Windows Analysis Report
file.exe

Overview

General Information

Sample name: file.exe
Analysis ID: 1538053
MD5: 87988911910daf2d730b3ca1d029c15b
SHA1: 796d1f151f6551c8df179d9dc0b36ff72dbc71d8
SHA256: 579817d9822bf05bd0f22d92d924229e99bad4ddfe68a484b4db8cb62f91ea2b
Tags: exeuser-Bitsight
Infos:

Detection

Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Detected unpacking (changes PE section rights)
AI detected suspicious sample
Disable Windows Defender notifications (registry)
Disable Windows Defender real time protection (registry)
Disables Windows Defender Tamper protection
Hides threads from debuggers
Machine Learning detection for sample
Modifies windows update settings
PE file contains section with special chars
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Allocates memory with a write watch (potentially for evading sandboxes)
Checks for debuggers (devices)
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality for execution timing, often used to detect debuggers
Contains long sleeps (>= 3 min)
Detected potential crypto function
Enables debug privileges
Entry point lies outside standard sections
Found potential string decryption / allocating functions
May sleep (evasive loops) to hinder dynamic analysis
PE file contains an invalid checksum
PE file contains sections with non-standard names
Sample file is different than original file name gathered from version info
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: file.exe Avira: detected
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for sample
Source: file.exe Joe Sandbox ML: detected
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00AA4B9F CryptVerifySignatureA, 0_2_00AA4B9F
Source: Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: file.exe, 00000000.00000002.1810276265.00000000008C2000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1677306944.0000000005340000.00000004.00001000.00020000.00000000.sdmp

System Summary
barindex
PE file contains section with special chars
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name: .idata
Source: file.exe Static PE information: section name:
Detected potential crypto function
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009B6090 0_2_009B6090
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009560B2 0_2_009560B2
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009C40B4 0_2_009C40B4
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009280A0 0_2_009280A0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009C00A9 0_2_009C00A9
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0096C0A1 0_2_0096C0A1
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A02098 0_2_00A02098
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A1609B 0_2_00A1609B
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009940DB 0_2_009940DB
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009500CC 0_2_009500CC
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0095A0E0 0_2_0095A0E0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008D800B 0_2_008D800B
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00954009 0_2_00954009
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0093603D 0_2_0093603D
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0092202E 0_2_0092202E
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008F604F 0_2_008F604F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0093E05F 0_2_0093E05F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00960042 0_2_00960042
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0096A042 0_2_0096A042
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00926045 0_2_00926045
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A00079 0_2_00A00079
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008EC053 0_2_008EC053
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008E406A 0_2_008E406A
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A32044 0_2_00A32044
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009C6072 0_2_009C6072
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009CE073 0_2_009CE073
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0098C064 0_2_0098C064
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009681B8 0_2_009681B8
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009B41AE 0_2_009B41AE
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009FA1A5 0_2_009FA1A5
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009BE1DC 0_2_009BE1DC
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A221F7 0_2_00A221F7
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009441F0 0_2_009441F0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0090C10A 0_2_0090C10A
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0094210A 0_2_0094210A
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0099013A 0_2_0099013A
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00934120 0_2_00934120
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009AC153 0_2_009AC153
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0098A156 0_2_0098A156
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008D6158 0_2_008D6158
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0095C14F 0_2_0095C14F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009AE171 0_2_009AE171
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008F0178 0_2_008F0178
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008FC28E 0_2_008FC28E
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A262B2 0_2_00A262B2
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0099628C 0_2_0099628C
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00904286 0_2_00904286
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A002B7 0_2_00A002B7
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009142A8 0_2_009142A8
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009402DA 0_2_009402DA
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009762C4 0_2_009762C4
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009322C5 0_2_009322C5
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A1A2FB 0_2_00A1A2FB
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009AA2FF 0_2_009AA2FF
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A082CE 0_2_00A082CE
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A0A2CE 0_2_00A0A2CE
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009A42E9 0_2_009A42E9
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A102D9 0_2_00A102D9
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009A021C 0_2_009A021C
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00952218 0_2_00952218
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0098E215 0_2_0098E215
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009DE20A 0_2_009DE20A
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009F6206 0_2_009F6206
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0093C20C 0_2_0093C20C
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00916236 0_2_00916236
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A18211 0_2_00A18211
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00988229 0_2_00988229
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009F222C 0_2_009F222C
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0096622E 0_2_0096622E
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00998221 0_2_00998221
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008E024C 0_2_008E024C
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A1C267 0_2_00A1C267
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0097225E 0_2_0097225E
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0093425C 0_2_0093425C
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009BC248 0_2_009BC248
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0098424F 0_2_0098424F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009D0241 0_2_009D0241
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009E2243 0_2_009E2243
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008F2251 0_2_008F2251
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00910271 0_2_00910271
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009A827D 0_2_009A827D
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A1E24F 0_2_00A1E24F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0097C266 0_2_0097C266
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00980265 0_2_00980265
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009C838A 0_2_009C838A
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00982385 0_2_00982385
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009A03B9 0_2_009A03B9
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009EA3BB 0_2_009EA3BB
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009D83DA 0_2_009D83DA
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A243E5 0_2_00A243E5
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0092A3DB 0_2_0092A3DB
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009E43CC 0_2_009E43CC
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009583C0 0_2_009583C0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0093E3CD 0_2_0093E3CD
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009D03FD 0_2_009D03FD
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008EC3E5 0_2_008EC3E5
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0095E3E2 0_2_0095E3E2
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0090A311 0_2_0090A311
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A12337 0_2_00A12337
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0090830D 0_2_0090830D
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A06311 0_2_00A06311
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00992321 0_2_00992321
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009B435B 0_2_009B435B
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0091C341 0_2_0091C341
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00960371 0_2_00960371
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0097437A 0_2_0097437A
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0096E378 0_2_0096E378
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00956367 0_2_00956367
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008E2379 0_2_008E2379
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009F4362 0_2_009F4362
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00900497 0_2_00900497
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A044B7 0_2_00A044B7
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0094C48F 0_2_0094C48F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A30488 0_2_00A30488
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009904B6 0_2_009904B6
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009944DA 0_2_009944DA
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008EA4D4 0_2_008EA4D4
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009684FE 0_2_009684FE
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A004CB 0_2_00A004CB
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009384E6 0_2_009384E6
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009EE4EB 0_2_009EE4EB
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009984EF 0_2_009984EF
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0097A41D 0_2_0097A41D
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A0242B 0_2_00A0242B
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009A6415 0_2_009A6415
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009E643E 0_2_009E643E
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00992438 0_2_00992438
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0096C43B 0_2_0096C43B
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009F8423 0_2_009F8423
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0090E447 0_2_0090E447
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0094244C 0_2_0094244C
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0095A44A 0_2_0095A44A
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00936470 0_2_00936470
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0092E46A 0_2_0092E46A
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009A2466 0_2_009A2466
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009C459B 0_2_009C459B
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0092259B 0_2_0092259B
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00948598 0_2_00948598
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A145AD 0_2_00A145AD
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009725B3 0_2_009725B3
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0098C5B1 0_2_0098C5B1
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009805DF 0_2_009805DF
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009965D4 0_2_009965D4
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A185F1 0_2_00A185F1
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009125C3 0_2_009125C3
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009C05C2 0_2_009C05C2
