Edit tour

Windows Analysis Report
MSBuild.exe

Overview

General Information

Sample name:	MSBuild.exe
Analysis ID:	1468847
MD5:	d253b17c8bee1355ecebe68853b03fa8
SHA1:	948fe597db1ca38bc6595b23ab3fa979e4149d6f
SHA256:	f0878eca55ab10a2e2f425404b3b4a92eb4d3f9b9020b333dab0757387840e9e
Tags:	exeRiseProStealer
Infos:

Detection

RisePro Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (changes PE section rights)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected RisePro Stealer

AI detected suspicious sample

Found stalling execution ending in API Sleep call

Hides threads from debuggers

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

Potentially malicious time measurement code found

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Uses schtasks.exe or at.exe to add and modify task schedules

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to read the PEB

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found decision node followed by non-executed suspicious APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

MSBuild.exe (PID: 7384 cmdline: "C:\Users\user\Desktop\MSBuild.exe" MD5: D253B17C8BEE1355ECEBE68853B03FA8)

schtasks.exe (PID: 7576 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7584 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 7624 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7632 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

MPGPH131.exe (PID: 7680 cmdline: C:\ProgramData\MPGPH131\MPGPH131.exe MD5: D253B17C8BEE1355ECEBE68853B03FA8)

MPGPH131.exe (PID: 7700 cmdline: C:\ProgramData\MPGPH131\MPGPH131.exe MD5: D253B17C8BEE1355ECEBE68853B03FA8)

RageMP131.exe (PID: 8004 cmdline: "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe" MD5: D253B17C8BEE1355ECEBE68853B03FA8)

RageMP131.exe (PID: 5700 cmdline: "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe" MD5: D253B17C8BEE1355ECEBE68853B03FA8)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000008.00000003.1524499032.00000000050B0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
0000000B.00000003.1603725215.0000000005180000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000007.00000003.1445320950.0000000004C30000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000000.00000003.1378720423.0000000004EF0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
0000000B.00000002.2599961844.0000000000E21000.00000040.00000001.01000000.00000006.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000007.00000002.2599669602.0000000000381000.00000040.00000001.01000000.00000005.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000008.00000002.2600321345.0000000000E21000.00000040.00000001.01000000.00000006.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000000.00000002.2599804514.0000000000771000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000006.00000002.2599663751.0000000000381000.00000040.00000001.01000000.00000005.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000006.00000003.1444596124.0000000004C50000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 7384	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: MPGPH131.exe PID: 7680	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: MPGPH131.exe PID: 7700	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: RageMP131.exe PID: 8004	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: RageMP131.exe PID: 5700	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Click to see the 10 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\MSBuild.exe, ProcessId: 7384, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RageMP131

Snort Signatures

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.8 - Destination IP: 193.233.132.62

Timestamp:	07/08/24-04:36:05.411458
SID:	2046269
Source Port:	49705
Destination Port:	50500
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.8 - Destination IP: 193.233.132.62

Timestamp:	07/08/24-04:36:26.270945
SID:	2046269
Source Port:	49711
Destination Port:	50500
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.8 - Destination IP: 193.233.132.62

Timestamp:	07/08/24-04:36:10.757547
SID:	2046269
Source Port:	49707
Destination Port:	50500
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.8 - Destination IP: 193.233.132.62

Timestamp:	07/08/24-04:36:19.083554
SID:	2046269
Source Port:	49709
Destination Port:	50500
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN RisePro TCP Heartbeat Packet - Source IP: 192.168.2.8 - Destination IP: 193.233.132.62

Timestamp:	07/08/24-04:36:02.442612
SID:	2049060
Source Port:	49705
Destination Port:	50500
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.8 - Destination IP: 193.233.132.62

Timestamp:	07/08/24-04:36:10.757376
SID:	2046269
Source Port:	49706
Destination Port:	50500
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\MPGPH131\MPGPH131.exe	ReversingLabs: Detection: 76%
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Virustotal: Detection: 73%	Perma Link
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	ReversingLabs: Detection: 76%
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Virustotal: Detection: 73%	Perma Link

Multi AV Scanner detection for submitted file

Source: MSBuild.exe	ReversingLabs: Detection: 76%
Source: MSBuild.exe	Virustotal: Detection: 73%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: MSBuild.exe

Joe Sandbox ML: detected

Source: MSBuild.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2049060 ET TROJAN RisePro TCP Heartbeat Packet 192.168.2.8:49705 -> 193.233.132.62:50500
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.8:49705 -> 193.233.132.62:50500
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.8:49706 -> 193.233.132.62:50500
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.8:49707 -> 193.233.132.62:50500
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.8:49709 -> 193.233.132.62:50500
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.8:49711 -> 193.233.132.62:50500

Source: global traffic

TCP traffic: 192.168.2.8:49705 -> 193.233.132.62:50500

Source: Joe Sandbox View

IP Address: 193.233.132.62 193.233.132.62

Source: Joe Sandbox View

ASN Name: FREE-NET-ASFREEnetEU FREE-NET-ASFREEnetEU

Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.62
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.62
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.62
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.62
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.62
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.62
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.62
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.62
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.62
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.62
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.62
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.62
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.62
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.62
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.62
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.62
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.62
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.62
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.62
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.62
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.62
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.62
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.62
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.62
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.62
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.221.240
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.221.240

Source: C:\Users\user\Desktop\MSBuild.exe

Code function: 0_2_0078DF40 recv,WSAStartup,closesocket,socket,connect,closesocket,

0_2_0078DF40

Source: MSBuild.exe, 00000000.00000003.1378720423.0000000004EF0000.00000004.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000000.00000002.2599804514.0000000000771000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000006.00000002.2599663751.0000000000381000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000006.00000003.1444596124.0000000004C50000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1445320950.0000000004C30000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2599669602.0000000000381000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000003.1524499032.00000000050B0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2600321345.0000000000E21000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 0000000B.00000003.1603725215.0000000005180000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.2599961844.0000000000E21000.00000040.00000001.01000000.00000006.sdmp	String found in binary or memory: http://www.winimage.com/zLibDll
Source: MSBuild.exe, 00000000.00000003.1378720423.0000000004EF0000.00000004.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000000.00000002.2599804514.0000000000771000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000006.00000002.2599663751.0000000000381000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000006.00000003.1444596124.0000000004C50000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1445320950.0000000004C30000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2599669602.0000000000381000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000003.1524499032.00000000050B0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2600321345.0000000000E21000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 0000000B.00000003.1603725215.0000000005180000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.2599961844.0000000000E21000.00000040.00000001.01000000.00000006.sdmp	String found in binary or memory: https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll
Source: MSBuild.exe, 00000000.00000002.2602987575.000000000129E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2601680202.0000000000EED000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2601794950.0000000000F2A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2599925937.0000000000D0E000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.2601566173.00000000014D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORT

Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703

System Summary

PE file contains section with special chars

Source: MSBuild.exe	Static PE information: section name:
Source: MSBuild.exe	Static PE information: section name: .idata
Source: MSBuild.exe	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name: .idata
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name: .idata
Source: MPGPH131.exe.0.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\MSBuild.exe	Code function: 0_2_00772050	0_2_00772050
Source: C:\Users\user\Desktop\MSBuild.exe	Code function: 0_2_0084B0B0	0_2_0084B0B0
Source: C:\Users\user\Desktop\MSBuild.exe	Code function: 0_2_00851000	0_2_00851000
Source: C:\Users\user\Desktop\MSBuild.exe	Code function: 0_2_0085A1CF	0_2_0085A1CF
Source: C:\Users\user\Desktop\MSBuild.exe	Code function: 0_2_0078A180	0_2_0078A180
Source: C:\Users\user\Desktop\MSBuild.exe	Code function: 0_2_0086DA91	0_2_0086DA91
Source: C:\Users\user\Desktop\MSBuild.exe	Code function: 0_2_007F2200	0_2_007F2200
Source: C:\Users\user\Desktop\MSBuild.exe	Code function: 0_2_007722D0	0_2_007722D0
Source: C:\Users\user\Desktop\MSBuild.exe	Code function: 0_2_00784330	0_2_00784330
Source: C:\Users\user\Desktop\MSBuild.exe	Code function: 0_2_0077ABE0	0_2_0077ABE0
Source: C:\Users\user\Desktop\MSBuild.exe	Code function: 0_2_007FC470	0_2_007FC470
Source: C:\Users\user\Desktop\MSBuild.exe	Code function: 0_2_007F54E0	0_2_007F54E0
Source: C:\Users\user\Desktop\MSBuild.exe	Code function: 0_2_00854788	0_2_00854788
Source: C:\Users\user\Desktop\MSBuild.exe	Code function: 0_2_007E0F20	0_2_007E0F20
Source: C:\Users\user\Desktop\MSBuild.exe	Code function: 0_2_0077A7B0	0_2_0077A7B0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00461000	6_2_00461000
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00382050	6_2_00382050
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_0045B0B0	6_2_0045B0B0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_0046A1CF	6_2_0046A1CF
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_0039A180	6_2_0039A180
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00402200	6_2_00402200
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_003822D0	6_2_003822D0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00394330	6_2_00394330
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_0038ABE0	6_2_0038ABE0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_0040C470	6_2_0040C470
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_004054E0	6_2_004054E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_003F0F20	6_2_003F0F20
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_0038A7B0	6_2_0038A7B0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00464788	6_2_00464788
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00461000	7_2_00461000
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00382050	7_2_00382050
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_0045B0B0	7_2_0045B0B0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_0046A1CF	7_2_0046A1CF
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_0039A180	7_2_0039A180
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00402200	7_2_00402200
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_003822D0	7_2_003822D0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00394330	7_2_00394330
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_0038ABE0	7_2_0038ABE0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_0040C470	7_2_0040C470
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_004054E0	7_2_004054E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_003F0F20	7_2_003F0F20
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_0038A7B0	7_2_0038A7B0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00464788	7_2_00464788
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_00EFB0B0	8_2_00EFB0B0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_00E22050	8_2_00E22050
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_00F01000	8_2_00F01000
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_00F0A1CF	8_2_00F0A1CF
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_00E3A180	8_2_00E3A180
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_00E222D0	8_2_00E222D0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_00F1DA91	8_2_00F1DA91
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_00EA2200	8_2_00EA2200
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_00E2ABE0	8_2_00E2ABE0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_00E34330	8_2_00E34330
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_00EA54E0	8_2_00EA54E0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_00EAC470	8_2_00EAC470
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_00E2A7B0	8_2_00E2A7B0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_00F04788	8_2_00F04788
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_00E90F20	8_2_00E90F20
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 11_2_00EFB0B0	11_2_00EFB0B0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 11_2_00E22050	11_2_00E22050
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 11_2_00F01000	11_2_00F01000
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 11_2_00F0A1CF	11_2_00F0A1CF
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 11_2_00E3A180	11_2_00E3A180
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 11_2_00E222D0	11_2_00E222D0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 11_2_00F1DA91	11_2_00F1DA91
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 11_2_00EA2200	11_2_00EA2200
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 11_2_00E2ABE0	11_2_00E2ABE0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 11_2_00E34330	11_2_00E34330
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 11_2_00EA54E0	11_2_00EA54E0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 11_2_00EAC470	11_2_00EAC470
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 11_2_00E2A7B0	11_2_00E2A7B0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 11_2_00F04788	11_2_00F04788
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 11_2_00E90F20	11_2_00E90F20

Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: String function: 0045E1F0 appears 46 times
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: String function: 00EFE1F0 appears 46 times

Source: MSBuild.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: MSBuild.exe	Static PE information: Section: ZLIB complexity 0.9992023887434555
Source: MSBuild.exe	Static PE information: Section: ntfjschw ZLIB complexity 0.9911348068251299
Source: RageMP131.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9992023887434555
Source: RageMP131.exe.0.dr	Static PE information: Section: ntfjschw ZLIB complexity 0.9911348068251299
Source: MPGPH131.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9992023887434555
Source: MPGPH131.exe.0.dr	Static PE information: Section: ntfjschw ZLIB complexity 0.9911348068251299

Source: classification engine

Classification label: mal100.troj.evad.winEXE@11/5@0/1

Source: C:\Users\user\Desktop\MSBuild.exe

File created: C:\Users\user\AppData\Local\RageMP131

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7584:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7632:120:WilError_03

Source: C:\Users\user\Desktop\MSBuild.exe

File created: C:\Users\user\AppData\Local\Temp\rage131MP.tmp

Jump to behavior

Source: C:\Users\user\Desktop\MSBuild.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: MSBuild.exe, 00000000.00000003.1378720423.0000000004EF0000.00000004.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000000.00000002.2599804514.0000000000771000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000006.00000002.2599663751.0000000000381000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000006.00000003.1444596124.0000000004C50000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1445320950.0000000004C30000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2599669602.0000000000381000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000003.1524499032.00000000050B0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2600321345.0000000000E21000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 0000000B.00000003.1603725215.0000000005180000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.2599961844.0000000000E21000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: MSBuild.exe, 00000000.00000003.1378720423.0000000004EF0000.00000004.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000000.00000002.2599804514.0000000000771000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000006.00000002.2599663751.0000000000381000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000006.00000003.1444596124.0000000004C50000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1445320950.0000000004C30000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2599669602.0000000000381000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000003.1524499032.00000000050B0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2600321345.0000000000E21000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 0000000B.00000003.1603725215.0000000005180000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.2599961844.0000000000E21000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q), tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');

Source: MSBuild.exe	ReversingLabs: Detection: 76%
Source: MSBuild.exe	Virustotal: Detection: 73%

Source: MSBuild.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: MPGPH131.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: MPGPH131.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: RageMP131.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: RageMP131.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\MSBuild.exe

File read: C:\Users\user\Desktop\MSBuild.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\MSBuild.exe "C:\Users\user\Desktop\MSBuild.exe"
Source: C:\Users\user\Desktop\MSBuild.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\MSBuild.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\ProgramData\MPGPH131\MPGPH131.exe C:\ProgramData\MPGPH131\MPGPH131.exe
Source: unknown	Process created: C:\ProgramData\MPGPH131\MPGPH131.exe C:\ProgramData\MPGPH131\MPGPH131.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Source: C:\Users\user\Desktop\MSBuild.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\MSBuild.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST	Jump to behavior

Source: C:\Users\user\Desktop\MSBuild.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSBuild.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSBuild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSBuild.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSBuild.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSBuild.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSBuild.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSBuild.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: devobj.dll	Jump to behavior

Source: MSBuild.exe

Static file information: File size 2282496 > 1048576

Source: MSBuild.exe

Static PE information: Raw size of ntfjschw is bigger than: 0x100000 < 0x198e00

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\MSBuild.exe	Unpacked PE file: 0.2.MSBuild.exe.770000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ntfjschw:EW;qapniwtc:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ntfjschw:EW;qapniwtc:EW;.taggant:EW;
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Unpacked PE file: 6.2.MPGPH131.exe.380000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ntfjschw:EW;qapniwtc:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ntfjschw:EW;qapniwtc:EW;.taggant:EW;
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Unpacked PE file: 7.2.MPGPH131.exe.380000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ntfjschw:EW;qapniwtc:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ntfjschw:EW;qapniwtc:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Unpacked PE file: 8.2.RageMP131.exe.e20000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ntfjschw:EW;qapniwtc:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ntfjschw:EW;qapniwtc:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Unpacked PE file: 11.2.RageMP131.exe.e20000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ntfjschw:EW;qapniwtc:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ntfjschw:EW;qapniwtc:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: RageMP131.exe.0.dr	Static PE information: real checksum: 0x232fca should be: 0x22dc07
Source: MSBuild.exe	Static PE information: real checksum: 0x232fca should be: 0x22dc07
Source: MPGPH131.exe.0.dr	Static PE information: real checksum: 0x232fca should be: 0x22dc07

