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008D904D 0_2_008D904D
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007E50BB 0_2_007E50BB
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008B9043 0_2_008B9043
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008D3045 0_2_008D3045
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0083F054 0_2_0083F054
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008F7057 0_2_008F7057
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00893050 0_2_00893050
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008EB050 0_2_008EB050
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008A106B 0_2_008A106B
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007E309D 0_2_007E309D
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007ED09A 0_2_007ED09A
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008A706D 0_2_008A706D
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007DF172 0_2_007DF172
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008C319C 0_2_008C319C
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007F916D 0_2_007F916D
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008A3194 0_2_008A3194
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0089F1AC 0_2_0089F1AC
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007EB14E 0_2_007EB14E
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008711B7 0_2_008711B7
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008251B4 0_2_008251B4
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008451C3 0_2_008451C3
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008BF1C3 0_2_008BF1C3
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\file.exe Code function: String function: 0097F6F5 appears 35 times
Sample file is different than original file name gathered from version info
Source: file.exe, 00000000.00000002.2239990643.00000000007A6000.00000008.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000002.2240350811.000000000125E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs file.exe
Source: file.exe Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe Static PE information: Section: ontajrjf ZLIB complexity 0.9950039586438152
Source: classification engine Classification label: mal100.evad.winEXE@1/1@0/0
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log Jump to behavior
Source: C:\Users\user\Desktop\file.exe Mutant created: NULL
Source: C:\Users\user\Desktop\file.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: file.exe String found in binary or memory: 3The file %s is missing. Please, re-install this application
Source: file.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: C:\Users\user\Desktop\file.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: sspicli.dll Jump to behavior
Source: file.exe Static file information: File size 1742848 > 1048576
Source: file.exe Static PE information: Raw size of ontajrjf is bigger than: 0x100000 < 0x1a3600
Source: Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: file.exe, 00000000.00000002.2239978807.00000000007A2000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2106981900.0000000005160000.00000004.00001000.00020000.00000000.sdmp

Data Obfuscation
barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\user\Desktop\file.exe Unpacked PE file: 0.2.file.exe.7a0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ontajrjf:EW;budoaocz:EW;.taggant:EW; vs :ER;.rsrc:W;
Entry point lies outside standard sections
Source: initial sample Static PE information: section where entry point is pointing to: .taggant
PE file contains an invalid checksum
Source: file.exe Static PE information: real checksum: 0x1ad89a should be: 0x1b58b7
PE file contains sections with non-standard names
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name: .idata
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name: ontajrjf
Source: file.exe Static PE information: section name: budoaocz
Source: file.exe Static PE information: section name: .taggant
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007AC06C push 749B1D27h; mov dword ptr [esp], ecx 0_2_007AC0A5
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007AC06C push 7B7796A1h; mov dword ptr [esp], ebx 0_2_007AC79F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0092A0D1 push edx; mov dword ptr [esp], 193C9507h 0_2_0092A0D7
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007AC03C push edi; mov dword ptr [esp], eax 0_2_007AC4A8
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007AC020 push eax; mov dword ptr [esp], 2DD116B9h 0_2_007AC129
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007AC020 push ecx; mov dword ptr [esp], edx 0_2_007AC609
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0092A0FA push 638B3692h; mov dword ptr [esp], edx 0_2_0092A110
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007F6015 push edx; mov dword ptr [esp], ebx 0_2_007F631C
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007F6015 push edi; mov dword ptr [esp], esi 0_2_007F6352
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007F6015 push 4DE65703h; mov dword ptr [esp], ebp 0_2_007F63A6
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007F6015 push eax; mov dword ptr [esp], ebx 0_2_007F6476
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007F6015 push ebp; mov dword ptr [esp], edi 0_2_007F649C
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007F6015 push ecx; mov dword ptr [esp], 628F8170h 0_2_007F64A2
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007F6015 push eax; mov dword ptr [esp], edi 0_2_007F64C0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007B200D push ecx; mov dword ptr [esp], esi 0_2_007B327F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00954019 push edi; mov dword ptr [esp], ebp 0_2_00954030
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00954019 push ebp; mov dword ptr [esp], esp 0_2_00954034
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009E2010 push ecx; mov dword ptr [esp], edx 0_2_009E231A
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0089005D push 54BE78F5h; mov dword ptr [esp], eax 0_2_008903DB
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0089005D push ebx; mov dword ptr [esp], edx 0_2_0089041D
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0089005D push 7967E4EFh; mov dword ptr [esp], ecx 0_2_008904F6
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0089005D push esi; mov dword ptr [esp], 534CCED9h 0_2_008904FA
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0089005D push eax; mov dword ptr [esp], ebp 0_2_0089052B
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0089005D push eax; mov dword ptr [esp], edx 0_2_00890570
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0089005D push 7F1AD491h; mov dword ptr [esp], eax 0_2_008905B5
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0089005D push 33607BB1h; mov dword ptr [esp], ecx 0_2_008905FA
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0089005D push ebx; mov dword ptr [esp], edx 0_2_00890636
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0089005D push ebp; mov dword ptr [esp], edi 0_2_0089068B
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0089005D push ecx; mov dword ptr [esp], edi 0_2_008906A5
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0099E045 push ebp; mov dword ptr [esp], eax 0_2_0099E052
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0099E045 push eax; mov dword ptr [esp], 69739E80h 0_2_0099E05C
Source: file.exe Static PE information: section name: entropy: 7.790554993050825
Source: file.exe Static PE information: section name: ontajrjf entropy: 7.953007139478122

Boot Survival
barindex
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Source: C:\Users\user\Desktop\file.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: Filemonclass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Source: C:\Users\user\Desktop\file.