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009465F5 0_2_009465F5
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009085F5 0_2_009085F5
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0096E5FA 0_2_0096E5FA
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0098A51E 0_2_0098A51E
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A0652F 0_2_00A0652F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008FC519 0_2_008FC519
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0094450B 0_2_0094450B
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00964525 0_2_00964525
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009E052D 0_2_009E052D
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00930525 0_2_00930525
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00966555 0_2_00966555
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009F257D 0_2_009F257D
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0090657F 0_2_0090657F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0096A567 0_2_0096A567
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009AC56C 0_2_009AC56C
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0091669D 0_2_0091669D
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009766A0 0_2_009766A0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0099A6A1 0_2_0099A6A1
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009046A9 0_2_009046A9
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008E86CB 0_2_008E86CB
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A086E6 0_2_00A086E6
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A126ED 0_2_00A126ED
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009346F4 0_2_009346F4
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009CA6F4 0_2_009CA6F4
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A226CC 0_2_00A226CC
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00902614 0_2_00902614
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009EC619 0_2_009EC619
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0097060B 0_2_0097060B
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009BE63A 0_2_009BE63A
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009D263F 0_2_009D263F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0091463D 0_2_0091463D
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009FE633 0_2_009FE633
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008FE620 0_2_008FE620
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009AA62D 0_2_009AA62D
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00926656 0_2_00926656
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0098465D 0_2_0098465D
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009D0658 0_2_009D0658
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009BA650 0_2_009BA650
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0097C671 0_2_0097C671
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008EE67E 0_2_008EE67E
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008F267A 0_2_008F267A
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0097A662 0_2_0097A662
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009E2668 0_2_009E2668
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0091066C 0_2_0091066C
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009CC791 0_2_009CC791
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009E4781 0_2_009E4781
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009DC7BD 0_2_009DC7BD
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009EA7B0 0_2_009EA7B0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A3A79B 0_2_00A3A79B
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009FA7A7 0_2_009FA7A7
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008DC7DF 0_2_008DC7DF
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0092C7F1 0_2_0092C7F1
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A0C7C8 0_2_00A0C7C8
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009787EA 0_2_009787EA
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009B471A 0_2_009B471A
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008EC70B 0_2_008EC70B
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00982701 0_2_00982701
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009AE703 0_2_009AE703
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00962736 0_2_00962736
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0099E738 0_2_0099E738
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00952724 0_2_00952724
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00920725 0_2_00920725
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A26766 0_2_00A26766
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009A0751 0_2_009A0751
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008FE75B 0_2_008FE75B
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A10759 0_2_00A10759
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009A8761 0_2_009A8761
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0095A769 0_2_0095A769
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008EC89A 0_2_008EC89A
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0094A881 0_2_0094A881
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0092488E 0_2_0092488E
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0093888F 0_2_0093888F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009B2886 0_2_009B2886
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009F08AF 0_2_009F08AF
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0093E8C7 0_2_0093E8C7
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009708CE 0_2_009708CE
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009968F5 0_2_009968F5
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009728E4 0_2_009728E4
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0094C8EC 0_2_0094C8EC
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009E0811 0_2_009E0811
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0092A835 0_2_0092A835
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009A4830 0_2_009A4830
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008D8822 0_2_008D8822
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008E483B 0_2_008E483B
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0091C852 0_2_0091C852
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0097A854 0_2_0097A854
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008EA85F 0_2_008EA85F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00908845 0_2_00908845
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009E6849 0_2_009E6849
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0095884D 0_2_0095884D
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009F2877 0_2_009F2877
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009C6877 0_2_009C6877
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A2485E 0_2_00A2485E
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00912994 0_2_00912994
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00992983 0_2_00992983
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0090C98C 0_2_0090C98C
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00998987 0_2_00998987
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0098C9B4 0_2_0098C9B4
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A14993 0_2_00A14993
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0095A9D2 0_2_0095A9D2
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009669DA 0_2_009669DA
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0097C9DB 0_2_0097C9DB
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A1E9FB 0_2_00A1E9FB
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009949C2 0_2_009949C2
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008E09D1 0_2_008E09D1
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009D09FD 0_2_009D09FD
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009F69F7 0_2_009F69F7
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0091A9EB 0_2_0091A9EB
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00954913 0_2_00954913
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009D8905 0_2_009D8905
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008E2917 0_2_008E2917
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009D6906 0_2_009D6906
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008DE92F 0_2_008DE92F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A0E902 0_2_00A0E902
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009CA931 0_2_009CA931
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00930940 0_2_00930940
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0095C949 0_2_0095C949
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009E4942 0_2_009E4942
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A0C940 0_2_00A0C940
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0090097F 0_2_0090097F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009EEA83 0_2_009EEA83
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00908AAC 0_2_00908AAC
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009A6AA4 0_2_009A6AA4
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00988ADB 0_2_00988ADB
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00986AD2 0_2_00986AD2
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009BEAC5 0_2_009BEAC5
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A1AAC7 0_2_00A1AAC7
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0099CAFE 0_2_0099CAFE
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00980AF0 0_2_00980AF0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009B0AEC 0_2_009B0AEC
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009C2AE0 0_2_009C2AE0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00928A10 0_2_00928A10
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00914A1D 0_2_00914A1D
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00990A06 0_2_00990A06
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0091EA39 0_2_0091EA39
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009BCA34 0_2_009BCA34
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A18A12 0_2_00A18A12
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009ECA23 0_2_009ECA23
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009CEA5F 0_2_009CEA5F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00922A5D 0_2_00922A5D
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008EEA5C 0_2_008EEA5C
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00982A4F 0_2_00982A4F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009BAA45 0_2_009BAA45
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009FEA75 0_2_009FEA75
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009DAA6B 0_2_009DAA6B
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0090AB91 0_2_0090AB91
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A1CBA0 0_2_00A1CBA0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009F4B87 0_2_009F4B87
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009BABBE 0_2_009BABBE
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0092CBA0 0_2_0092CBA0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0094EBA6 0_2_0094EBA6
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009FCBA8 0_2_009FCBA8
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00952BAF 0_2_00952BAF
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009B6BA0 0_2_009B6BA0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A22B9E 0_2_00A22B9E
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0096ABD6 0_2_0096ABD6
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009F8BDC 0_2_009F8BDC
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009B8BDC 0_2_009B8BDC
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009AEBD7 0_2_009AEBD7
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00984BD7 0_2_00984BD7
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009FABC8 0_2_009FABC8
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A20BF8 0_2_00A20BF8
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00904BF0 0_2_00904BF0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009A4BEB 0_2_009A4BEB
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00974BE9 0_2_00974BE9
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009ACB19 0_2_009ACB19
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0093AB09 0_2_0093AB09
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0094AB37 0_2_0094AB37
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009E2B3D 0_2_009E2B3D
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A26B0B 0_2_00A26B0B
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00978B3A 0_2_00978B3A
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00902B22 0_2_00902B22
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00956B26 0_2_00956B26
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0093CB27 0_2_0093CB27
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00984B22 0_2_00984B22
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A06B60 0_2_00A06B60