Source: MSBuild.exe	Static PE information: section name:
Source: MSBuild.exe	Static PE information: section name: .idata
Source: MSBuild.exe	Static PE information: section name:
Source: MSBuild.exe	Static PE information: section name: ntfjschw
Source: MSBuild.exe	Static PE information: section name: qapniwtc
Source: MSBuild.exe	Static PE information: section name: .taggant
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name: .idata
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name: ntfjschw
Source: RageMP131.exe.0.dr	Static PE information: section name: qapniwtc
Source: RageMP131.exe.0.dr	Static PE information: section name: .taggant
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name: .idata
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name: ntfjschw
Source: MPGPH131.exe.0.dr	Static PE information: section name: qapniwtc
Source: MPGPH131.exe.0.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\MSBuild.exe	Code function: 0_2_0084DDB7 push ecx; ret	0_2_0084DDCA
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_0045DDB7 push ecx; ret	6_2_0045DDCA
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_0045DDB7 push ecx; ret	7_2_0045DDCA
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_00EFDDB7 push ecx; ret	8_2_00EFDDCA
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 11_2_00EFDDB7 push ecx; ret	11_2_00EFDDCA

Source: MSBuild.exe	Static PE information: section name: entropy: 7.985142092044359
Source: MSBuild.exe	Static PE information: section name: ntfjschw entropy: 7.952029052275701
Source: RageMP131.exe.0.dr	Static PE information: section name: entropy: 7.985142092044359
Source: RageMP131.exe.0.dr	Static PE information: section name: ntfjschw entropy: 7.952029052275701
Source: MPGPH131.exe.0.dr	Static PE information: section name: entropy: 7.985142092044359
Source: MPGPH131.exe.0.dr	Static PE information: section name: ntfjschw entropy: 7.952029052275701

Source: C:\Users\user\Desktop\MSBuild.exe	File created: C:\ProgramData\MPGPH131\MPGPH131.exe			Jump to dropped file
Source: C:\Users\user\Desktop\MSBuild.exe	File created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe			Jump to dropped file

Source: C:\Users\user\Desktop\MSBuild.exe

File created: C:\ProgramData\MPGPH131\MPGPH131.exe

Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\MSBuild.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\MSBuild.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\MSBuild.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\MSBuild.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\MSBuild.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\MSBuild.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\MSBuild.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\MSBuild.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\MSBuild.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: Regmonclass	Jump to behavior

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\MSBuild.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST

Source: C:\Users\user\Desktop\MSBuild.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131			Jump to behavior
Source: C:\Users\user\Desktop\MSBuild.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131			Jump to behavior

Malware Analysis System Evasion

Found stalling execution ending in API Sleep call

Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Stalling execution: Execution stalls by calling Sleep