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7AE0A2 second address: 7AE0AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FA4392209E6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7AE0AD second address: 7AD8C1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA438C9B23Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jnl 00007FA438C9B23Ch 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 popad 0x00000016 nop 0x00000017 stc 0x00000018 clc 0x00000019 push dword ptr [ebp+122D01E9h] 0x0000001f sub dword ptr [ebp+122D192Eh], edx 0x00000025 add dword ptr [ebp+122D192Eh], edx 0x0000002b call dword ptr [ebp+122D2A1Ah] 0x00000031 pushad 0x00000032 sub dword ptr [ebp+122D1965h], edi 0x00000038 je 00007FA438C9B242h 0x0000003e jno 00007FA438C9B23Ch 0x00000044 xor eax, eax 0x00000046 mov dword ptr [ebp+122D1965h], edx 0x0000004c stc 0x0000004d mov edx, dword ptr [esp+28h] 0x00000051 xor dword ptr [ebp+122D1965h], edx 0x00000057 mov dword ptr [ebp+122D352Bh], eax 0x0000005d mov dword ptr [ebp+122D1965h], edi 0x00000063 mov esi, 0000003Ch 0x00000068 jmp 00007FA438C9B249h 0x0000006d or dword ptr [ebp+122D2A57h], esi 0x00000073 add esi, dword ptr [esp+24h] 0x00000077 mov dword ptr [ebp+122D1965h], edi 0x0000007d lodsw 0x0000007f stc 0x00000080 add eax, dword ptr [esp+24h] 0x00000084 sub dword ptr [ebp+122D1B33h], ecx 0x0000008a sub dword ptr [ebp+122D1910h], esi 0x00000090 mov ebx, dword ptr [esp+24h] 0x00000094 sub dword ptr [ebp+122D2A57h], edx 0x0000009a nop 0x0000009b pushad 0x0000009c push eax 0x0000009d push edx 0x0000009e pushad 0x0000009f popad 0x000000a0 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7AD8C1 second address: 7AD8CB instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7AD8CB second address: 7AD8F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jno 00007FA438C9B24Dh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 92D774 second address: 92D778 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 92D778 second address: 92D78D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA438C9B241h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 92D78D second address: 92D79F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jnp 00007FA4392209E6h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push esi 0x00000011 pop esi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 92D79F second address: 92D7B6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnl 00007FA438C9B241h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 92D7B6 second address: 92D7BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 92D7BC second address: 92D7C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 920CA4 second address: 920CB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FA4392209EEh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 920CB7 second address: 920CDF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007FA438C9B236h 0x00000009 push edi 0x0000000a pop edi 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 jno 00007FA438C9B242h 0x00000017 pushad 0x00000018 push eax 0x00000019 pop eax 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 92CA8C second address: 92CAA0 instructions: 0x00000000 rdtsc 0x00000002 je 00007FA4392209EEh 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 92CAA0 second address: 92CAB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA438C9B245h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 92CC23 second address: 92CC27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 92CC27 second address: 92CC58 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA438C9B245h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebx 0x0000000c pushad 0x0000000d popad 0x0000000e jne 00007FA438C9B236h 0x00000014 pop ebx 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007FA438C9B23Ah 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 92D084 second address: 92D088 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 92D088 second address: 92D098 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a ja 00007FA438C9B236h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 92FE54 second address: 92FEC8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA4392209EAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FA4392209F8h 0x0000000f nop 0x00000010 push 00000000h 0x00000012 push esi 0x00000013 call 00007FA4392209E8h 0x00000018 pop esi 0x00000019 mov dword ptr [esp+04h], esi 0x0000001d add dword ptr [esp+04h], 0000001Ch 0x00000025 inc esi 0x00000026 push esi 0x00000027 ret 0x00000028 pop esi 0x00000029 ret 0x0000002a mov esi, dword ptr [ebp+122D3593h] 0x00000030 push 00000000h 0x00000032 jnc 00007FA4392209E8h 0x00000038 push 007E7773h 0x0000003d push edx 0x0000003e push eax 0x0000003f push edx 0x00000040 jmp 00007FA4392209F0h 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 93006A second address: 93009C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jg 00007FA438C9B236h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push edx 0x00000011 push edi 0x00000012 jl 00007FA438C9B236h 0x00000018 pop edi 0x00000019 pop edx 0x0000001a mov eax, dword ptr [eax] 0x0000001c jmp 00007FA438C9B23Ch 0x00000021 mov dword ptr [esp+04h], eax 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push ebx 0x00000029 pop ebx 0x0000002a pop eax 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 93009C second address: 93015B instructions: 0x00000000 rdtsc 0x00000002 je 00007FA4392209F8h 0x00000008 jmp 00007FA4392209F2h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop eax 0x00000010 push 00000000h 0x00000012 push esi 0x00000013 call 00007FA4392209E8h 0x00000018 pop esi 0x00000019 mov dword ptr [esp+04h], esi 0x0000001d add dword ptr [esp+04h], 00000014h 0x00000025 inc esi 0x00000026 push esi 0x00000027 ret 0x00000028 pop esi 0x00000029 ret 0x0000002a xor dword ptr [ebp+122D1A2Fh], esi 0x00000030 push 00000003h 0x00000032 push 00000000h 0x00000034 push edx 0x00000035 call 00007FA4392209E8h 0x0000003a pop edx 0x0000003b mov dword ptr [esp+04h], edx 0x0000003f add dword ptr [esp+04h], 00000016h 0x00000047 inc edx 0x00000048 push edx 0x00000049 ret 0x0000004a pop edx 0x0000004b ret 0x0000004c push 00000000h 0x0000004e push 00000003h 0x00000050 call 00007FA4392209E9h 0x00000055 jnl 00007FA4392209F2h 0x0000005b push eax 0x0000005c jl 00007FA4392209F4h 0x00000062 jmp 00007FA4392209EEh 0x00000067 mov eax, dword ptr [esp+04h] 0x0000006b jmp 00007FA4392209EEh 0x00000070 mov eax, dword ptr [eax] 0x00000072 jmp 00007FA4392209EEh 0x00000077 mov dword ptr [esp+04h], eax 0x0000007b push eax 0x0000007c push edx 0x0000007d push eax 0x0000007e push edx 0x0000007f push edi 0x00000080 pop edi 0x00000081 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 93015B second address: 930165 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FA438C9B236h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9301F4 second address: 93025B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA4392209F7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c jmp 00007FA4392209F4h 0x00000011 mov ecx, 275D9DAAh 0x00000016 push 00000000h 0x00000018 jmp 00007FA4392209EDh 0x0000001d pushad 0x0000001e jne 00007FA4392209E6h 0x00000024 mov ax, bx 0x00000027 popad 0x00000028 push 7B973D73h 0x0000002d push esi 0x0000002e push eax 0x0000002f push edx 0x00000030 jmp 00007FA4392209EEh 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 93025B second address: 9302B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 xor dword ptr [esp], 7B973DF3h 0x0000000e pushad 0x0000000f mov dword ptr [ebp+12455CEBh], eax 0x00000015 mov dword ptr [ebp+122D17E8h], ebx 0x0000001b popad 0x0000001c push 00000003h 0x0000001e mov dword ptr [ebp+122D1A2Fh], ebx 0x00000024 push 00000000h 0x00000026 push 00000000h 0x00000028 push edx 0x00000029 call 00007FA438C9B238h 0x0000002e pop edx 0x0000002f mov dword ptr [esp+04h], edx 0x00000033 add dword ptr [esp+04h], 00000017h 0x0000003b inc edx 0x0000003c push edx 0x0000003d ret 0x0000003e pop edx 0x0000003f ret 0x00000040 or dword ptr [ebp+122D186Fh], esi 0x00000046 clc 0x00000047 push 00000003h 0x00000049 mov cx, 70B7h 0x0000004d push 77D5FE2Dh 0x00000052 push ecx 0x00000053 pushad 0x00000054 pushad 0x00000055 popad 0x00000056 push eax 0x00000057 push edx 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9302B8 second address: 93031B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 add dword ptr [esp], 482A01D3h 0x0000000d sub dword ptr [ebp+122D186Fh], ebx 0x00000013 jno 00007FA4392209F7h 0x00000019 lea ebx, dword ptr [ebp+12455D3Fh] 0x0000001f sub dword ptr [ebp+122D2BD9h], eax 0x00000025 mov esi, dword ptr [ebp+122D36F3h] 0x0000002b xchg eax, ebx 0x0000002c push esi 0x0000002d jmp 00007FA4392209F0h 0x00000032 pop esi 0x00000033 push eax 0x00000034 push eax 0x00000035 push edx 0x00000036 jmp 00007FA4392209F1h 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 925C83 second address: 925C9D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA438C9B244h 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 94D88C second address: 94D890 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 94D890 second address: 94D8CE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA438C9B246h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FA438C9B23Dh 0x00000010 jmp 00007FA438C9B245h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 94D8CE second address: 94D8E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FA4392209EDh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 94D8E1 second address: 94D8E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 94DC9E second address: 94DCB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA4392209F3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 94DCB5 second address: 94DCBF instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FA438C9B236h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 94E11E second address: 94E143 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA4392209F8h 0x00000007 pushad 0x00000008 jbe 00007FA4392209E6h 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 94E2CD second address: 94E2D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 94E2D7 second address: 94E2E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 jne 00007FA4392209E6h 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 94E2E4 second address: 94E2E9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 94E489 second address: 94E493 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FA4392209E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 94E493 second address: 94E4A1 