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008FEB48 0_2_008FEB48
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009C8B57 0_2_009C8B57
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008F2B5C 0_2_008F2B5C
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00948B47 0_2_00948B47
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009B4B45 0_2_009B4B45
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A12B4F 0_2_00A12B4F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008E8B7A 0_2_008E8B7A
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00934B64 0_2_00934B64
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00944B6E 0_2_00944B6E
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A38B5F 0_2_00A38B5F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009C0C96 0_2_009C0C96
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0097AC84 0_2_0097AC84
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008F8C98 0_2_008F8C98
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00924C88 0_2_00924C88
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0093EC8D 0_2_0093EC8D
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008ECCA9 0_2_008ECCA9
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008EACA7 0_2_008EACA7
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00992CB3 0_2_00992CB3
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009A0CD8 0_2_009A0CD8
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A18CE7 0_2_00A18CE7
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009F0CD8 0_2_009F0CD8
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00976CDF 0_2_00976CDF
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008F2CD6 0_2_008F2CD6
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008DECD2 0_2_008DECD2
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0091ECF5 0_2_0091ECF5
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00912CF6 0_2_00912CF6
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009F2CF1 0_2_009F2CF1
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008D8CFC 0_2_008D8CFC
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009CACEA 0_2_009CACEA
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009E0CE2 0_2_009E0CE2
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00946CEB 0_2_00946CEB
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00996C05 0_2_00996C05
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A0EC3F 0_2_00A0EC3F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009CCC3C 0_2_009CCC3C
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A04C0D 0_2_00A04C0D
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0099EC36 0_2_0099EC36
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0092AC53 0_2_0092AC53
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0095EC4D 0_2_0095EC4D
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A02C7C 0_2_00A02C7C
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00964C63 0_2_00964C63
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008FCC79 0_2_008FCC79
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00960D95 0_2_00960D95
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009F6D90 0_2_009F6D90
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0094CDBB 0_2_0094CDBB
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A02D9F 0_2_00A02D9F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008F0DEC 0_2_008F0DEC
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00996DF3 0_2_00996DF3
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00978D1D 0_2_00978D1D
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008D6D00 0_2_008D6D00
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0092ED1D 0_2_0092ED1D
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009E4D3C 0_2_009E4D3C
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00950D36 0_2_00950D36
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A1ED09 0_2_00A1ED09
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00998D35 0_2_00998D35
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A2CD0F 0_2_00A2CD0F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00996D37 0_2_00996D37
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009FED2E 0_2_009FED2E
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009A8D29 0_2_009A8D29
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008EED33 0_2_008EED33
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A42D1A 0_2_00A42D1A
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009B2D51 0_2_009B2D51
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A24D6C 0_2_00A24D6C
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0095AD41 0_2_0095AD41
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00914D47 0_2_00914D47
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0098AD4E 0_2_0098AD4E
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009EAD7A 0_2_009EAD7A
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0096ED64 0_2_0096ED64
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A0CD52 0_2_00A0CD52
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009F4E9B 0_2_009F4E9B
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00980E97 0_2_00980E97
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00962E8E 0_2_00962E8E
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009E2EBF 0_2_009E2EBF
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A08E95 0_2_00A08E95
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009ECEA8 0_2_009ECEA8
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008F4EB8 0_2_008F4EB8
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0099AEA5 0_2_0099AEA5
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0097EEDF 0_2_0097EEDF
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00954EC2 0_2_00954EC2
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0098CEF9 0_2_0098CEF9
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A1AEC3 0_2_00A1AEC3
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0095EEF1 0_2_0095EEF1
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009EEEF0 0_2_009EEEF0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009B0EE8 0_2_009B0EE8
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0093EE16 0_2_0093EE16
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00986E1F 0_2_00986E1F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009ACE11 0_2_009ACE11
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008FAE1C 0_2_008FAE1C
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009D2E09 0_2_009D2E09
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009BCE02 0_2_009BCE02
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00916E0B 0_2_00916E0B
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00928E0E 0_2_00928E0E
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00970E32 0_2_00970E32
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00932E34 0_2_00932E34
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00922E38 0_2_00922E38
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0097CE27 0_2_0097CE27
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00900E57 0_2_00900E57
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A26E6D 0_2_00A26E6D
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A22E54 0_2_00A22E54
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0097CF96 0_2_0097CF96
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A12FA9 0_2_00A12FA9
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009A8F95 0_2_009A8F95
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009D2F8F 0_2_009D2F8F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00920F86 0_2_00920F86
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A00FBE 0_2_00A00FBE
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00968FB4 0_2_00968FB4
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009B4FA5 0_2_009B4FA5
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0096AFD3 0_2_0096AFD3
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00956FC4 0_2_00956FC4
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0092CFC4 0_2_0092CFC4
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00910FF5 0_2_00910FF5
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0096CFF2 0_2_0096CFF2
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0092AFE2 0_2_0092AFE2
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0098EFEB 0_2_0098EFEB
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008EAFFB 0_2_008EAFFB
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0095CF16 0_2_0095CF16
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009DCF15 0_2_009DCF15
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009F6F0F 0_2_009F6F0F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009AAF03 0_2_009AAF03
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00998F02 0_2_00998F02
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00924F37 0_2_00924F37
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008F6F20 0_2_008F6F20
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A1CF12 0_2_00A1CF12
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009FAF2A 0_2_009FAF2A
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009D4F25 0_2_009D4F25
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009CAF21 0_2_009CAF21
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00952F5A 0_2_00952F5A
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009DEF47 0_2_009DEF47
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A04F47 0_2_00A04F47
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00990F71 0_2_00990F71
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009B6F67 0_2_009B6F67
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009A109A 0_2_009A109A
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0099F088 0_2_0099F088
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008DF09A 0_2_008DF09A
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0094F08D 0_2_0094F08D
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009B90B4 0_2_009B90B4
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008ED0BE 0_2_008ED0BE
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009950A9 0_2_009950A9
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009310A2 0_2_009310A2
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009FD0AD 0_2_009FD0AD
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008EF0B9 0_2_008EF0B9
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009DB0A0 0_2_009DB0A0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A0F0E0 0_2_00A0F0E0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009590D7 0_2_009590D7
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009150D3 0_2_009150D3
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009010CB 0_2_009010CB
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009CD0FC 0_2_009CD0FC
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A37022 0_2_00A37022
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009F1019 0_2_009F1019
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009BB015 0_2_009BB015
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009E9006 0_2_009E9006
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008E9013 0_2_008E9013
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00965036 0_2_00965036
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A09008 0_2_00A09008
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008FD026 0_2_008FD026
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0094703B 0_2_0094703B
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0098902F 0_2_0098902F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0091D055 0_2_0091D055
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009E504F 0_2_009E504F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0094B042 0_2_0094B042
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009A3063 0_2_009A3063
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A1105F 0_2_00A1105F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008F3186 0_2_008F3186
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00999181 0_2_00999181
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009D3186 0_2_009D3186
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009171BE 0_2_009171BE
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0096F1A6 0_2_0096F1A6
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008FF1BC 0_2_008FF1BC
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009A91CE 0_2_009A91CE
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009FB1CB 0_2_009FB1CB
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008F91E0 0_2_008F91E0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A07129 0_2_00A07129
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0091311D 0_2_0091311D
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0093B11F 0_2_0093B11F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0097710B 0_2_0097710B