graph_8-23205

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\MSBuild.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\MSBuild.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A25211 second address: A25217 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A25217 second address: A2521B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A2521B second address: A25249 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FF534D06A42h 0x0000000b jc 00007FF534D06A43h 0x00000011 jmp 00007FF534D06A3Dh 0x00000016 push ecx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A25249 second address: A2525B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jno 00007FF534CC3C6Ah 0x0000000e rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A2422D second address: A2425F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF534D06A41h 0x00000007 jmp 00007FF534D06A42h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e je 00007FF534D06A66h 0x00000014 pushad 0x00000015 pushad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A2425F second address: A24268 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A24268 second address: A24284 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF534D06A48h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A2468E second address: A246A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF534CC3C6Fh 0x00000009 jnc 00007FF534CC3C66h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A246A7 second address: A246AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A2483B second address: A2484E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 jmp 00007FF534CC3C6Bh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A2484E second address: A2485B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jng 00007FF534D06A36h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A24B3B second address: A24B74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jmp 00007FF534CC3C72h 0x0000000b popad 0x0000000c pop eax 0x0000000d pushad 0x0000000e jmp 00007FF534CC3C76h 0x00000013 push eax 0x00000014 push edx 0x00000015 js 00007FF534CC3C66h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A24B74 second address: A24B78 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A2652E second address: A2655C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 push eax 0x00000007 pushad 0x00000008 jl 00007FF534CC3C68h 0x0000000e push edi 0x0000000f pushad 0x00000010 popad 0x00000011 pop edi 0x00000012 popad 0x00000013 mov eax, dword ptr [esp+04h] 0x00000017 push ecx 0x00000018 jg 00007FF534CC3C68h 0x0000001e push edi 0x0000001f pop edi 0x00000020 pop ecx 0x00000021 mov eax, dword ptr [eax] 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 jc 00007FF534CC3C66h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A2655C second address: A2657F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF534D06A3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e pushad 0x0000000f jmp 00007FF534D06A3Ah 0x00000014 push eax 0x00000015 push edx 0x00000016 push esi 0x00000017 pop esi 0x00000018 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A2657F second address: A26583 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A2667E second address: A266AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a jnp 00007FF534D06A4Dh 0x00000010 mov eax, dword ptr [eax] 0x00000012 push esi 0x00000013 push eax 0x00000014 push edx 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A266AC second address: A266B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A266B0 second address: A266BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push ecx 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A266BF second address: A266D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop ecx 0x00000006 pop eax 0x00000007 mov cx, dx 0x0000000a lea ebx, dword ptr [ebp+1244A47Bh] 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A26748 second address: A26752 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push ecx 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A26752 second address: A267E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop ecx 0x00000006 nop 0x00000007 and cx, F634h 0x0000000c push 00000000h 0x0000000e push 00000000h 0x00000010 push edx 0x00000011 call 00007FF534CC3C68h 0x00000016 pop edx 0x00000017 mov dword ptr [esp+04h], edx 0x0000001b add dword ptr [esp+04h], 0000001Ch 0x00000023 inc edx 0x00000024 push edx 0x00000025 ret 0x00000026 pop edx 0x00000027 ret 0x00000028 jbe 00007FF534CC3C6Ah 0x0000002e mov cx, EEA5h 0x00000032 call 00007FF534CC3C69h 0x00000037 pushad 0x00000038 jmp 00007FF534CC3C76h 0x0000003d pushad 0x0000003e jmp 00007FF534CC3C6Fh 0x00000043 jo 00007FF534CC3C66h 0x00000049 popad 0x0000004a popad 0x0000004b push eax 0x0000004c jbe 00007FF534CC3C77h 0x00000052 jmp 00007FF534CC3C71h 0x00000057 mov eax, dword ptr [esp+04h] 0x0000005b push edi 0x0000005c pushad 0x0000005d push eax 0x0000005e push edx 0x0000005f rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A267E6 second address: A2680A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pop edi 0x00000008 mov eax, dword ptr [eax] 0x0000000a jbe 00007FF534D06A3Ch 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 push edi 0x00000014 pop edi 0x00000015 popad 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a je 00007FF534D06A44h 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 pop eax 0x00000024 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A26903 second address: A26908 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A26908 second address: A26979 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF534D06A46h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c mov dword ptr [ebp+122D35E4h], eax 0x00000012 call 00007FF534D06A39h 0x00000017 jnp 00007FF534D06A50h 0x0000001d push eax 0x0000001e jns 00007FF534D06A42h 0x00000024 js 00007FF534D06A3Ch 0x0000002a mov eax, dword ptr [esp+04h] 0x0000002e pushad 0x0000002f jmp 00007FF534D06A3Ah 0x00000034 push edi 0x00000035 push eax 0x00000036 push edx 0x00000037 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A26979 second address: A26989 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 mov eax, dword ptr [eax] 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A26989 second address: A269C2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF534D06A43h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esp+04h], eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 jbe 00007FF534D06A36h 0x0000001a jmp 00007FF534D06A40h 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A47E23 second address: A47E44 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 popad 0x00000007 pop ecx 0x00000008 jmp 00007FF534CC3C71h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A47E44 second address: A47E4A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A47E4A second address: A47E50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A47E50 second address: A47E5D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007FF534D06A36h 0x00000009 push edx 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A13A58 second address: A13A5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A13A5E second address: A13A7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF534D06A3Fh 0x00000009 popad 0x0000000a pop eax 0x0000000b jng 00007FF534D06A58h 0x00000011 push eax 0x00000012 push edx 0x00000013 push edi 0x00000014 pop edi 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A46406 second address: A4640A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A4640A second address: A4640E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A4685B second address: A4685F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A4685F second address: A46865 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A46865 second address: A4686A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A4686A second address: A46888 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FF534D06A3Dh 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 ja 00007FF534D06A36h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A469B5 second address: A469CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF534CC3C6Ch 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e push edi 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A469CC second address: A469D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A46C1F second address: A46C25 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A46C25 second address: A46C2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A46C2D second address: A46C31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A3AB7A second address: A3AB96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jl 00007FF534D06A36h 0x0000000c popad 0x0000000d pushad 0x0000000e jg 00007FF534D06A36h 0x00000014 jnl 00007FF534D06A36h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A3AB96 second address: A3ABA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FF534CC3C66h 0x0000000a popad 0x0000000b jp 00007FF534CC3C6Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A46EDB second address: A46EE1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A46EE1 second address: A46EE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A47C9E second address: A47CA6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A47CA6 second address: A47CBE instructions: 0x00000000 rdtsc 0x00000002 jne 00007FF534CC3C72h 0x00000008 jmp 00007FF534CC3C6Ah 0x0000000d push edx 0x0000000e pop edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A47CBE second address: A47CC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A4C98C second address: A4C990 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A4E2CA second address: A4E2CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A1D9FD second address: A1DA03 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A54E83 second address: A54E89 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A541E2 second address: A541F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 jmp 00007FF534CC3C70h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A541F9 second address: A5420F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jnl 00007FF534D06A36h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jo 00007FF534D06A7Eh 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A543A3 second address: A543B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF534CC3C71h 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A543B9 second address: A543BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A543BF second address: A543C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A54555 second address: A5455D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A546E7 second address: A546F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FF534CC3C6Dh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A546F9 second address: A54744 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007FF534D06A49h 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jp 00007FF534D06A4Eh 0x00000013 jmp 00007FF534D06A3Ch 0x00000018 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A549FC second address: A54A01 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A54A01 second address: A54A15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 jc 00007FF534D06A36h 0x0000000c pop eax 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A54A15 second address: A54A36 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FF534CC3C6Bh 0x0000000d jmp 00007FF534CC3C6Eh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A54B9E second address: A54BA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A54D22 second address: A54D28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A54D28 second address: A54D60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007FF534D06A44h 0x0000000d push eax 0x0000000e pop eax 0x0000000f push edi 0x00000010 pop edi 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FF534D06A45h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A56EFD second address: A56F16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF534CC3C75h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A574ED second address: A574F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A57A5A second address: A57A81 