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jne 00007FA438C9B236h 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 94E4A1 second address: 94E4A7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 94E5CA second address: 94E5E1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jl 00007FA438C9B236h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edi 0x0000000d push eax 0x0000000e push edx 0x0000000f jg 00007FA438C9B238h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 94E8F7 second address: 94E8FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 94E8FC second address: 94E90C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push edi 0x00000006 pop edi 0x00000007 push edx 0x00000008 pop edx 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 94EA93 second address: 94EA97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 94EA97 second address: 94EAA3 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FA438C9B236h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 94EAA3 second address: 94EAA9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 91D7AE second address: 91D7B3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 94EC03 second address: 94EC1D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FA4392209F3h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 94F24A second address: 94F24E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 94F24E second address: 94F258 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FA4392209E6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 94F57D second address: 94F583 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 94F583 second address: 94F589 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 924202 second address: 924217 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FA438C9B236h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d ja 00007FA438C9B238h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 924217 second address: 92421D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 92421D second address: 924221 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 91F24D second address: 91F253 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 91F253 second address: 91F257 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 91F257 second address: 91F25B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 958609 second address: 95860E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 958750 second address: 958770 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FA4392209F5h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 958770 second address: 9587B0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jno 00007FA438C9B236h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 jmp 00007FA438C9B248h 0x00000015 mov eax, dword ptr [eax] 0x00000017 jmp 00007FA438C9B23Dh 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 push ebx 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9587B0 second address: 9587B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 95752A second address: 95752E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9227B6 second address: 9227D0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA4392209F6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 922797 second address: 9227B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FA438C9B244h 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 95D003 second address: 95D04C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FA4392209F5h 0x0000000a jg 00007FA4392209EAh 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jo 00007FA4392209ECh 0x00000019 jne 00007FA4392209E6h 0x0000001f jmp 00007FA4392209F6h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 95D04C second address: 95D056 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FA438C9B23Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 95D182 second address: 95D188 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 95D188 second address: 95D1A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007FA438C9B242h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 95D1A0 second address: 95D1A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 96095D second address: 96096B instructions: 0x00000000 rdtsc 0x00000002 jp 00007FA438C9B236h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 96096B second address: 96096F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 96096F second address: 960973 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9609A9 second address: 9609B3 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FA4392209E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9609B3 second address: 9609D5 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FA438C9B238h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push edx 0x00000010 jmp 00007FA438C9B241h 0x00000015 pop edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9609D5 second address: 960A08 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FA4392209F3h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FA4392209F2h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 960A08 second address: 960A4C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007FA438C9B248h 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [eax] 0x0000000d jmp 00007FA438C9B23Eh 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FA438C9B240h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 960A4C second address: 960A52 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 960A52 second address: 960A78 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 jl 00007FA438C9B23Eh 0x0000000f jnl 00007FA438C9B238h 0x00000015 call 00007FA438C9B239h 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e push ecx 0x0000001f pop ecx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 960A78 second address: 960A7E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 960A7E second address: 960AAF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FA438C9B247h 0x00000008 push edx 0x00000009 pop edx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e pushad 0x0000000f push edi 0x00000010 jmp 00007FA438C9B23Bh 0x00000015 pop edi 0x00000016 push ecx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 960AAF second address: 960ABF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 960ABF second address: 960AC9 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FA438C9B236h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 960AC9 second address: 960ACF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 960ACF second address: 960AE3 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FA438C9B236h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pop edx 0x00000013 pop eax 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 960AE3 second address: 960AF7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA4392209F0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 960F4B second address: 960F5C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA438C9B23Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 960F5C second address: 960F62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 96113D second address: 961143 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 961143 second address: 961147 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 96161E second address: 961624 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 961624 second address: 961629 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 961629 second address: 961630 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 961630 second address: 96163C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 963E3F second address: 963E52 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA438C9B23Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 963545 second address: 963549 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 963549 second address: 96354D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 964918 second address: 96491C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 964677 second address: 96467B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 96491C second address: 96492C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jno 00007FA4392209E6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 96467B second address: 964681 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 96492C second address: 96493A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jne 00007FA4392209E6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 96493A second address: 9649AB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push ebx 0x0000000b call 00007FA438C9B238h 0x00000010 pop ebx 0x00000011 mov dword ptr [esp+04h], ebx 0x00000015 add dword ptr [esp+04h], 00000015h 0x0000001d inc ebx 0x0000001e push ebx 0x0000001f ret 0x00000020 pop ebx 0x00000021 ret 0x00000022 mov esi, dword ptr [ebp+122D30D6h] 0x00000028 movsx edi, di 0x0000002b push 00000000h 0x0000002d push 00000000h 0x0000002f push ecx 0x00000030 call 00007FA438C9B238h 0x00000035 pop ecx 0x00000036 mov dword ptr [esp+04h], ecx 0x0000003a add dword ptr [esp+04h], 00000018h 0x00000042 inc ecx 0x00000043 push ecx 0x00000044 ret 0x00000045 pop ecx 0x00000046 ret 0x00000047 je 00007FA438C9B238h 0x0000004d mov esi, ecx 