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A1713F 0_2_00A1713F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009FF13F 0_2_009FF13F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A0D103 0_2_00A0D103
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00971123 0_2_00971123
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\file.exe Code function: String function: 00A9FB94 appears 35 times
Sample file is different than original file name gathered from version info
Source: file.exe, 00000000.00000000.1668140029.00000000008C6000.00000008.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe Static PE information: Section: wprgrgqn ZLIB complexity 0.9951514682718272
Source: classification engine Classification label: mal100.evad.winEXE@1/1@0/0
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log Jump to behavior
Source: C:\Users\user\Desktop\file.exe Mutant created: NULL
Source: C:\Users\user\Desktop\file.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: file.exe String found in binary or memory: 3The file %s is missing. Please, re-install this application
Source: file.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: C:\Users\user\Desktop\file.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: sspicli.dll Jump to behavior
Source: file.exe Static file information: File size 1732096 > 1048576
Source: file.exe Static PE information: Raw size of wprgrgqn is bigger than: 0x100000 < 0x1a0a00
Source: Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: file.exe, 00000000.00000002.1810276265.00000000008C2000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1677306944.0000000005340000.00000004.00001000.00020000.00000000.sdmp

Data Obfuscation
barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\user\Desktop\file.exe Unpacked PE file: 0.2.file.exe.8c0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;wprgrgqn:EW;hzfubnnc:EW;.taggant:EW; vs :ER;.rsrc:W;
Entry point lies outside standard sections
Source: initial sample Static PE information: section where entry point is pointing to: .taggant
PE file contains an invalid checksum
Source: file.exe Static PE information: real checksum: 0x1a9fb9 should be: 0x1ac679
PE file contains sections with non-standard names
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name: .idata
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name: wprgrgqn
Source: file.exe Static PE information: section name: hzfubnnc
Source: file.exe Static PE information: section name: .taggant
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008CE5A1 push ebx; mov dword ptr [esp], 7BBE297Dh 0_2_008CE5B6
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008CE5F1 push ecx; mov dword ptr [esp], ebx 0_2_008CEF4C
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008CE5F1 push 34B325A3h; mov dword ptr [esp], ecx 0_2_008CEF54
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008D408A push 5C6FB07Dh; mov dword ptr [esp], ecx 0_2_008D50C4
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008CC0B7 push edx; mov dword ptr [esp], 7B080A84h 0_2_008CC0B8
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00B4A02C push ecx; mov dword ptr [esp], edi 0_2_00B4A06C
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00B4A02C push 1404D626h; mov dword ptr [esp], ebx 0_2_00B4A123
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008D2069 push 38BCDA82h; mov dword ptr [esp], edi 0_2_008D2095
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A32044 push 55AB6081h; mov dword ptr [esp], edx 0_2_00A320C7
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A32044 push 74ECC82Ch; mov dword ptr [esp], edx 0_2_00A320CF
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A32044 push 72951B92h; mov dword ptr [esp], esp 0_2_00A321B6
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A32044 push esi; mov dword ptr [esp], 191FFED6h 0_2_00A32208
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A32044 push 7E0D073Dh; mov dword ptr [esp], ebx 0_2_00A3222C
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A32044 push edi; mov dword ptr [esp], esi 0_2_00A3227E
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A32044 push 234B7748h; mov dword ptr [esp], eax 0_2_00A322CA
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A32044 push edx; mov dword ptr [esp], 1FF1D100h 0_2_00A32389
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A32044 push edi; mov dword ptr [esp], 30EECFB5h 0_2_00A323FE
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A32044 push 7A970861h; mov dword ptr [esp], ebp 0_2_00A32445
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A32044 push 727F7701h; mov dword ptr [esp], edi 0_2_00A3244F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A32044 push 62E5A695h; mov dword ptr [esp], esi 0_2_00A324C5
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A32044 push 67F822ECh; mov dword ptr [esp], eax 0_2_00A324E3
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A32044 push 3C520DC5h; mov dword ptr [esp], ebp 0_2_00A32505
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A32044 push 20745756h; mov dword ptr [esp], esi 0_2_00A3256B
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A32044 push 5A464452h; mov dword ptr [esp], eax 0_2_00A32575
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A32044 push 3B332BFEh; mov dword ptr [esp], edi 0_2_00A32627
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A32044 push 222C468Fh; mov dword ptr [esp], ecx 0_2_00A3265D
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A32044 push esi; mov dword ptr [esp], 536C069Eh 0_2_00A326BD
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A32044 push 3883B2C3h; mov dword ptr [esp], ebp 0_2_00A3275F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A32044 push 2710B767h; mov dword ptr [esp], ecx 0_2_00A32784
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A32044 push 4B4011A9h; mov dword ptr [esp], esi 0_2_00A327B5
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A32044 push 67D93066h; mov dword ptr [esp], ebp 0_2_00A32820
Source: file.exe Static PE information: section name: entropy: 7.7981680493863905
Source: file.exe Static PE information: section name: wprgrgqn entropy: 7.954218945063447

Boot Survival
barindex
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Source: C:\Users\user\Desktop\file.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: Filemonclass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Source: C:\Users\user\Desktop\file.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 8CDBB3 second address: 8CDBCF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push edi 0x00000006 pop edi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e jmp 00007F81A505507Dh 0x00000013 pop edi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A48A9B second address: A48A9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A48A9F second address: A48AA9 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F81A5055076h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A48AA9 second address: A48AAF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A48AAF second address: A48AB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A48AB5 second address: A48ACF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81A47422A6h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A3F265 second address: A3F26B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A3F26B second address: A3F29C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81A47422A3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a pushad 0x0000000b jnl 00007F81A47422A5h 0x00000011 push esi 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A47CC9 second address: A47CDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F81A5055081h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A47CDF second address: A47CE6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A482D0 second address: A482F4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F81A5055082h 0x0000000a jp 00007F81A5055076h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A482F4 second address: A482F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A4B161 second address: A4B165 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A4B165 second address: 8CDBB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 add dword ptr [esp], 5240E251h 0x0000000d push ebx 0x0000000e mov dword ptr [ebp+122D33C4h], ebx 0x00000014 pop ecx 0x00000015 push dword ptr [ebp+122D0759h] 0x0000001b mov edx, 4D125FB6h 0x00000020 mov dword ptr [ebp+122D1AFCh], ebx 0x00000026 call dword ptr [ebp+122D3A88h] 0x0000002c pushad 0x0000002d pushad 0x0000002e jmp 00007F81A474229Ch 0x00000033 mov edx, dword ptr [ebp+122D29BFh] 0x00000039 popad 0x0000003a xor eax, eax 0x0000003c mov dword ptr [ebp+122D3346h], ecx 0x00000042 mov edx, dword ptr [esp+28h] 0x00000046 jmp 00007F81A47422A2h 0x0000004b mov dword ptr [ebp+122D2B93h], eax 0x00000051 pushad 0x00000052 mov dword ptr [ebp+122D3346h], esi 0x00000058 jmp 00007F81A47422A2h 0x0000005d popad 0x0000005e mov esi, 0000003Ch 0x00000063 jmp 00007F81A47422A5h 0x00000068 add esi, dword ptr [esp+24h] 0x0000006c jnl 00007F81A47422A2h 0x00000072 lodsw 0x00000074 mov dword ptr [ebp+122D3346h], eax 0x0000007a add eax, dword ptr [esp+24h] 0x0000007e js 00007F81A474229Ch 0x00000084 mov dword ptr [ebp+122D3346h], ecx 0x0000008a mov ebx, dword ptr [esp+24h] 0x0000008e jmp 00007F81A47422A9h 0x00000093 clc 0x00000094 nop 0x00000095 push eax 0x00000096 push edx 0x00000097 push ecx 0x00000098 push ebx 0x00000099 pop ebx 0x0000009a pop ecx 0x0000009b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A4B1E0 second address: A4B22F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jp 00007F81A5055076h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push edi 0x00000010 call 00007F81A5055078h 0x00000015 pop edi 0x00000016 mov dword ptr [esp+04h], edi 0x0000001a add dword ptr [esp+04h], 00000014h 0x00000022 inc edi 0x00000023 push edi 0x00000024 ret 0x00000025 pop edi 0x00000026 ret 0x00000027 push 00000000h 0x00000029 mov dx, ax 0x0000002c call 00007F81A5055079h 0x00000031 jp 00007F81A5055081h 0x00000037 push eax 0x00000038 push ecx 0x00000039 pushad 0x0000003a push edi 0x0000003b pop edi 0x0000003c push eax 0x0000003d push edx 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A4B22F second address: A4B23D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A4B360 second address: A4B39C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 push ebx 0x00000009 call 00007F81A505507Bh 0x0000000e or edi, dword ptr [ebp+122D2A67h] 0x00000014 pop ecx 0x00000015 pop edi 0x00000016 mov edi, edx 0x00000018 push 00000000h 0x0000001a jo 00007F81A505507Ch 0x00000020 mov edi, dword ptr [ebp+122D19DDh] 0x00000026 mov dword ptr [ebp+122D2100h], esi 0x0000002c push 7F54D9C2h 0x00000031 pushad 0x00000032 push eax 0x00000033 push edx 0x00000034 pushad 0x00000035 popad 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A4B39C second address: A4B3BD instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F81A47422A9h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A4B4A9 second address: A4B4AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A4B4AF second address: A4B4B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A5D200 second address: A5D204 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A6C518 second address: A6C520 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A2FFB2 second address: A2FFB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A6A6A0 second address: A6A6B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 je 00007F81A474229Eh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A6A6B5 second address: A6A6C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F81A505507Bh 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A6A6C6 second address: A6A6CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A6AF8A second address: A6AF94 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F81A5055076h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A6AF94 second address: A6AFAF instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jne 00007F81A4742296h 0x00000009 ja 00007F81A4742296h 0x0000000f pop esi 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 pop edx 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A6AFAF second address: A6AFC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F81A505507Dh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A6AFC1 second address: A6AFD3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F81A474229Ch 0x00000009 push eax 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A6B65E second address: A6B689 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jl 00007F81A505507Ah 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f pop ebx 0x00000010 push ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F81A5055088h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A6258E second address: A62594 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A62594 second address: A62598 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A2E2FA second address: A2E30C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007F81A4742298h 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A2E30C second address: A2E312 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A2E312 second address: A2E334 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007F81A47422A7h 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A2E334 second address: A2E33A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A2E33A second address: A2E340 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A6BEA2 second address: A6BEDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F81A5055089h 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c jns 00007F81A5055076h 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F81A5055081h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A6BEDE second address: A6BEE2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A6C016 second address: A6C023 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push esi 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A6C023 second address: A6C029 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A6C029 second address: A6C03B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c ja 00007F81A5055076h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A6C03B second address: A6C049 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81A474229Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A6C049 second address: A6C067 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F81A5055084h 0x00000008 jo 00007F81A505507Eh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A2ACDA second address: A2ACE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A40DD4 second address: A40DD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A40DD8 second address: A40DF8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81A474229Ch 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jnc 00007F81A474229Eh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A40DF8 second address: A40E0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F81A5055080h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A7314F second address: A73153 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A73153 second address: A73168 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81A505507Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A733E4 second address: A733E9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A733E9 second address: A733EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A77EE7 second address: A77EEB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A7855F second address: A7856A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F81A5055076h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A7856A second address: A7857E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jns 00007F81A4742296h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push esi 0x0000000d push ecx 0x0000000e push esi 0x0000000f pop esi 0x00000010 pop ecx 0x00000011 push ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A7857E second address: A78584 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A788B1 second address: A788B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A7B351 second address: A7B355 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A7B355 second address: A7B359 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A7B359 second address: A7B35F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A7B35F second address: A7B3A9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81A47422A4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 4A18DF70h 0x00000010 movzx esi, dx 0x00000013 push 358325CCh 0x00000018 pushad 0x00000019 push edi 0x0000001a jmp 00007F81A474229Ch 0x0000001f pop edi 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007F81A47422A2h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A7B756 second address: A7B75B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A7B75B second address: A7B77C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F81A47422A0h 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jp 00007F81A47422B1h 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A7B861 second address: A7B865 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A7B865 second address: A7B86A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A7BA3E second address: A7BA43 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A7BED1 second address: A7BEDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A7BEDD second address: A7BEE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A7C25C second address: A7C260 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A7C4AE second address: A7C4B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A7EF06 second address: A7EF0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A7ED29 second address: A7ED4E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F81A5055087h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push esi 0x0000000f push eax 0x00000010 push edx 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A7EF0A second address: A7EF0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A7EF0E second address: A7EF14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A7EF14 second address: A7EF1A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A7EF1A second address: A7EF1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A7EF1E second address: A7EF3C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jmp 00007F81A474229Fh 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A7F85E second address: A7F871 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F81A505507Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A80318 second address: A80325 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A81141 second address: A81145 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A81145 second address: A8114F instructions: 0x00000000 rdtsc 0x00000002 jns 00007F81A4742296h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A8114F second address: A81159 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F81A5055076h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A81159 second address: A8116B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 js 00007F81A474229Eh 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A81B45 second address: A81B62 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81A5055089h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A838CC second address: A838E3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81A474229Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A838E3 second address: A838ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A84F55 second address: A84F85 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F81A47422A5h 0x00000008 pushad 0x00000009 popad 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c push esi 0x0000000d pop esi 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F81A474229Dh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A84F85 second address: A84F89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A87135 second address: A87157 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jl 00007F81A4742296h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F81A47422A3h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A87157 second address: A871D0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81A5055089h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push esi 0x0000000d call 00007F81A5055078h 0x00000012 pop esi 0x00000013 mov dword ptr [esp+04h], esi 0x00000017 add dword ptr [esp+04h], 00000015h 0x0000001f inc esi 0x00000020 push esi 0x00000021 ret 0x00000022 pop esi 0x00000023 ret 0x00000024 mov di, DA00h 0x00000028 mov edi, 759654CBh 0x0000002d push 00000000h 0x0000002f or ebx, dword ptr [ebp+12451048h] 0x00000035 push 00000000h 0x00000037 push 00000000h 0x00000039 push esi 0x0000003a call 00007F81A5055078h 0x0000003f pop esi 0x00000040 mov dword ptr [esp+04h], esi 0x00000044 add dword ptr [esp+04h], 00000019h 0x0000004c inc esi 0x0000004d push esi 0x0000004e ret 0x0000004f pop esi 0x00000050 ret 0x00000051 xchg eax, esi 0x00000052 pushad 0x00000053 push eax 0x00000054 push edx 0x00000055 jns 00007F81A5055076h 0x0000005b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A881DC second address: A881E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A881E0 second address: A881F9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81A505507Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jbe 00007F81A505507Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A881F9 second address: A88209 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 jbe 00007F81A4742296h 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A8A203 second address: A8A208 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A893DF second address: A893EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007F81A4742296h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A8A208 second address: A8A21A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F81A505507Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A893EA second address: A893FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 push esi 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c pop esi 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A8A21A second address: A8A26F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push ebx 0x0000000e call 00007F81A5055078h 0x00000013 pop ebx 0x00000014 mov dword ptr [esp+04h], ebx 0x00000018 add dword ptr [esp+04h], 00000016h 0x00000020 inc ebx 0x00000021 push ebx 0x00000022 ret 0x00000023 pop ebx 0x00000024 ret 0x00000025 mov ebx, dword ptr [ebp+122D2A9Fh] 0x0000002b push 00000000h 0x0000002d adc bl, FFFFFFF5h 0x00000030 push 00000000h 0x00000032 mov ebx, edi 0x00000034 mov ebx, dword ptr [ebp+122D2A47h] 0x0000003a xchg eax, esi 0x0000003b push eax 0x0000003c push edx 0x0000003d push eax 0x0000003e push edx 0x0000003f jmp 00007F81A5055082h 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A8A26F second address: A8A275 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A8B181 second address: A8B185 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A8B185 second address: A8B195 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a ja 00007F81A4742296h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A8B195 second address: A8B199 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A8A451 second address: A8A457 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A8D2F1 second address: A8D2F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A8D2F7 second address: A8D2FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A8D2FB second address: A8D2FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A904F6 second address: A90587 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81A47422A5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushad 0x0000000c push edx 0x0000000d pop edx 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 jmp 00007F81A474229Fh 0x00000016 popad 0x00000017 nop 0x00000018 push 00000000h 0x0000001a push eax 0x0000001b call 00007F81A4742298h 0x00000020 pop eax 0x00000021 mov dword ptr [esp+04h], eax 0x00000025 add dword ptr [esp+04h], 0000001Ch 0x0000002d inc eax 0x0000002e push eax 0x0000002f ret 0x00000030 pop eax 0x00000031 ret 0x00000032 call 00007F81A47422A8h 0x00000037 pushad 0x00000038 add ax, CCCCh 0x0000003d mov dword ptr [ebp+124517ACh], ebx 0x00000043 popad 0x00000044 pop ebx 0x00000045 push 00000000h 0x00000047 sbb di, EED0h 0x0000004c push 00000000h 0x0000004e mov edi, dword ptr [ebp+122D1E50h] 0x00000054 xchg eax, esi 0x00000055 pushad 0x00000056 push eax 0x00000057 push edx 0x00000058 push eax 0x00000059 push edx 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A90587 second address: A9058B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A8F599 second address: A8F626 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov dword ptr [esp], eax 0x00000007 push 00000000h 0x00000009 push edx 0x0000000a call 00007F81A4742298h 0x0000000f pop edx 0x00000010 mov dword ptr [esp+04h], edx 0x00000014 add dword ptr [esp+04h], 0000001Ch 0x0000001c inc edx 0x0000001d push edx 0x0000001e ret 0x0000001f pop edx 0x00000020 ret 0x00000021 movzx edi, ax 0x00000024 push dword ptr fs:[00000000h] 0x0000002b xor dword ptr [ebp+122D34AAh], ebx 0x00000031 or bx, 2ADCh 0x00000036 mov dword ptr fs:[00000000h], esp 0x0000003d je 00007F81A474229Ch 0x00000043 mov dword ptr [ebp+122D3619h], edi 0x00000049 mov eax, dword ptr [ebp+122D12A9h] 0x0000004f push FFFFFFFFh 0x00000051 push 00000000h 0x00000053 push eax 0x00000054 call 00007F81A4742298h 0x00000059 pop eax 0x0000005a mov dword ptr [esp+04h], eax 0x0000005e add dword ptr [esp+04h], 0000001Bh 0x00000066 inc eax 0x00000067 push eax 0x00000068 ret 0x00000069 pop eax 0x0000006a ret 0x0000006b pushad 0x0000006c mov eax, edx 0x0000006e mov edx, dword ptr [ebp+122D2B5Fh] 0x00000074 popad 0x00000075 nop 0x00000076 push edi 0x00000077 pushad 0x00000078 push eax 0x00000079 push