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FF534CC3C6Ch 0x0000000b popad 0x0000000c mov dword ptr [esp], ebx 0x0000000f or esi, dword ptr [ebp+122D38B9h] 0x00000015 stc 0x00000016 nop 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a ja 00007FF534CC3C66h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A57A81 second address: A57A9D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FF534D06A3Eh 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 pushad 0x00000011 popad 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A57B71 second address: A57B76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A57B76 second address: A57B88 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF534D06A3Dh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A57C88 second address: A57C9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF534CC3C6Dh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A58129 second address: A58141 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF534D06A40h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A58141 second address: A5815B instructions: 0x00000000 rdtsc 0x00000002 jl 00007FF534CC3C66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e sub edi, 23574FFEh 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 push edi 0x00000019 pop edi 0x0000001a rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A586B5 second address: A586B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A586B9 second address: A586BE instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A586BE second address: A5871B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jmp 00007FF534D06A40h 0x0000000d nop 0x0000000e push 00000000h 0x00000010 push ebp 0x00000011 call 00007FF534D06A38h 0x00000016 pop ebp 0x00000017 mov dword ptr [esp+04h], ebp 0x0000001b add dword ptr [esp+04h], 0000001Ah 0x00000023 inc ebp 0x00000024 push ebp 0x00000025 ret 0x00000026 pop ebp 0x00000027 ret 0x00000028 mov edi, dword ptr [ebp+122D5734h] 0x0000002e push 00000000h 0x00000030 mov edi, dword ptr [ebp+122D1828h] 0x00000036 push 00000000h 0x00000038 mov esi, edi 0x0000003a xchg eax, ebx 0x0000003b push eax 0x0000003c push edx 0x0000003d pushad 0x0000003e jmp 00007FF534D06A3Ah 0x00000043 push eax 0x00000044 push edx 0x00000045 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A5871B second address: A58720 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A58720 second address: A58725 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A58725 second address: A58739 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jl 00007FF534CC3C68h 0x00000012 push edx 0x00000013 pop edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A5A086 second address: A5A08F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A5A08F second address: A5A0B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 jl 00007FF534CC3C6Ch 0x0000000e jo 00007FF534CC3C66h 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FF534CC3C73h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A5A0B8 second address: A5A0FC instructions: 0x00000000 rdtsc 0x00000002 je 00007FF534D06A36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push 00000000h 0x00000010 push ebx 0x00000011 call 00007FF534D06A38h 0x00000016 pop ebx 0x00000017 mov dword ptr [esp+04h], ebx 0x0000001b add dword ptr [esp+04h], 00000014h 0x00000023 inc ebx 0x00000024 push ebx 0x00000025 ret 0x00000026 pop ebx 0x00000027 ret 0x00000028 push 00000000h 0x0000002a mov dword ptr [ebp+122D2121h], ebx 0x00000030 push eax 0x00000031 pushad 0x00000032 jne 00007FF534D06A3Ch 0x00000038 push eax 0x00000039 push edx 0x0000003a push edi 0x0000003b pop edi 0x0000003c rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A5A8E9 second address: A5A8ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A5A8ED second address: A5A8FA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push ebx 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A5C0F5 second address: A5C0FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A5D50F second address: A5D522 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 je 00007FF534D06A40h 0x0000000e pushad 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A5E982 second address: A5E987 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A5C8AA second address: A5C8C5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF534D06A47h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A5C8C5 second address: A5C8CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007FF534CC3C66h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A5FEEC second address: A5FEF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A5C8CF second address: A5C8DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A5FEF1 second address: A5FF77 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FF534D06A38h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007FF534D06A45h 0x00000012 nop 0x00000013 push 00000000h 0x00000015 push edi 0x00000016 call 00007FF534D06A38h 0x0000001b pop edi 0x0000001c mov dword ptr [esp+04h], edi 0x00000020 add dword ptr [esp+04h], 00000014h 0x00000028 inc edi 0x00000029 push edi 0x0000002a ret 0x0000002b pop edi 0x0000002c ret 0x0000002d mov dword ptr [ebp+1244590Eh], eax 0x00000033 mov dword ptr [ebp+122D23F0h], edx 0x00000039 push 00000000h 0x0000003b js 00007FF534D06A3Ch 0x00000041 mov edi, dword ptr [ebp+122D3699h] 0x00000047 push 00000000h 0x00000049 jmp 00007FF534D06A3Ah 0x0000004e xchg eax, esi 0x0000004f jmp 00007FF534D06A46h 0x00000054 push eax 0x00000055 jo 00007FF534D06A40h 0x0000005b pushad 0x0000005c push eax 0x0000005d push edx 0x0000005e rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A61BDD second address: A61BE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A61BE2 second address: A61BED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007FF534D06A36h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A62E27 second address: A62E2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A62E2B second address: A62E2F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A64BEC second address: A64C74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 push eax 0x00000007 pushad 0x00000008 jmp 00007FF534CC3C71h 0x0000000d jmp 00007FF534CC3C6Ch 0x00000012 popad 0x00000013 nop 0x00000014 push 00000000h 0x00000016 push ebx 0x00000017 call 00007FF534CC3C68h 0x0000001c pop ebx 0x0000001d mov dword ptr [esp+04h], ebx 0x00000021 add dword ptr [esp+04h], 0000001Dh 0x00000029 inc ebx 0x0000002a push ebx 0x0000002b ret 0x0000002c pop ebx 0x0000002d ret 0x0000002e mov edi, 08433172h 0x00000033 push 00000000h 0x00000035 sub dword ptr [ebp+122D200Fh], eax 0x0000003b push 00000000h 0x0000003d movzx ebx, di 0x00000040 jmp 00007FF534CC3C71h 0x00000045 xchg eax, esi 0x00000046 pushad 0x00000047 jmp 00007FF534CC3C6Bh 0x0000004c push eax 0x0000004d pushad 0x0000004e popad 0x0000004f pop eax 0x00000050 popad 0x00000051 push eax 0x00000052 push eax 0x00000053 push edx 0x00000054 push eax 0x00000055 push edx 0x00000056 push esi 0x00000057 pop esi 0x00000058 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A64C74 second address: A64C7E instructions: 0x00000000 rdtsc 0x00000002 jp 00007FF534D06A36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A62E2F second address: A62E39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A64C7E second address: A64C84 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A62E39 second address: A62EFC instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FF534CC3C66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push ebp 0x00000011 call 00007FF534CC3C68h 0x00000016 pop ebp 0x00000017 mov dword ptr [esp+04h], ebp 0x0000001b add dword ptr [esp+04h], 00000014h 0x00000023 inc ebp 0x00000024 push ebp 0x00000025 ret 0x00000026 pop ebp 0x00000027 ret 0x00000028 mov dword ptr [ebp+122D1939h], edx 0x0000002e jmp 00007FF534CC3C6Ah 0x00000033 push dword ptr fs:[00000000h] 0x0000003a je 00007FF534CC3C6Ch 0x00000040 mov edi, dword ptr [ebp+122D374Dh] 0x00000046 jns 00007FF534CC3C6Ch 0x0000004c mov dword ptr fs:[00000000h], esp 0x00000053 push 00000000h 0x00000055 push ebx 0x00000056 call 00007FF534CC3C68h 0x0000005b pop ebx 0x0000005c mov dword ptr [esp+04h], ebx 0x00000060 add dword ptr [esp+04h], 00000016h 0x00000068 inc ebx 0x00000069 push ebx 0x0000006a ret 0x0000006b pop ebx 0x0000006c ret 0x0000006d mov bx, 1D00h 0x00000071 mov eax, dword ptr [ebp+122D13D9h] 0x00000077 mov dword ptr [ebp+122D1963h], edx 0x0000007d sub edi, 6CF38360h 0x00000083 push FFFFFFFFh 0x00000085 cmc 0x00000086 nop 0x00000087 jmp 00007FF534CC3C77h 0x0000008c push eax 0x0000008d push eax 0x0000008e push edx 0x0000008f push eax 0x00000090 push edx 0x00000091 jmp 00007FF534CC3C6Fh 0x00000096 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A62EFC second address: A62F00 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A62F00 second address: A62F06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A65E33 second address: A65E3A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A65E3A second address: A65E4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jl 00007FF534CC3C70h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A64DED second address: A64DF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A67EA7 second address: A67F37 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FF534CC3C66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b je 00007FF534CC3C66h 0x00000011 pop esi 0x00000012 popad 0x00000013 mov dword ptr [esp], eax 0x00000016 push 00000000h 0x00000018 push ecx 0x00000019 call 00007FF534CC3C68h 0x0000001e pop ecx 0x0000001f mov dword ptr [esp+04h], ecx 0x00000023 add dword ptr [esp+04h], 00000015h 0x0000002b inc ecx 0x0000002c push ecx 0x0000002d ret 0x0000002e pop ecx 0x0000002f ret 0x00000030 call 00007FF534CC3C77h 0x00000035 pop ebx 0x00000036 mov dword ptr [ebp+122D192Dh], eax 0x0000003c push 00000000h 0x0000003e movzx edi, dx 0x00000041 push 00000000h 0x00000043 push esi 0x00000044 ja 00007FF534CC3C6Ch 0x0000004a pop ebx 0x0000004b je 00007FF534CC3C6Eh 0x00000051 pushad 0x00000052 mov esi, dword ptr [ebp+122D290Fh] 0x00000058 popad 0x00000059 push eax 0x0000005a push ecx 0x0000005b push eax 0x0000005c push edx 0x0000005d jmp 00007FF534CC3C78h 0x00000062 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A69F54 second address: A69FAD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push 00000000h 0x0000000e push ecx 0x0000000f call 00007FF534D06A38h 0x00000014 pop ecx 0x00000015 mov dword ptr [esp+04h], ecx 0x00000019 add dword ptr [esp+04h], 00000018h 0x00000021 inc ecx 0x00000022 push ecx 0x00000023 ret 0x00000024 pop ecx 0x00000025 ret 0x00000026 push 00000000h 0x00000028 push 00000000h 0x0000002a push edi 0x0000002b call 00007FF534D06A38h 0x00000030 pop edi 0x00000031 mov dword ptr [esp+04h], edi 0x00000035 add dword ptr [esp+04h], 0000001Dh 0x0000003d inc edi 0x0000003e push edi 0x0000003f ret 0x00000040 pop edi 0x00000041 ret 0x00000042 xchg eax, esi 0x00000043 pushad 0x00000044 push eax 0x00000045 push edx 0x00000046 push esi 0x00000047 pop esi 0x00000048 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A69FAD second address: A69FB7 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A69FB7 second address: A69FBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A6AF63 second address: A6AFB2 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FF534CC3C68h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push ebx 0x00000010 call 00007FF534CC3C68h 0x00000015 pop ebx 0x00000016 mov dword ptr [esp+04h], ebx 0x0000001a add dword ptr [esp+04h], 00000014h 0x00000022 inc ebx 0x00000023 push ebx 0x00000024 ret 0x00000025 pop ebx 0x00000026 ret 0x00000027 push eax 0x00000028 push ecx 0x00000029 add dword ptr [ebp+122D362Eh], edx 0x0000002f pop edi 0x00000030 pop ebx 0x00000031 push 00000000h 0x00000033 movzx ebx, bx 0x00000036 push 00000000h 0x00000038 js 00007FF534CC3C69h 0x0000003e sbb bl, 00000062h 0x00000041 push eax 0x00000042 push edi 0x00000043 push eax 0x00000044 push edx 0x00000045 jnp 00007FF534CC3C66h 0x0000004b rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A6CE9F second address: A6CEA3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A6CEA3 second address: A6CEC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jl 00007FF534CC3C7Fh 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FF534CC3C71h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A68FFB