0x0000004f push 00000000h 0x00000051 mov edi, dword ptr [ebp+122D377Bh] 0x00000057 push eax 0x00000058 push eax 0x00000059 push edx 0x0000005a pushad 0x0000005b jns 00007FA438C9B236h 0x00000061 jns 00007FA438C9B236h 0x00000067 popad 0x00000068 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9649AB second address: 9649B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9649B1 second address: 9649B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9653F0 second address: 9653FA instructions: 0x00000000 rdtsc 0x00000002 jl 00007FA4392209E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 965EFB second address: 965F00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 965C39 second address: 965C63 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jl 00007FA4392209E6h 0x00000009 jmp 00007FA4392209F4h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 jnp 00007FA4392209E6h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 966AB0 second address: 966B06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 nop 0x00000006 mov dword ptr [ebp+122D2C1Dh], ecx 0x0000000c push 00000000h 0x0000000e push 00000000h 0x00000010 push eax 0x00000011 call 00007FA438C9B238h 0x00000016 pop eax 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b add dword ptr [esp+04h], 0000001Ch 0x00000023 inc eax 0x00000024 push eax 0x00000025 ret 0x00000026 pop eax 0x00000027 ret 0x00000028 push 00000000h 0x0000002a movzx esi, dx 0x0000002d xchg eax, ebx 0x0000002e jmp 00007FA438C9B245h 0x00000033 push eax 0x00000034 push eax 0x00000035 push edx 0x00000036 pushad 0x00000037 push edi 0x00000038 pop edi 0x00000039 pushad 0x0000003a popad 0x0000003b popad 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 96AE3E second address: 96AE59 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA4392209F1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 96AE59 second address: 96AE5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 96AE5D second address: 96AEB5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 nop 0x00000008 or dword ptr [ebp+122D2400h], ebx 0x0000000e push 00000000h 0x00000010 mov dword ptr [ebp+122D3238h], esi 0x00000016 push 00000000h 0x00000018 push 00000000h 0x0000001a push ecx 0x0000001b call 00007FA4392209E8h 0x00000020 pop ecx 0x00000021 mov dword ptr [esp+04h], ecx 0x00000025 add dword ptr [esp+04h], 00000014h 0x0000002d inc ecx 0x0000002e push ecx 0x0000002f ret 0x00000030 pop ecx 0x00000031 ret 0x00000032 call 00007FA4392209F7h 0x00000037 mov ebx, 060FF57Dh 0x0000003c pop edi 0x0000003d push eax 0x0000003e push eax 0x0000003f push edx 0x00000040 push ebx 0x00000041 push ebx 0x00000042 pop ebx 0x00000043 pop ebx 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 96CE2D second address: 96CE97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FA438C9B236h 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push ecx 0x0000000e push esi 0x0000000f push eax 0x00000010 pop eax 0x00000011 pop esi 0x00000012 pop ecx 0x00000013 nop 0x00000014 push 00000000h 0x00000016 push eax 0x00000017 call 00007FA438C9B238h 0x0000001c pop eax 0x0000001d mov dword ptr [esp+04h], eax 0x00000021 add dword ptr [esp+04h], 0000001Bh 0x00000029 inc eax 0x0000002a push eax 0x0000002b ret 0x0000002c pop eax 0x0000002d ret 0x0000002e push 00000000h 0x00000030 sub dword ptr [ebp+122D2F00h], edx 0x00000036 push 00000000h 0x00000038 push 00000000h 0x0000003a push ecx 0x0000003b call 00007FA438C9B238h 0x00000040 pop ecx 0x00000041 mov dword ptr [esp+04h], ecx 0x00000045 add dword ptr [esp+04h], 00000014h 0x0000004d inc ecx 0x0000004e push ecx 0x0000004f ret 0x00000050 pop ecx 0x00000051 ret 0x00000052 xor edi, dword ptr [ebp+122D34E7h] 0x00000058 push eax 0x00000059 push eax 0x0000005a push edx 0x0000005b push edx 0x0000005c pushad 0x0000005d popad 0x0000005e pop edx 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 96DF5D second address: 96DF70 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jno 00007FA4392209E6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 96DF70 second address: 96DF76 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 96A0C2 second address: 96A0CD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jl 00007FA4392209E6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 96D070 second address: 96D075 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 96D13A second address: 96D140 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 96D140 second address: 96D144 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 96F12A second address: 96F130 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 96F130 second address: 96F198 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FA438C9B236h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d jmp 00007FA438C9B241h 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push ecx 0x00000017 call 00007FA438C9B238h 0x0000001c pop ecx 0x0000001d mov dword ptr [esp+04h], ecx 0x00000021 add dword ptr [esp+04h], 00000016h 0x00000029 inc ecx 0x0000002a push ecx 0x0000002b ret 0x0000002c pop ecx 0x0000002d ret 0x0000002e xor edi, dword ptr [ebp+122D35F3h] 0x00000034 push 00000000h 0x00000036 mov ebx, dword ptr [ebp+122D1C1Bh] 0x0000003c or dword ptr [ebp+124640C7h], ecx 0x00000042 xchg eax, esi 0x00000043 jmp 00007FA438C9B23Eh 0x00000048 push eax 0x00000049 push eax 0x0000004a pushad 0x0000004b push esi 0x0000004c pop esi 0x0000004d push eax 0x0000004e push edx 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 96E0E1 second address: 96E0FD instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FA4392209E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c jmp 00007FA4392209ECh 0x00000011 push eax 0x00000012 push edx 0x00000013 push esi 0x00000014 pop esi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 96E195 second address: 96E1A7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnl 00007FA438C9B238h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 970083 second address: 97008A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 96F33D second address: 96F373 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007FA438C9B249h 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FA438C9B244h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 97100B second address: 9710CF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA4392209EDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jp 00007FA4392209ECh 0x0000000f popad 0x00000010 mov dword ptr [esp], eax 0x00000013 sub edi, 76F6EDA2h 0x00000019 push 00000000h 0x0000001b push 00000000h 0x0000001d push esi 0x0000001e call 00007FA4392209E8h 0x00000023 pop esi 0x00000024 mov dword ptr [esp+04h], esi 0x00000028 add dword ptr [esp+04h], 00000017h 0x00000030 inc esi 0x00000031 push esi 0x00000032 ret 0x00000033 pop esi 0x00000034 ret 0x00000035 or dword ptr [ebp+122D1924h], ecx 0x0000003b push ebx 0x0000003c jne 00007FA4392209F9h 0x00000042 pop ebx 0x00000043 push 00000000h 0x00000045 push 00000000h 0x00000047 push ecx 0x00000048 call 00007FA4392209E8h 0x0000004d pop ecx 0x0000004e mov dword ptr [esp+04h], ecx 0x00000052 add dword ptr [esp+04h], 00000018h 0x0000005a inc ecx 0x0000005b push ecx 0x0000005c ret 0x0000005d pop ecx 0x0000005e ret 0x0000005f mov di, bx 0x00000062 jmp 00007FA4392209F6h 0x00000067 sub dword ptr [ebp+122D2DABh], ecx 0x0000006d xchg eax, esi 0x0000006e jo 00007FA4392209EEh 0x00000074 jnc 00007FA4392209E8h 0x0000007a push eax 0x0000007b push eax 0x0000007c push edx 0x0000007d jo 00007FA4392209E8h 0x00000083 pushad 0x00000084 popad 0x00000085 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 970228 second address: 97022C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 97022C second address: 970232 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 970232 second address: 970238 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 973F20 second address: 973F25 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 973F25 second address: 973F31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 972314 second address: 972318 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 972318 second address: 97232A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a je 00007FA438C9B238h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 973169 second address: 973184 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FA4392209ECh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jnl 00007FA4392209E8h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9751EF second address: 9751F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9751F3 second address: 9751FD instructions: 0x00000000 rdtsc 0x00000002 jl 00007FA4392209E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 913880 second address: 913884 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 913884 second address: 91388C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 91388C second address: 9138B1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA438C9B23Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jg 00007FA438C9B238h 0x00000010 jo 00007FA438C9B242h 0x00000016 jns 00007FA438C9B236h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 989DEC second address: 989DFB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA4392209EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 