edx 0x0000007a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A9077E second address: A90782 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A9185F second address: A91867 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A90782 second address: A90788 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A945ED second address: A94631 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jl 00007F81A474229Ch 0x0000000d popad 0x0000000e mov dword ptr [esp], eax 0x00000011 jmp 00007F81A474229Eh 0x00000016 push 00000000h 0x00000018 jng 00007F81A474229Bh 0x0000001e push 00000000h 0x00000020 stc 0x00000021 xchg eax, esi 0x00000022 push eax 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007F81A474229Bh 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A90788 second address: A9078D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A92932 second address: A92946 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F81A474229Dh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A955FE second address: A95604 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A948C0 second address: A948C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A948C7 second address: A948E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007F81A5055081h 0x0000000e push eax 0x0000000f push edx 0x00000010 push edx 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A9DB1B second address: A9DB20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A9D3C9 second address: A9D3E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F81A5055076h 0x0000000a popad 0x0000000b push esi 0x0000000c pushad 0x0000000d popad 0x0000000e pop esi 0x0000000f push edi 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 pop eax 0x00000014 jp 00007F81A5055076h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A9D3E3 second address: A9D3E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A9D527 second address: A9D559 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007F81A505507Fh 0x0000000b jnp 00007F81A5055076h 0x00000011 popad 0x00000012 jbe 00007F81A505508Ah 0x00000018 jmp 00007F81A505507Eh 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A9D559 second address: A9D55D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A2C855 second address: A2C86B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F81A505507Ah 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A7F85A second address: A7F85E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AAEE57 second address: AAEE62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F81A5055076h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AAEE62 second address: AAEE68 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AAEE68 second address: AAEE6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AAEE6C second address: AAEE70 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AAEF4F second address: AAEF56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AAEF56 second address: AAEFB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 push eax 0x00000007 jmp 00007F81A47422A5h 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 jmp 00007F81A47422A5h 0x00000015 mov eax, dword ptr [eax] 0x00000017 jnl 00007F81A47422A4h 0x0000001d mov dword ptr [esp+04h], eax 0x00000021 pushad 0x00000022 pushad 0x00000023 jbe 00007F81A4742296h 0x00000029 push edx 0x0000002a pop edx 0x0000002b popad 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AAEFB4 second address: AAEFB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AB0342 second address: AB034C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F81A4742296h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AB034C second address: AB037E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81A5055086h 0x00000007 jmp 00007F81A5055084h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push esi 0x00000011 pop esi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AB037E second address: AB0382 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AB0382 second address: AB0390 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AB0390 second address: AB03B1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F81A47422A9h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AB03B1 second address: AB03BB instructions: 0x00000000 rdtsc 0x00000002 jne 00007F81A5055076h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AB03BB second address: AB03D0 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F81A47422A0h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AB6CA9 second address: AB6CAD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AB6E05 second address: AB6E1E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81A474229Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AB6E1E second address: AB6E51 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81A5055080h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jno 00007F81A5055076h 0x00000010 push esi 0x00000011 pop esi 0x00000012 jmp 00007F81A5055084h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AB6E51 second address: AB6E56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AB6E56 second address: AB6E5C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AB6E5C second address: AB6E60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AB6E60 second address: AB6E66 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AB7511 second address: AB7515 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AB7515 second address: AB7519 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AB991E second address: AB992D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop esi 0x00000006 pushad 0x00000007 jnl 00007F81A474229Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ABE183 second address: ABE18D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ABE18D second address: ABE198 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ABE198 second address: ABE19E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ABE19E second address: ABE1A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ABE450 second address: ABE470 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F81A5055076h 0x0000000a jmp 00007F81A5055085h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ABE5C8 second address: ABE5EE instructions: 0x00000000 rdtsc 0x00000002 jp 00007F81A4742296h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F81A47422A8h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ABE5EE second address: ABE5F8 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F81A5055076h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ABE5F8 second address: ABE60C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F81A4742296h 0x0000000a jmp 00007F81A474229Ah 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ABE913 second address: ABE929 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F81A5055076h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pop eax 0x00000010 jng 00007F81A5055076h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ABEBC9 second address: ABEBE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F81A47422A5h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ABEECC second address: ABEED2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ABDB2A second address: ABDB30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AC34AE second address: AC34B8 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F81A5055076h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AC34B8 second address: AC34D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 jbe 00007F81A47422BEh 0x0000000d pushad 0x0000000e push eax 0x0000000f pop eax 0x00000010 jmp 00007F81A474229Bh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A799E5 second address: A6258E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81A5055086h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jg 00007F81A5055078h 0x0000000f popad 0x00000010 push eax 0x00000011 pushad 0x00000012 jns 00007F81A5055080h 0x00000018 jnl 00007F81A505508Eh 0x0000001e popad 0x0000001f nop 0x00000020 push 00000000h 0x00000022 push ebp 0x00000023 call 00007F81A5055078h 0x00000028 pop ebp 0x00000029 mov dword ptr [esp+04h], ebp 0x0000002d add dword ptr [esp+04h], 00000017h 0x00000035 inc ebp 0x00000036 push ebp 0x00000037 ret 0x00000038 pop ebp 0x00000039 ret 0x0000003a pushad 0x0000003b mov eax, dword ptr [ebp+122D3363h] 0x00000041 mov dword ptr [ebp+122D3766h], edx 0x00000047 popad 0x00000048 sbb cl, FFFFFF96h 0x0000004b lea eax, dword ptr [ebp+1247F73Ah] 0x00000051 mov di, ax 0x00000054 push eax 0x00000055 pushad 0x00000056 jmp 00007F81A5055088h 0x0000005b pushad 0x0000005c jns 00007F81A5055076h 0x00000062 pushad 0x00000063 popad 0x00000064 popad 0x00000065 popad 0x00000066 mov dword ptr [esp], eax 0x00000069 mov dword ptr [ebp+122D349Bh], ebx 0x0000006f call dword ptr [ebp+122D19B6h] 0x00000075 push eax 0x00000076 push edx 0x00000077 jnp 00007F81A505507Eh 0x0000007d jng 00007F81A5055076h 0x00000083 pushad 0x00000084 popad 0x00000085 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A79B72 second address: A79B78 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A79B78 second address: A79B7E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A7A28E second address: A7A29E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pushad 0x00000006 popad 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A7A29E second address: A7A2A4 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A7A394 second address: A7A3B4 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F81A474229Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c pushad 0x0000000d push eax 0x0000000e pop eax 0x0000000f jnc 00007F81A4742296h 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A7A3B4 second address: A7A3C9 instructions: 0x00000000 rdtsc 0x00000002 js 00007F81A5055076h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push esi 0x00000014 pop esi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A7A3C9 second address: A7A3CF instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A7A3CF second address: A7A3D9 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F81A505507Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A7A3D9 second address: A7A3FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [eax] 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F81A47422A7h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A7A4CD second address: A7A4D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A7AAC1 second address: A7AAC7 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A7AAC7 second address: A7AAE6 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F81A5055078h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e jmp 00007F81A505507Eh 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A7ACDA second address: A7ACDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A7ACDE second address: A7ACE2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A7AEA3 second address: A7AEA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A7AEA7 second address: A7AEC6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F81A5055084h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A7AEC6 second address: A7AECC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A7AF5A second address: A7AF61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A7AF61 second address: A7AFC0 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F81A4742298h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f mov dword ptr [ebp+122D17F6h], eax 0x00000015 lea eax, dword ptr [ebp+1247F77Eh] 0x0000001b mov dword ptr [ebp+122D3326h], ecx 0x00000021 nop 0x00000022 jnl 00007F81A47422A2h 0x00000028 push eax 0x00000029 push edi 0x0000002a push esi 0x0000002b jnl 00007F81A4742296h 0x00000031 pop esi 0x00000032 pop edi 0x00000033 nop 0x00000034 mov edi, dword ptr [ebp+122D2A9Bh] 0x0000003a lea eax, dword ptr [ebp+1247F73Ah] 0x00000040 mov edx, edi 0x00000042 nop 0x00000043 push eax 0x00000044 push edx 0x00000045 pushad 0x00000046 jo 00007F81A4742296h 0x0000004c jo 00007F81A4742296h 0x00000052 popad 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ACA401 second address: ACA405 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ACA854 second address: ACA86D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F81A47422A5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ACA86D second address: ACA871 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ACA871 second address: ACA895 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jne 00007F81A47422A7h 0x00000010 push ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ACA895 second address: ACA89A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ACA89A second address: ACA8A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ACAA02 second address: ACAA12 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F81A5055082h 0x00000008 jl 00007F81A5055076h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AD0A29 second address: AD0A2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A31B35 second address: A31B42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push edi 0x00000006 jno 00007F81A5055076h 0x0000000c pop edi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A31B42 second address: A31B4A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 push edi 0x00000007 pop edi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ACF744 second address: ACF748 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ACF748 second address: ACF774 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jmp 00007F81A47422A9h 0x0000000c ja 00007F81A4742296h 0x00000012 pop edx 0x00000013 popad 0x00000014 pushad 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ACF774 second address: ACF77E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ACF77E second address: ACF784 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ACF42C second address: ACF440 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F81A505507Eh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ACF440 second address: ACF456 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F81A47422A1h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ACF456 second address: ACF466 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F81A505507Ah 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ACF466 second address: ACF477 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jo 00007F81A4742298h 0x0000000f push eax 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ACF477 second address: ACF484 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007F81A5055076h 0x00000009 push edx 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AD01D9 second address: AD01ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push edi 0x00000008 jbe 00007F81A4742296h 0x0000000e pop edi 0x0000000f pushad 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AD01ED second address: AD0215 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F81A5055076h 0x0000000a popad 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F81A5055089h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AD0215 second address: AD0219 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AD0703 second address: AD0723 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F81A5055089h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AD0723 second address: AD073E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81A47422A7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AD073E second address: AD0768 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F81A505507Eh 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F81A5055083h 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AD0768 second address: AD077D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F81A474229Ch 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AD077D second address: AD0791 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007F81A5055076h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b popad 0x0000000c jnp 00007F81A505507Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AD34E6 second address: AD34F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AD34F3 second address: AD3524 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81A5055080h 0x00000007 jmp 00007F81A5055083h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jg 00007F81A5055076h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AD3524 second address: AD3548 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81A47422A2h 0x00000007 jmp 00007F81A474229Eh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AD3684 second address: AD3689 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AD3689 second address: AD368E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AD368E second address: AD3694 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AD37F9 second address: AD3829 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F81A4742296h 0x00000008 jbe 00007F81A4742296h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push ecx 0x00000011 push eax 0x00000012 pop eax 0x00000013 pop ecx 0x00000014 pushad 0x00000015 jmp 00007F81A47422A9h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ADC037 second address: ADC045 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jnl 00007F81A5055076h 0x0000000c push esi 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ADC045 second address: ADC06D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F81A47422A5h 0x00000010 push eax 0x00000011 ja 00007F81A4742296h 0x00000017 pop eax 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ADC06D second address: ADC07A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007F81A5055076h 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ADC314 second address: ADC31A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ADC31A second address: ADC31F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ADC5F0 second address: ADC64B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F81A47422A0h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F81A474229Bh 0x00000010 pop esi 0x00000011 push eax 0x00000012 push edx 0x00000013 jnl 00007F81A47422B1h 0x00000019 jmp 00007F81A47422A6h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ADC64B second address: ADC65D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jg 00007F81A5055076h 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c jl 00007F81A5055076h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ADC951 second address: ADC976 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 jmp 00007F81A474229Eh 0x0000000c popad 0x0000000d pushad 0x0000000e jmp 00007F81A474229Ch 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AE171B second address: AE173C instructions: 0x00000000 rdtsc 0x00000002 jc 00007F81A5055076h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ecx 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 jmp 00007F81A505507Fh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AE0CEB second address: AE0CEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AE1117 second address: AE1121 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F81A5055076h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AE1121 second address: AE112B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AE112B second address: AE1131 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AE41DE second address: AE41E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AE447A second address: AE4480 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AE4480 second address: AE448A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F81A4742296h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AE448A second address: AE44BF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F81A5055081h 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jl 00007F81A5055080h 0x00000015 jmp 00007F81A505507Ah 0x0000001a push eax 0x0000001b pushad 0x0000001c popad 0x0000001d jno 00007F81A5055076h 0x00000023 pop eax 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AE44BF second address: AE44DA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007F81A4742296h 0x00000009 jbe 00007F81A4742296h 0x0000000f pushad 0x00000010 popad 0x00000011 jg 00007F81A4742296h 0x00000017 popad 0x00000018 push edi 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AECC73 second address: AECC78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AECC78 second address: AECC84 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F81A4742296h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AEB319 second address: AEB351 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F81A5055084h 0x00000009 popad 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F81A5055082h 0x00000012 pushad 0x00000013 je 00007F81A5055076h 0x00000019 push ebx 0x0000001a pop ebx 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AEB5CD second address: AEB5D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AEC6B9 second address: AEC6BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AEC6BF second address: AEC6DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F81A47422A4h 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AEC6DA second address: AEC6EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F81A5055076h 0x0000000a popad 0x0000000b push ebx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AF15A5 second address: AF15BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F81A47422A3h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AF15BE second address: AF15C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AF15C2 second address: AF15D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnl 00007F81A4742296h 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AF4B30 second address: AF4B41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pop esi 0x00000008 js 00007F81A50550A2h 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AF4B41 second address: AF4B4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AF4B4C second address: AF4B50 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AF4CBC second address: AF4CE1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F81A47422A6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop eax 0x0000000b push esi 0x0000000c jnl 00007F81A4742296h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AF4CE1 second address: AF4CED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AF50D6 second address: AF50DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AFD19F second address: AFD1A4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AFD2F5 second address: AFD304 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jl 00007F81A4742296h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AFD304 second address: AFD327 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F81A5055087h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AFD327 second address: AFD32B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AFD32B second address: AFD351 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F81A5055088h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jno 00007F81A5055078h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AFD923 second address: AFD929 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AFD929 second address: AFD930 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AFD930 second address: AFD939 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edx 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AFDC20 second address: AFDC34 instructions: 0x00000000 rdtsc 0x00000002 je 00007F81A5055078h 0x00000008 push eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c je 00007F81A5055076h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B00FB5 second address: B00FB9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B00FB9 second address: B00FE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007F81A505507Ch 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 jmp 00007F81A505507Dh 0x00000015 pushad 0x00000016 popad 0x00000017 push esi 0x00000018 pop esi 0x00000019 popad 0x0000001a jng 00007F81A5055078h 0x00000020 pushad 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B00FE9 second address: B0100B instructions: 0x00000000 rdtsc 0x00000002 jo 00007F81A47422ADh 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F81A47422A5h 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A36B6C second address: A36B71 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A36B71 second address: A36B7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B05CC5 second address: B05CCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B05CCB second address: B05CCF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B05CCF second address: B05CD7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B05CD7 second address: B05CEE instructions: 0x00000000 rdtsc 0x00000002 jno 00007F81A474229Eh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B05CEE second address: B05CF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B05CF5 second address: B05D10 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F81A47422A6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B056E9 second address: B056F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B05849 second address: B0584D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B0584D second address: B05896 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F81A5055076h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 jmp 00007F81A5055086h 0x00000015 jmp 00007F81A505507Bh 0x0000001a popad 0x0000001b jmp 00007F81A5055087h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B07526 second address: B0752C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B0752C second address: B07531 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B07531 second address: B0754E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F81A47422A9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B0754E second address: B07552 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B07552 second address: B07570 