989DFB second address: 989E02 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 989E02 second address: 989E0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 98A0C6 second address: 98A0D7 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FA438C9B236h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 99155E second address: 991562 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 992E39 second address: 992E3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 992E3D second address: 992E41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 992E41 second address: 992E54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jc 00007FA438C9B236h 0x00000010 push edx 0x00000011 pop edx 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 992E54 second address: 992E6A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA4392209EAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push ecx 0x0000000e push ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 992E6A second address: 992E98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop ecx 0x00000006 mov eax, dword ptr [eax] 0x00000008 push ecx 0x00000009 jnl 00007FA438C9B238h 0x0000000f pop ecx 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007FA438C9B245h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 992E98 second address: 992EB1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA4392209F2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 992F4D second address: 992F6A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FA438C9B248h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 992F6A second address: 992F9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jmp 00007FA4392209F6h 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 pushad 0x00000012 js 00007FA4392209E8h 0x00000018 pushad 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c js 00007FA4392209E6h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 992F9D second address: 992FD0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 jmp 00007FA438C9B248h 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jns 00007FA438C9B23Ch 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 992FD0 second address: 992FD6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 992FD6 second address: 992FDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 99312A second address: 993162 instructions: 0x00000000 rdtsc 0x00000002 je 00007FA4392209F7h 0x00000008 jmp 00007FA4392209F1h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 pushad 0x00000014 pushad 0x00000015 jnc 00007FA4392209E6h 0x0000001b jmp 00007FA4392209EDh 0x00000020 popad 0x00000021 push ecx 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 993162 second address: 7AD8C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 pop eax 0x00000007 cld 0x00000008 push dword ptr [ebp+122D01E9h] 0x0000000e jmp 00007FA438C9B244h 0x00000013 call dword ptr [ebp+122D2A1Ah] 0x00000019 pushad 0x0000001a sub dword ptr [ebp+122D1965h], edi 0x00000020 je 00007FA438C9B242h 0x00000026 jno 00007FA438C9B23Ch 0x0000002c xor eax, eax 0x0000002e mov dword ptr [ebp+122D1965h], edx 0x00000034 stc 0x00000035 mov edx, dword ptr [esp+28h] 0x00000039 xor dword ptr [ebp+122D1965h], edx 0x0000003f mov dword ptr [ebp+122D352Bh], eax 0x00000045 mov dword ptr [ebp+122D1965h], edi 0x0000004b mov esi, 0000003Ch 0x00000050 jmp 00007FA438C9B249h 0x00000055 or dword ptr [ebp+122D2A57h], esi 0x0000005b add esi, dword ptr [esp+24h] 0x0000005f mov dword ptr [ebp+122D1965h], edi 0x00000065 lodsw 0x00000067 stc 0x00000068 add eax, dword ptr [esp+24h] 0x0000006c sub dword ptr [ebp+122D1B33h], ecx 0x00000072 sub dword ptr [ebp+122D1910h], esi 0x00000078 mov ebx, dword ptr [esp+24h] 0x0000007c sub dword ptr [ebp+122D2A57h], edx 0x00000082 nop 0x00000083 pushad 0x00000084 push eax 0x00000085 push edx 0x00000086 pushad 0x00000087 popad 0x00000088 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 996EB9 second address: 996EBF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9973F4 second address: 997406 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pushad 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a jne 00007FA438C9B236h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 99756F second address: 99758C instructions: 0x00000000 rdtsc 0x00000002 jne 00007FA4392209E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push edi 0x0000000c pop edi 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007FA4392209EDh 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9976AF second address: 9976B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9976B5 second address: 9976C3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9976C3 second address: 9976C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9976C7 second address: 9976CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9976CB second address: 9976D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9976D1 second address: 9976F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push esi 0x00000006 pop esi 0x00000007 jnc 00007FA4392209E6h 0x0000000d push eax 0x0000000e pop eax 0x0000000f popad 0x00000010 ja 00007FA4392209E8h 0x00000016 pushad 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push eax 0x0000001b push edx 0x0000001c push edi 0x0000001d push eax 0x0000001e pop eax 0x0000001f pop edi 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9976F1 second address: 9976FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007FA438C9B236h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 997971 second address: 997977 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 997977 second address: 997994 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FA438C9B238h 0x00000008 jnl 00007FA438C9B238h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 jnp 00007FA438C9B236h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 997AFE second address: 997B39 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FA4392209E6h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push esi 0x0000000d jnl 00007FA4392209E6h 0x00000013 pop esi 0x00000014 jne 00007FA4392209E8h 0x0000001a push ebx 0x0000001b pop ebx 0x0000001c popad 0x0000001d push ebx 0x0000001e jmp 00007FA4392209F8h 0x00000023 pushad 0x00000024 push eax 0x00000025 pop eax 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 997B39 second address: 997B3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 997E1C second address: 997E20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 99D874 second address: 99D88E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FA438C9B23Fh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 99D88E second address: 99D892 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 99D892 second address: 99D89E instructions: 0x00000000 rdtsc 0x00000002 jng 00007FA438C9B236h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 99C336 second address: 99C348 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jns 00007FA4392209E6h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 99C348 second address: 99C34E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 99C34E second address: 99C358 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FA4392209ECh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 99C4F3 second address: 99C51A instructions: 0x00000000 rdtsc 0x00000002 jc 00007FA438C9B236h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e jmp 00007FA438C9B249h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 99C51A second address: 99C520 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 99C661 second address: 99C667 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 99C7B7 second address: 99C7E1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA4392209EAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a jmp 00007FA4392209F7h 0x0000000f push eax 0x00000010 push edx 0x00000011 push edx 0x00000012 pop edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 99C7E1 second address: 99C7E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 99C942 second address: 99C964 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FA4392209F7h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 99C964 second address: 99C968 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 99CAAE second address: 99CABA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 99CABA second address: 99CAC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FA438C9B236h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 99CAC4 second address: 99CADD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA4392209F3h 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 99CADD second address: 99CAE2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 99CC15 second address: 99CC3D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA4392209F7h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebx 0x0000000c pushad 0x0000000d pushad 0x0000000e jp 00007FA4392209E6h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 99CC3D second address: 99CC5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA438C9B23Ch 0x00000009 popad 0x0000000a pushad 0x0000000b jo 00007FA438C9B236h 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 99CDF0 second address: 99CDF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 99CDF4 second address: 99CDF8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 99CDF8 second address: 99CDFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 99CF43 second address: 99CF4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FA438C9B236h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 99CF4D second address: 99CF66 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FA4392209FBh 0x00000008 jmp 00007FA4392209EFh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 99D232 second address: 99D23A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 99D23A second address: 99D24D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 pushad 0x00000007 popad 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d js 00007FA4392209E6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 99BEA5 second address: 99BEC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FA438C9B236h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jc 00007FA438C9B236h 0x00000015 jnc 00007FA438C9B236h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9A8C91 second address: 9A8C95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9A7A74 second address: 9A7A8C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jng 00007FA438C9B236h 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 jg 00007FA438C9B236h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9ACC5C second address: 9ACC62 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9ACC62 second address: 9ACC8D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FA438C9B249h 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jl 00007FA438C9B236h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9ACC8D second address: 9ACC93 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 95DCAA second address: 95DCB0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 95DCB0 second address: 95DCB7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 95E210 second address: 95E229 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA438C9B245h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 95E229 second address: 95E24F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA4392209F5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jne 00007FA4392209E6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 95E24F second address: 95E255 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 95E255 second address: 7AD8C1 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FA4392209FBh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b or dword ptr [ebp+122D2C21h], edi 0x00000011 push dword ptr [ebp+122D01E9h] 0x00000017 push 00000000h 0x00000019 push edx 0x0000001a call 00007FA4392209E8h 0x0000001f pop edx 0x00000020 mov dword ptr [esp+04h], edx 0x00000024 add dword ptr [esp+04h], 0000001Dh 0x0000002c inc edx 0x0000002d push edx 0x0000002e ret 0x0000002f pop edx 0x00000030 ret 0x00000031 call dword ptr [ebp+122D2A1Ah] 0x00000037 pushad 0x00000038 sub dword ptr [ebp+122D1965h], edi 0x0000003e je 00007FA4392209F2h 0x00000044 jno 00007FA4392209ECh 0x0000004a xor eax, eax 0x0000004c mov dword ptr [ebp+122D1965h], edx 0x00000052 stc 0x00000053 mov edx, dword ptr [esp+28h] 0x00000057 xor dword ptr [ebp+122D1965h], edx 0x0000005d mov dword ptr [ebp+122D352Bh], eax 0x00000063 mov dword ptr [ebp+122D1965h], edi 0x00000069 mov esi, 0000003Ch 0x0000006e jmp 00007FA4392209F9h 0x00000073 or dword ptr [ebp+122D2A57h], esi 0x00000079 add esi, dword ptr [esp+24h] 0x0000007d mov dword ptr [ebp+122D1965h], edi 0x00000083 lodsw 0x00000085 stc 0x00000086 add eax, dword ptr [esp+24h] 0x0000008a sub dword ptr [ebp+122D1B33h], ecx 0x00000090 sub dword ptr [ebp+122D1910h], esi 0x00000096 mov ebx, dword ptr [esp+24h] 0x0000009a sub dword ptr [ebp+122D2A57h], edx 0x000000a0 nop 0x000000a1 pushad 0x000000a2 push eax 0x000000a3 push edx 0x000000a4 pushad 0x000000a5 popad 0x000000a6 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 95E4DB second address: 95E4DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 95E86E second address: 95E8E0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA4392209F1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d ja 00007FA4392209ECh 0x00000013 push 00000004h 0x00000015 push 00000000h 0x00000017 push edi 0x00000018 call 00007FA4392209E8h 0x0000001d pop edi 0x0000001e mov dword ptr [esp+04h], edi 0x00000022 add dword ptr [esp+04h], 0000001Bh 0x0000002a inc edi 0x0000002b push edi 0x0000002c ret 0x0000002d pop edi 0x0000002e ret 0x0000002f call 00007FA4392209EAh 0x00000034 mov dword ptr [ebp+122D1965h], ebx 0x0000003a pop edx 0x0000003b push eax 0x0000003c push eax 0x0000003d push edx 0x0000003e pushad 0x0000003f jmp 00007FA4392209F0h 0x00000044 pushad 0x00000045 popad 0x00000046 popad 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 95E8E0 second address: 95E8E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 95E8E6 second address: 95E8EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 95EE72 second address: 95EE7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007FA438C9B236h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9AD24E second address: 9AD254 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9AD254 second address: 9AD258 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9AD258 second address: 9AD290 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA4392209F5h 0x00000007 js 00007FA4392209E6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007FA4392209F6h 0x00000014 push ebx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9AD290 second address: 9AD2B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 jmp 00007FA438C9B249h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9AD804 second address: 9AD822 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FA4392209EEh 0x0000000a pop ebx 0x0000000b pushad 0x0000000c push esi 0x0000000d jne 00007FA4392209E6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9AD822 second address: 9AD836 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 push edi 0x00000007 pop edi 0x00000008 je 00007FA438C9B236h 0x0000000e popad 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9B0AB2 second address: 9B0AB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9B35CB second address: 9B35D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9B384B second address: 9B384F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9B384F second address: 9B3861 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA438C9B23Ch 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9B3A03 second address: 9B3A09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9BA1CB second address: 9BA1F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 ja 00007FA438C9B253h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9B8C80 second address: 9B8C8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 js 00007FA4392209E6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9B8C8E second address: 9B8CAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA438C9B249h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9B8CAD second address: 9B8CB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9B8CB2 second address: 9B8CB9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9B8CB9 second address: 9B8CBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 95EA93 second address: 95EB1C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push eax 0x0000000d call 00007FA438C9B238h 0x00000012 pop eax 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 add dword ptr [esp+04h], 00000019h 0x0000001f inc eax 0x00000020 push eax 0x00000021 ret 0x00000022 pop eax 0x00000023 ret 0x00000024 mov edi, dword ptr [ebp+122D17EDh] 0x0000002a mov ebx, dword ptr [ebp+12483A8Dh] 0x00000030 push 00000000h 0x00000032 push edx 0x00000033 call 00007FA438C9B238h 0x00000038 pop edx 0x00000039 mov dword ptr [esp+04h], edx 0x0000003d add dword ptr [esp+04h], 00000016h 0x00000045 inc edx 0x00000046 push edx 0x00000047 ret 0x00000048 pop edx 0x00000049 ret 0x0000004a mov ecx, dword ptr [ebp+122D37D3h] 0x00000050 add eax, ebx 0x00000052 push 00000000h 0x00000054 push ecx 0x00000055 call 00007FA438C9B238h 0x0000005a pop ecx 0x0000005b mov dword ptr [esp+04h], ecx 0x0000005f add dword ptr [esp+04h], 00000015h 0x00000067 inc ecx 0x00000068 push ecx 0x00000069 ret 0x0000006a pop ecx 0x0000006b ret 0x0000006c nop 0x0000006d push eax 0x0000006e push edx 0x0000006f jns 00007FA438C9B23Ch 0x00000075 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 95EB1C second address: 95EB39 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA4392209F3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9BDC2B second address: 9BDC34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9BDC34 second address: 9BDC3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FA4392209E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9BD66B second address: 9BD693 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 jnl 00007FA438C9B251h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9BD693 second address: 9BD6A2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 pop eax 0x00000009 push edi 0x0000000a pop edi 0x0000000b popad 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9BD6A2 second