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F81A47422A6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B07570 second address: B07576 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A3A299 second address: A3A2A2 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A3A2A2 second address: A3A2A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B1471D second address: B14721 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B14721 second address: B14725 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B18D09 second address: B18D26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 jmp 00007F81A47422A7h 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B18640 second address: B18645 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B187DA second address: B187DF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B187DF second address: B18810 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F81A5055082h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F81A5055084h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B18810 second address: B18815 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B18815 second address: B1885B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F81A505507Dh 0x00000009 jmp 00007F81A505507Ch 0x0000000e jmp 00007F81A5055084h 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F81A5055082h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B1D66A second address: B1D680 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F81A474229Ch 0x00000008 jng 00007F81A47422A7h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B1C2B7 second address: B1C2BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B1C429 second address: B1C433 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F81A4742296h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B1C433 second address: B1C439 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B1C439 second address: B1C43E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B1C43E second address: B1C469 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push edx 0x00000006 jmp 00007F81A505507Eh 0x0000000b jmp 00007F81A505507Dh 0x00000010 pop edx 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B1C469 second address: B1C47B instructions: 0x00000000 rdtsc 0x00000002 jng 00007F81A4742296h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jne 00007F81A47422A2h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B2D153 second address: B2D159 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B2D159 second address: B2D16C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 jne 00007F81A4742296h 0x0000000c jnl 00007F81A4742296h 0x00000012 pop ebx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B2D16C second address: B2D1A3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F81A5055087h 0x00000008 pop ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F81A5055088h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B2BAC3 second address: B2BAD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F81A474229Eh 0x00000009 pop ebx 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B2BC36 second address: B2BC3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B2BC3C second address: B2BC47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B2BC47 second address: B2BC4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B2BEEB second address: B2BF00 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81A474229Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B2BF00 second address: B2BF0C instructions: 0x00000000 rdtsc 0x00000002 jl 00007F81A5055076h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B2BF0C second address: B2BF12 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B2BF12 second address: B2BF18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B2C05A second address: B2C068 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81A474229Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B2C068 second address: B2C074 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B2C074 second address: B2C07E instructions: 0x00000000 rdtsc 0x00000002 jg 00007F81A4742296h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B2C07E second address: B2C084 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B2C084 second address: B2C08A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B2C359 second address: B2C37A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81A505507Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jl 00007F81A5055082h 0x0000000f jng 00007F81A5055076h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B30648 second address: B30653 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B30653 second address: B30689 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F81A505507Ah 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F81A5055087h 0x00000013 js 00007F81A505507Ch 0x00000019 ja 00007F81A5055076h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B30689 second address: B3068F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B3068F second address: B3069D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F81A505507Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B3069D second address: B306B7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81A47422A2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B306B7 second address: B306BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B48781 second address: B487A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F81A4742296h 0x0000000a popad 0x0000000b jmp 00007F81A47422A9h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B487A5 second address: B487AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B487AC second address: B487BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 ja 00007F81A4742296h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B49E38 second address: B49E3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B4C818 second address: B4C835 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b jmp 00007F81A474229Bh 0x00000010 jnc 00007F81A4742296h 0x00000016 pop edi 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B4C98A second address: B4C994 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F81A505508Dh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B534FB second address: B53510 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jno 00007F81A4742296h 0x0000000c popad 0x0000000d pop esi 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B53510 second address: B53514 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B53514 second address: B5352E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81A47422A3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B5386F second address: B53875 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B53875 second address: B5387E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B5387E second address: B53882 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B53882 second address: B53886 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B58221 second address: B5822B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B60B7F second address: B60B84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B60B84 second address: B60B89 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B62AB5 second address: B62ABB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B5837C second address: B58380 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B58380 second address: B58384 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B5861C second address: B58639 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F81A5055076h 0x0000000a popad 0x0000000b jmp 00007F81A505507Fh 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B58639 second address: B58645 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F81A4742296h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A7DFC7 second address: A7DFDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jg 00007F81A5055076h 0x00000010 push esi 0x00000011 pop esi 0x00000012 popad 0x00000013 rdtsc
Tries to evade debugger and weak emulator (self modifying code)
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: 8CDBED instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: 8CDB10 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: A7305F instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: A717F4 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: A99A3A instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: A79BF1 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: B08972 instructions caused by: Self-modifying code
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\file.exe Memory allocated: 5540000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\file.exe Memory allocated: 57A0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\file.exe Memory allocated: 55C0000 memory reserve | memory write watch Jump to behavior
Contains capabilities to detect virtual machines
Source: C:\Users\user\Desktop\file.exe Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc Jump to behavior
Source: C:\Users\user\Desktop\file.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion Jump to behavior
Source: C:\Users\user\Desktop\file.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008CE048 rdtsc 0_2_008CE048
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\file.exe Thread delayed: delay time: 922337203685477 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\file.exe TID: 5800 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00AAAF98 GetSystemInfo,VirtualAlloc, 0_2_00AAAF98
Source: C:\Users\user\Desktop\file.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: file.exe, file.exe, 00000000.00000002.1810342366.0000000000A52000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.1810342366.0000000000A52000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: C:\Users\user\Desktop\file.exe System information queried: ModuleInformation Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging
barindex
Hides threads from debuggers
Source: C:\Users\user\Desktop\file.exe Thread information set: HideFromDebugger Jump to behavior
Tries to detect sandboxes and other dynamic analysis tools (window names)
Source: C:\Users\user\Desktop\file.exe Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe Open window title or class name: file monitor - sysinternals: www.sysinternals.com
Checks for debuggers (devices)
Source: C:\Users\user\Desktop\file.exe File opened: NTICE
Source: C:\Users\user\Desktop\file.exe File opened: SICE
Source: C:\Users\user\Desktop\file.exe File opened: SIWVID
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\file.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008CE048 rdtsc 0_2_008CE048
Enables debug privileges
Source: C:\Users\user\Desktop\file.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\file.exe Memory allocated: page read and write | page guard Jump to behavior
Source: file.exe, 00000000.00000002.1810342366.0000000000A52000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: oSGF_Program Manager
Source: file.exe, file.exe, 00000000.00000002.1810342366.0000000000A52000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: SGF_Program Manager
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00AA3CE1 GetSystemTime,GetFileTime, 0_2_00AA3CE1

Lowering of HIPS / PFW / Operating System Security Settings
barindex
Disable Windows Defender notifications (registry)
Source: C:\Users\user\Desktop\file.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1 Jump to behavior
Disable Windows Defender real time protection (registry)
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection Registry value created: DisableIOAVProtection 1 Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection Registry value created: DisableRealtimeMonitoring 1 Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications Registry value created: DisableNotifications 1 Jump to behavior
Disables Windows Defender Tamper protection
Source: C:\Users\user\Desktop\file.exe Registry value created: TamperProtection 0 Jump to behavior
Modifies windows update settings
Source: C:\Users\user\Desktop\file.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions Jump to behavior
Source: C:\Users\user\Desktop\file.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates Jump to behavior
Source: C:\Users\user\Desktop\file.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1538053 Sample: file.exe Startdate: 20/10/2024 Architecture: WINDOWS Score: 100 11 Antivirus / Scanner detection for submitted sample 2->11 13 Machine Learning detection for sample 2->13 15 PE file contains section with special chars 2->15 17 AI detected suspicious sample 2->17 5 file.exe 9 1 2->5         started        process3 file4 9 C:\Users\user\AppData\Local\...\file.exe.log, CSV 5->9 dropped 19 Detected unpacking (changes PE section rights) 5->19 21 Tries to detect sandboxes and other dynamic analysis tools (window names) 5->21 23 Modifies windows update settings 5->23 25 8 other signatures 5->25 signatures5
⊘No contacted IP infos