address: 9BD6B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jnc 00007FA438C9B238h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9C11B4 second address: 9C11BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9C11BA second address: 9C11BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9C8890 second address: 9C88A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jg 00007FA4392209EEh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9C88A3 second address: 9C88AC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push edx 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9C6BF5 second address: 9C6C10 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA4392209F5h 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9C6E9D second address: 9C6EE6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FA438C9B248h 0x0000000d jng 00007FA438C9B242h 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FA438C9B244h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9C7A71 second address: 9C7A98 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jns 00007FA4392209E6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop esi 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FA4392209F8h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9C85E4 second address: 9C85EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9D1708 second address: 9D170D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9D07CE second address: 9D07D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9D07D2 second address: 9D080E instructions: 0x00000000 rdtsc 0x00000002 jns 00007FA4392209E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007FA4392209F4h 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 jmp 00007FA4392209F9h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9D080E second address: 9D0816 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9D09AE second address: 9D09C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA4392209F1h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9D09C5 second address: 9D0A0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FA438C9B245h 0x0000000d pushad 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 jmp 00007FA438C9B244h 0x00000015 jmp 00007FA438C9B245h 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9D0A0F second address: 9D0A2C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA4392209F3h 0x00000007 push eax 0x00000008 push edx 0x00000009 jne 00007FA4392209E6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9D0E40 second address: 9D0E46 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9D9BAE second address: 9D9BB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9D9BB7 second address: 9D9BBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9D9BBD second address: 9D9BD4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA4392209F3h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9D838C second address: 9D8392 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9D8392 second address: 9D839A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9D839A second address: 9D83A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FA438C9B236h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9D8583 second address: 9D858F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jnc 00007FA4392209E6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9D858F second address: 9D8593 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9D9A2E second address: 9D9A34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9DE8B7 second address: 9DE8BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9DE8BD second address: 9DE8CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jbe 00007FA4392209EAh 0x0000000d push eax 0x0000000e pop eax 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9DE8CE second address: 9DE8E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA438C9B247h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9E1676 second address: 9E1680 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FA4392209E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9EFDBA second address: 9EFDF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push ecx 0x0000000a jmp 00007FA438C9B246h 0x0000000f jmp 00007FA438C9B246h 0x00000014 pop ecx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9EFDF1 second address: 9EFE15 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA4392209EFh 0x00000007 pushad 0x00000008 push edx 0x00000009 pop edx 0x0000000a jmp 00007FA4392209EEh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9F2B2F second address: 9F2B4B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA438C9B23Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a js 00007FA438C9B25Ah 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 pop eax 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9F2B4B second address: 9F2B4F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9F2568 second address: 9F256D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9F256D second address: 9F2573 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9F26E1 second address: 9F26F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push edx 0x00000009 pop edx 0x0000000a push eax 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9F5DB0 second address: 9F5DC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jnc 00007FA4392209E6h 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9F5DC0 second address: 9F5DC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9F5DC5 second address: 9F5DCA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9F5F3B second address: 9F5F5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA438C9B245h 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9F5F5B second address: 9F5F5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A0418D second address: A04195 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A04195 second address: A0419F instructions: 0x00000000 rdtsc 0x00000002 jo 00007FA4392209EEh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A08DF5 second address: A08E10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FA438C9B243h 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A08FA5 second address: A08FAB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A09126 second address: A09130 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FA438C9B236h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A09130 second address: A09153 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FA4392209F3h 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e pop edi 0x0000000f jnl 00007FA4392209E6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A09415 second address: A09419 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A09419 second address: A0941D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A0941D second address: A09450 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA438C9B243h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FA438C9B246h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A09450 second address: A09454 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A09599 second address: A095AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FA438C9B236h 0x0000000a popad 0x0000000b pushad 0x0000000c push edi 0x0000000d pop edi 0x0000000e push esi 0x0000000f pop esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A095AB second address: A095B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A095B0 second address: A095B5 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A095B5 second address: A095DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop ecx 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jl 00007FA439220A08h 0x0000000f pushad 0x00000010 jmp 00007FA4392209F8h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A09733 second address: A09782 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA438C9B23Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c jnc 00007FA438C9B236h 0x00000012 pop edx 0x00000013 pushad 0x00000014 jmp 00007FA438C9B248h 0x00000019 push esi 0x0000001a pop esi 0x0000001b push edi 0x0000001c pop edi 0x0000001d popad 0x0000001e popad 0x0000001f pushad 0x00000020 jo 00007FA438C9B23Eh 0x00000026 push edi 0x00000027 pop edi 0x00000028 jne 00007FA438C9B236h 0x0000002e push eax 0x0000002f push edx 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A09782 second address: A09788 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A0A3DC second address: A0A3E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A0CC15 second address: A0CC2B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA4392209F2h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A10E24 second address: A10E41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 popad 0x00000008 push edx 0x00000009 pop edx 0x0000000a popad 0x0000000b pop edx 0x0000000c pushad 0x0000000d jmp 00007FA438C9B23Bh 0x00000012 pushad 0x00000013 push esi 0x00000014 pop esi 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A10E41 second address: A10E47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A10A06 second address: A10A23 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FA438C9B24Fh 0x00000008 jmp 00007FA438C9B243h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A1907C second address: A19083 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A19083 second address: A19091 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A19091 second address: A1909B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FA4392209E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A1909B second address: A190BC instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FA438C9B241h 0x0000000c push edx 0x0000000d pop edx 0x0000000e jo 00007FA438C9B236h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A1DB0C second address: A1DB11 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A1F4EE second address: A1F4F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A1F4F5 second address: A1F4FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A1F4FB second address: A1F501 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A1F367 second address: A1F384 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA4392209F7h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A218ED second address: A218F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A218F1 second address: A218F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 91A310 second address: 91A314 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 91A314 second address: 91A33E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007FA4392209EAh 0x0000000e pushad 0x0000000f popad 0x00000010 jmp 00007FA4392209F4h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 91A33E second address: 91A343 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A2D65A second address: A2D665 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A2D665 second address: A2D66B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A3476C second address: A34775 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A34A7F second address: A34A8F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007FA438C9B236h 0x0000000a jbe 00007FA438C9B236h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A34C39 second address: A34C3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A34F09 second address: A34F0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A34F0F second address: A34F1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A34F1A second address: A34F24 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FA438C9B236h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A34F24 second address: A34F61 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FA439220A01h 0x00000008 jmp 00007FA4392209F5h 0x0000000d jbe 00007FA4392209E6h 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push ebx 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FA4392209F5h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A3509C second address: A350A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A3D570 second address: A3D57A instructions: 0x00000000 rdtsc 0x00000002 je 00007FA4392209E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A3ED99 second address: A3EDA5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A3EDA5 second address: A3EDA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A3EDA9 second address: A3EDBF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA438C9B242h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A42502 second address: A4251E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push edi 0x00000008 push eax 0x00000009 pop eax 0x0000000a jbe 00007FA4392209E6h 0x00000010 pop edi 0x00000011 popad 0x00000012 push edx 0x00000013 pushad 0x00000014 jl 00007FA4392209E6h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A4251E second address: A42524 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A3958F second address: A39599 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A39400 second address: A39429 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FA438C9B24Fh 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007FA438C9B247h 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push ebx 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 pop ebx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A39429 second address: A39448 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA4392209F9h 0x00000009 push eax 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9637E2 second address: 9637E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Tries to evade debugger and weak emulator (self modifying code)
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: 7AD86A instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: 7AD947 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: 9586CE instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: 9E2EAD instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: 7B48DE instructions caused by: Self-modifying code
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\file.exe Memory allocated: 53A0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\file.exe Memory allocated: 5590000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\file.exe Memory allocated: 7590000 memory reserve | memory write watch Jump to behavior
Contains capabilities to detect virtual machines
Source: C:\Users\user\Desktop\file.exe Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc Jump to behavior
Source: C:\Users\user\Desktop\file.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion Jump to behavior
Source: C:\Users\user\Desktop\file.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007B291C rdtsc 0_2_007B291C
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\file.exe Thread delayed: delay time: 922337203685477 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\file.exe TID: 5512 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Users\user\Desktop\file.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0098CD81 GetSystemInfo,VirtualAlloc, 0_2_0098CD81
Source: C:\Users\user\Desktop\file.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: file.exe, file.exe, 00000000.00000002.2240002018.0000000000934000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.2240002018.0000000000934000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: C:\Users\user\Desktop\file.exe System information queried: ModuleInformation Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging
barindex
Hides threads from debuggers
Source: C:\Users\user\Desktop\file.exe Thread information set: HideFromDebugger Jump to behavior
Tries to detect sandboxes and other dynamic analysis tools (window names)
Source: C:\Users\user\Desktop\file.exe Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe Open window title or class name: file monitor - sysinternals: www.sysinternals.com
Checks for debuggers (devices)
Source: C:\Users\user\Desktop\file.exe File opened: NTICE
Source: C:\Users\user\Desktop\file.exe File opened: SICE
Source: C:\Users\user\Desktop\file.exe File opened: SIWVID
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\file.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007B291C rdtsc 0_2_007B291C
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_007AB97C LdrInitializeThunk, 0_2_007AB97C
Enables debug privileges
Source: C:\Users\user\Desktop\file.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\file.exe Memory allocated: page read and write | page guard Jump to behavior
Source: file.exe, file.exe, 00000000.00000002.2240002018.0000000000934000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: ZProgram Manager
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00983842 GetSystemTime,GetFileTime, 0_2_00983842

Lowering of HIPS / PFW / Operating System Security Settings
barindex
Disable Windows Defender notifications (registry)
Source: C:\Users\user\Desktop\file.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1 Jump to behavior
Disable Windows Defender real time protection (registry)
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection Registry value created: DisableIOAVProtection 1 Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection Registry value created: DisableRealtimeMonitoring 1 Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications Registry value created: DisableNotifications 1 Jump to behavior
Disables Windows Defender Tamper protection
Source: C:\Users\user\Desktop\file.exe Registry value created: TamperProtection 0 Jump to behavior
Modifies windows update settings
Source: C:\Users\user\Desktop\file.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions Jump to behavior
Source: C:\Users\user\Desktop\file.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates Jump to behavior
Source: C:\Users\user\Desktop\file.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1532740 Sample: file.exe Startdate: 13/10/2024 Architecture: WINDOWS Score: 100 11 Antivirus / Scanner detection for submitted sample 2->11 13 Machine Learning detection for sample 2->13 15 PE file contains section with special chars 2->15 17 AI detected suspicious sample 2->17 5 file.exe 9 1 2->5         started        process3 file4 9 C:\Users\user\AppData\Local\...\file.exe.log, CSV 5->9 dropped 19 Detected unpacking (changes PE section rights) 5->19 21 Tries to detect sandboxes and other dynamic analysis tools (window names) 5->21 23 Modifies windows update settings 5->23 25 8 other signatures 5->25 signatures5
⊘No contacted IP infos