second address: A68FFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A68FFF second address: A69005 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A69005 second address: A690A0 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FF534D06A3Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d mov ebx, dword ptr [ebp+122D2DEFh] 0x00000013 push dword ptr fs:[00000000h] 0x0000001a push 00000000h 0x0000001c push edi 0x0000001d call 00007FF534D06A38h 0x00000022 pop edi 0x00000023 mov dword ptr [esp+04h], edi 0x00000027 add dword ptr [esp+04h], 00000018h 0x0000002f inc edi 0x00000030 push edi 0x00000031 ret 0x00000032 pop edi 0x00000033 ret 0x00000034 cmc 0x00000035 mov bx, E62Ah 0x00000039 mov dword ptr fs:[00000000h], esp 0x00000040 mov ebx, 169AB44Ch 0x00000045 mov eax, dword ptr [ebp+122D16E9h] 0x0000004b push 00000000h 0x0000004d push ebx 0x0000004e call 00007FF534D06A38h 0x00000053 pop ebx 0x00000054 mov dword ptr [esp+04h], ebx 0x00000058 add dword ptr [esp+04h], 0000001Bh 0x00000060 inc ebx 0x00000061 push ebx 0x00000062 ret 0x00000063 pop ebx 0x00000064 ret 0x00000065 adc edi, 767E8847h 0x0000006b push FFFFFFFFh 0x0000006d jmp 00007FF534D06A3Fh 0x00000072 nop 0x00000073 pushad 0x00000074 push eax 0x00000075 push edx 0x00000076 jo 00007FF534D06A36h 0x0000007c rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A690A0 second address: A690A9 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A67175 second address: A6717B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A6E0F7 second address: A6E16D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 nop 0x00000005 xor ebx, 13A85352h 0x0000000b push dword ptr fs:[00000000h] 0x00000012 or ebx, 7034A896h 0x00000018 mov dword ptr fs:[00000000h], esp 0x0000001f push 00000000h 0x00000021 push ebx 0x00000022 call 00007FF534CC3C68h 0x00000027 pop ebx 0x00000028 mov dword ptr [esp+04h], ebx 0x0000002c add dword ptr [esp+04h], 0000001Dh 0x00000034 inc ebx 0x00000035 push ebx 0x00000036 ret 0x00000037 pop ebx 0x00000038 ret 0x00000039 mov eax, dword ptr [ebp+122D0285h] 0x0000003f or ebx, dword ptr [ebp+122D39A1h] 0x00000045 push FFFFFFFFh 0x00000047 call 00007FF534CC3C73h 0x0000004c je 00007FF534CC3C69h 0x00000052 movsx edi, si 0x00000055 pop ebx 0x00000056 push eax 0x00000057 push eax 0x00000058 push edx 0x00000059 push esi 0x0000005a push edi 0x0000005b pop edi 0x0000005c pop esi 0x0000005d rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A15519 second address: A1555E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF534D06A41h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007FF534D06A45h 0x0000000f jmp 00007FF534D06A48h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A1555E second address: A15564 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A15564 second address: A15569 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A15569 second address: A15570 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A0EA12 second address: A0EA29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF534D06A41h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A77D88 second address: A77D90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A18AF2 second address: A18AF6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A18AF6 second address: A18B0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FF534CC3C66h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e js 00007FF534CC3C66h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A7DDA7 second address: A7DDAB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A7DDAB second address: A7DDCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push edx 0x0000000c je 00007FF534CC3C68h 0x00000012 pushad 0x00000013 popad 0x00000014 pop edx 0x00000015 mov eax, dword ptr [eax] 0x00000017 push esi 0x00000018 push eax 0x00000019 push edx 0x0000001a jnp 00007FF534CC3C66h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A7DF26 second address: A7DF2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A8377D second address: A837A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FF534CC3C6Eh 0x0000000e jng 00007FF534CC3C72h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A837A6 second address: A837B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF534D06A3Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A82C20 second address: A82C42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 jnp 00007FF534CC3C66h 0x0000000c jmp 00007FF534CC3C74h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A82C42 second address: A82C4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A830B2 second address: A830B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A83217 second address: A8321C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A88500 second address: A88513 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF534CC3C6Fh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A88513 second address: A8851C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A8851C second address: A88522 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A88522 second address: A88528 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A88528 second address: A8852D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A88689 second address: A88693 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FF534D06A36h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A88693 second address: A8869C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A8869C second address: A886A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A89042 second address: A89046 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A89046 second address: A89078 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FF534D06A36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a js 00007FF534D06A4Bh 0x00000010 jmp 00007FF534D06A45h 0x00000015 popad 0x00000016 jng 00007FF534D06A48h 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 pushad 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A89078 second address: A8907E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A891E1 second address: A891ED instructions: 0x00000000 rdtsc 0x00000002 jns 00007FF534D06A36h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A898E3 second address: A898EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A8F195 second address: A8F19F instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FF534D06A42h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A8F19F second address: A8F1A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A8E097 second address: A8E0A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 jmp 00007FF534D06A3Bh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A8E234 second address: A8E239 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A8E51F second address: A8E533 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007FF534D06A3Ch 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A8E533 second address: A8E543 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF534CC3C6Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A8E543 second address: A8E55C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF534D06A45h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A8EBF2 second address: A8EC10 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FF534CC3C78h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A8EC10 second address: A8EC24 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jg 00007FF534D06A36h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c jc 00007FF534D06A3Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A907D9 second address: A907DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A9333C second address: A9336B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jns 00007FF534D06A38h 0x0000000b jmp 00007FF534D06A48h 0x00000010 popad 0x00000011 jno 00007FF534D06A4Ah 0x00000017 push ecx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A9A62A second address: A9A62E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A5568C second address: A55691 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A55691 second address: A55718 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007FF534CC3C66h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp], eax 0x00000011 push 00000000h 0x00000013 push ebx 0x00000014 call 00007FF534CC3C68h 0x00000019 pop ebx 0x0000001a mov dword ptr [esp+04h], ebx 0x0000001e add dword ptr [esp+04h], 00000019h 0x00000026 inc ebx 0x00000027 push ebx 0x00000028 ret 0x00000029 pop ebx 0x0000002a ret 0x0000002b lea eax, dword ptr [ebp+12479405h] 0x00000031 push 00000000h 0x00000033 push ecx 0x00000034 call 00007FF534CC3C68h 0x00000039 pop ecx 0x0000003a mov dword ptr [esp+04h], ecx 0x0000003e add dword ptr [esp+04h], 00000019h 0x00000046 inc ecx 0x00000047 push ecx 0x00000048 ret 0x00000049 pop ecx 0x0000004a ret 0x0000004b je 00007FF534CC3C6Bh 0x00000051 add cx, 5D17h 0x00000056 nop 0x00000057 jmp 00007FF534CC3C77h 0x0000005c push eax 0x0000005d push eax 0x0000005e push edx 0x0000005f jbe 00007FF534CC3C6Ch 0x00000065 push eax 0x00000066 push edx 0x00000067 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A55718 second address: A5571C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A5571C second address: A55721 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A55721 second address: A3AB7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 mov dword ptr [ebp+122D2767h], eax 0x0000000e call dword ptr [ebp+122D198Eh] 0x00000014 pushad 0x00000015 jmp 00007FF534D06A45h 0x0000001a push ecx 0x0000001b jmp 00007FF534D06A3Bh 0x00000020 pop ecx 0x00000021 jmp 00007FF534D06A3Ah 0x00000026 popad 0x00000027 pushad 0x00000028 jmp 00007FF534D06A42h 0x0000002d pushad 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A55FB4 second address: A55FCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pop ebx 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push eax 0x0000000d pushad 0x0000000e jg 00007FF534CC3C66h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A55FCA second address: A56038 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 mov eax, dword ptr [eax] 0x00000008 pushad 0x00000009 pushad 0x0000000a jmp 00007FF534D06A48h 0x0000000f jmp 00007FF534D06A49h 0x00000014 popad 0x00000015 jbe 00007FF534D06A4Fh 0x0000001b jmp 00007FF534D06A49h 0x00000020 popad 0x00000021 mov dword ptr [esp+04h], eax 0x00000025 jl 00007FF534D06A42h 0x0000002b je 00007FF534D06A3Ch 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A560D8 second address: A560F0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF534CC3C71h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A561DC second address: A561F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF534D06A47h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A561F7 second address: A56246 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FF534CC3C66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f mov edx, dword ptr [ebp+122D27DEh] 0x00000015 push 00000004h 0x00000017 ja 00007FF534CC3C7Ah 0x0000001d nop 0x0000001e jbe 00007FF534CC3C73h 0x00000024 jmp 00007FF534CC3C6Dh 0x00000029 push eax 0x0000002a je 00007FF534CC3C6Eh 0x00000030 push edx 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A568F8 second address: A568FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A569A9 second address: A569AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A569AD second address: A569B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A569B3 second address: A56A43 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF534CC3C73h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c jp 00007FF534CC3C6Ch 0x00000012 adc edi, 2701E5FBh 0x00000018 lea eax, dword ptr [ebp+12479449h] 0x0000001e and ecx, 2976222Ah 0x00000024 add ecx, dword ptr [ebp+122D38EDh] 0x0000002a nop 0x0000002b jmp 00007FF534CC3C73h 0x00000030 push eax 0x00000031 jno 00007FF534CC3C70h 0x00000037 nop 0x00000038 mov ecx, dword ptr [ebp+122D38E5h] 0x0000003e lea eax, dword ptr [ebp+12479405h] 0x00000044 adc di, FB69h 0x00000049 nop 0x0000004a jmp 00007FF534CC3C79h 0x0000004f push eax 0x00000050 push eax 0x00000051 push edx 0x00000052 push eax 0x00000053 push edx 0x00000054 pushad 0x00000055 popad 0x00000056 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A56A43 second address: A56A5C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF534D06A45h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A56A5C second address: A56A62 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A9ABBD second address: A9ABD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push esi 0x00000007 pop esi 0x00000008 jmp 00007FF534D06A3Ah 0x0000000d pop eax 0x0000000e pushad 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A9ABD8 second address: A9ABE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A9AFE5 second address: A9AFE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A9D652 second address: A9D656 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A9D656 second address: A9D66A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FF534D06A36h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c ja 00007FF534D06A4Dh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: AA090B second address: AA090F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: AA090F second address: AA0929 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF534D06A3Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a pushad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: AA0929 second address: AA0962 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007FF534CC3C72h 0x0000000d jmp 00007FF534CC3C6Bh 0x00000012 pushad 0x00000013 popad 0x00000014 jc 00007FF534CC3C66h 0x0000001a popad 0x0000001b pushad 0x0000001c pushad 0x0000001d popad 0x0000001e jl 00007FF534CC3C66h 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: AA0315 second address: AA0323 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnp 00007FF534D06A36h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: AA0323 second address: AA0368 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b jbe 00007FF534CC3C6Ch 0x00000011 pushad 0x00000012 jmp 00007FF534CC3C74h 0x00000017 push eax 0x00000018 pop eax 0x00000019 je 00007FF534CC3C66h 0x0000001f jmp 00007FF534CC3C70h 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: AA04C7 second address: AA04D1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: AA04D1 second address: AA04D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: AA04D5 second address: AA04DD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A105A5 second address: A105A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A105A9 second address: A105BC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 jc 00007FF534D06A53h 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: AA591F second address: AA5936 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF534CC3C72h 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: AA5936 second address: AA593F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop esi 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: AA5A47 second address: AA5A4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: AA5A4D second address: AA5A51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: AA5A51 second address: AA5A5D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jng 00007FF534CC3C66h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A564B0 second address: A564CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF534D06A49h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A564CD second address: A564DF instructions: 0x00000000 rdtsc 0x00000002 js 00007FF534CC3C68h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A564DF second address: A564E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A10581 second address: A105A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF534CC3C76h 0x00000009 push eax 0x0000000a push edx 0x0000000b jng 00007FF534CC3C66h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: AA9A32 second address: AA9A3A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: AA9A3A second address: AA9A48 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jng 00007FF534CC3C6Eh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: AA9235 second address: AA9246 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF534D06A3Bh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: AA949C second address: AA94A2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A1701A second address: A17020 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: AAD97D second address: AAD987 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: AAD987 second address: AAD98B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: AAD98B second address: AAD99A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF534CC3C6Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: AADC60 second address: AADC65 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: AADC65 second address: AADC6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: AADDCF second address: AADDF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF534D06A42h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FF534D06A3Ah 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: AADDF4 second address: AADDF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: AADDF8 second address: AADDFC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: AAE05D second address: AAE061 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: AAE061 second address: AAE06A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: AAE06A second address: AAE070 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: AB442F second address: AB4445 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jp 00007FF534D06A36h 0x0000000c popad 0x0000000d pushad 0x0000000e jl 00007FF534D06A36h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: AB4445 second address: AB445B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FF534CC3C66h 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 js 00007FF534CC3C66h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: AB445B second address: AB4464 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: AB4464 second address: AB4473 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF534CC3C6Ah 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: AB45B4 second address: AB45D0 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FF534D06A36h 0x00000008 jne 00007FF534D06A36h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 ja 00007FF534D06A3Ch 0x00000016 je 00007FF534D06A36h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: AB45D0 second address: AB45E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF534CC3C71h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: AB4718 second address: AB4731 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FF534D06A36h 0x0000000a pop ecx 0x0000000b jmp 00007FF534D06A3Eh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: AB4731 second address: AB4736 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: AB4736 second address: AB4755 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 jnp 00007FF534D06A4Eh 0x0000000d jbe 00007FF534D06A38h 0x00000013 push eax 0x00000014 push edx 0x00000015 jl 00007FF534D06A36h 0x0000001b push ecx 0x0000001c pop ecx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: AB4A3A second address: AB4A5E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF534CC3C6Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jl 00007FF534CC3C66h 0x00000012 jno 00007FF534CC3C66h 0x00000018 jg 00007FF534CC3C66h 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: AB4F5C second address: AB4F60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: AB4F60 second address: AB4F66 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: AB4F66 second address: AB4F6E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: AB4F6E second address: AB4F72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: AB54CB second address: AB54D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: AB5777 second address: AB577F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: AB577F second address: AB5798 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jmp 00007FF534D06A40h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: AB5AEB second address: AB5AF0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: AB5AF0 second address: AB5AF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: AB6097 second address: AB609B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: ABA018 second address: ABA046 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007FF534D06A41h 0x00000011 popad 0x00000012 push ecx 0x00000013 push esi 0x00000014 pop esi 0x00000015 jmp 00007FF534D06A3Ch 0x0000001a pop ecx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: ABA046 second address: ABA04B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: ABA04B second address: ABA058 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: AB9847 second address: AB986F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF534CC3C77h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FF534CC3C6Dh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: AB9997 second address: AB999D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: AB9C95 second address: AB9CA2 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pushad 0x0000000b popad 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: ABE790 second address: ABE794 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: ABE794 second address: ABE7E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF534CC3C74h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jl 00007FF534CC3C82h 0x00000011 jmp 00007FF534CC3C76h 0x00000016 jg 00007FF534CC3C66h 0x0000001c pushad 0x0000001d pushad 0x0000001e popad 0x0000001f push edx 0x00000020 pop edx 0x00000021 push esi 0x00000022 pop esi 0x00000023 popad 0x00000024 popad 0x00000025 je 00007FF534CC3C83h 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A1F4F6 second address: A1F502 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FF534D06A36h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A1F502 second address: A1F508 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: AC54CD second address: AC54D3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: AC560A second address: AC561F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FF534CC3C66h 0x0000000a jc 00007FF534CC3C66h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: AC561F second address: AC5630 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF534D06A3Bh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: AC5906 second address: AC5917 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jno 00007FF534CC3C66h 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: AC62A5 second address: AC62AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: AC69FD second address: AC6A0A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007FF534CC3C66h 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: AC6A0A second address: AC6A13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: AC6A13 second address: AC6A17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: AC6A17 second address: AC6A4F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007FF534D06A42h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push ebx 0x0000000e push ecx 0x0000000f jmp 00007FF534D06A46h 0x00000014 pop ecx 0x00000015 pushad 0x00000016 push esi 0x00000017 pop esi 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: AC4914 second address: AC4918 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: ACD268 second address: ACD26E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: ACD26E second address: ACD284 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnp 00007FF534CC3C6Eh 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: ADB319 second address: ADB337 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FF534D06A47h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: ADB337 second address: ADB33B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: ADB33B second address: ADB378 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebx 0x00000009 pushad 0x0000000a jbe 00007FF534D06A48h 0x00000010 pushad 0x00000011 jnl 00007FF534D06A36h 0x00000017 jmp 00007FF534D06A42h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: ADAF30 second address: ADAF34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: ADAF34 second address: ADAF38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: AE3159 second address: AE315F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: AE315F second address: AE3183 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF534D06A48h 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e pop edx 0x0000000f push esi 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: AE3183 second address: AE3187 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: AEB684 second address: AEB6A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FF534D06A36h 0x0000000a jmp 00007FF534D06A48h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: AEB6A8 second address: AEB6B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: AEB6B1 second address: AEB6B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: AF2341 second address: AF2354 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b jl 00007FF534CC3C72h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: AF2354 second address: AF235E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FF534D06A36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: AF275B second address: AF2792 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FF534CC3C66h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c popad 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 jmp 00007FF534CC3C73h 0x00000015 jmp 00007FF534CC3C6Dh 0x0000001a jl 00007FF534CC3C66h 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: AF2B82 second address: AF2B86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: AF2B86 second address: AF2B98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jnl 00007FF534CC3C66h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: AF720A second address: AF7214 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FF534D06A36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: AF7214 second address: AF722D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF534CC3C75h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: AF722D second address: AF7233 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: AF6E12 second address: AF6E16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: B0F91F second address: B0F926 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: B0F926 second address: B0F932 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007FF534CC3C66h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: B0F932 second address: B0F936 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: B0F74F second address: B0F753 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: B0F753 second address: B0F760 instructions: 0x00000000 rdtsc 0x00000002 je 00007FF534D06A36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: B0F760 second address: B0F766 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: B0F766 second address: B0F76B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: B09595 second address: B09599 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: B09599 second address: B095DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jno 00007FF534D06A4Ah 0x0000000c pushad 0x0000000d jmp 00007FF534D06A3Ch 0x00000012 jmp 00007FF534D06A44h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: B1B619 second address: B1B61D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: B1B61D second address: B1B629 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: B1B629 second address: B1B62F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: B1B62F second address: B1B633 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: B1CD95 second address: B1CDBA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF534CC3C79h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a js 00007FF534CC3C66h 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: B1F89F second address: B1F8B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FF534D06A36h 0x0000000a jg 00007FF534D06A36h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: B1F533 second address: B1F54A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF534CC3C6Eh 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: B1F54A second address: B1F550 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: B1F550 second address: B1F554 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: B46E85 second address: B46E89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: B46E89 second address: B46E8D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: B46E8D second address: B46E93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: B45C89 second address: B45C8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: B45C8F second address: B45C9F instructions: 0x00000000 rdtsc 0x00000002 jne 00007FF534D06A36h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: B45F39 second address: B45F3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: B45F3D second address: B45F43 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: B45F43 second address: B45F49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: B45F49 second address: B45F59 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jns 00007FF534D06A36h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: B4606A second address: B46082 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF534CC3C74h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: B46082 second address: B46087 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: B46087 second address: B4608D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: B4608D second address: B460C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jng 00007FF534D06A3Ah 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e jmp 00007FF534D06A40h 0x00000013 jnc 00007FF534D06A42h 0x00000019 jmp 00007FF534D06A3Ah 0x0000001e push edi 0x0000001f pop edi 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: B4668B second address: B466A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF534CC3C70h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: B466A0 second address: B466BB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF534D06A44h 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: B466BB second address: B466C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: B466C1 second address: B466D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a jmp 00007FF534D06A3Ah 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: B4680E second address: B46824 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF534CC3C72h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: B46824 second address: B46845 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jng 00007FF534D06A36h 0x00000012 jmp 00007FF534D06A3Fh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: B46845 second address: B46865 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF534CC3C76h 0x00000007 ja 00007FF534CC3C66h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: B46865 second address: B4686A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: B469D2 second address: B469D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: B469D8 second address: B469DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: B469DE second address: B46A0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF534CC3C6Ah 0x00000009 popad 0x0000000a pushad 0x0000000b jmp 00007FF534CC3C78h 0x00000010 pushad 0x00000011 popad 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: B46B53 second address: B46B57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: B4DA5E second address: B4DA7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jnl 00007FF534CC3C68h 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FF534CC3C6Fh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: B4DA7E second address: B4DA83 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: B4DB65 second address: B4DB6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: B4DB6B second address: B4DB86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FF534D06A3Ah 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jl 00007FF534D06A38h 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: B4DE4B second address: B4DE78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 ja 00007FF534CC3C66h 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e popad 0x0000000f popad 0x00000010 mov eax, dword ptr [eax] 0x00000012 jmp 00007FF534CC3C73h 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b pushad 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 50C07DF second address: 50C07F3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF534D06A3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 50C07F3 second address: 50C081F instructions: 0x00000000 rdtsc 0x00000002 movsx ebx, cx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushfd 0x00000008 jmp 00007FF534CC3C6Ah 0x0000000d sbb ecx, 19F70C88h 0x00000013 jmp 00007FF534CC3C6Bh 0x00000018 popfd 0x00000019 popad 0x0000001a pop ebp 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 50C081F second address: 50C083A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF534D06A47h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 50C083A second address: 50C0840 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 50C0840 second address: 50C0844 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 50C0844 second address: 50C0848 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 50903C9 second address: 50903CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 50903CD second address: 50903D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 50903D3 second address: 509042C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, cx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d mov si, A2E1h 0x00000011 jmp 00007FF534D06A3Eh 0x00000016 popad 0x00000017 push eax 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b pushfd 0x0000001c jmp 00007FF534D06A47h 0x00000021 and ah, 0000003Eh 0x00000024 jmp 00007FF534D06A49h 0x00000029 popfd 0x0000002a rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 509042C second address: 509047A instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FF534CC3C70h 0x00000008 xor ax, 6438h 0x0000000d jmp 00007FF534CC3C6Bh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 pushfd 0x00000018 jmp 00007FF534CC3C76h 0x0000001d or ah, FFFFFF98h 0x00000020 jmp 00007FF534CC3C6Bh 0x00000025 popfd 0x00000026 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 51004EB second address: 510052D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007FF534D06A45h 0x0000000a add ax, 1536h 0x0000000f jmp 00007FF534D06A41h 0x00000014 popfd 0x00000015 popad 0x00000016 xchg eax, ebp 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FF534D06A3Dh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 510052D second address: 510055A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF534CC3C71h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b mov ch, bh 0x0000000d movzx esi, bx 0x00000010 popad 0x00000011 xchg eax, ebp 0x00000012 pushad 0x00000013 mov ecx, edx 0x00000015 mov cx, bx 0x00000018 popad 0x00000019 mov ebp, esp 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 510055A second address: 510055E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 510055E second address: 510056E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF534CC3C6Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 510056E second address: 5100574 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 5090012 second address: 5090051 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF534CC3C71h 0x00000008 call 00007FF534CC3C70h 0x0000000d pop esi 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 jmp 00007FF534CC3C6Eh 0x00000017 mov dword ptr [esp], ebp 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d push esi 0x0000001e pop edi 0x0000001f rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 5090051 second address: 50900EB instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FF534D06A48h 0x00000008 and ax, 60D8h 0x0000000d jmp 00007FF534D06A3Bh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 pushad 0x00000016 pushfd 0x00000017 jmp 00007FF534D06A46h 0x0000001c xor esi, 2E312B38h 0x00000022 jmp 00007FF534D06A3Bh 0x00000027 popfd 0x00000028 mov dx, ax 0x0000002b popad 0x0000002c popad 0x0000002d mov ebp, esp 0x0000002f pushad 0x00000030 pushfd 0x00000031 jmp 00007FF534D06A40h 0x00000036 and ah, FFFFFF98h 0x00000039 jmp 00007FF534D06A3Bh 0x0000003e popfd 0x0000003f call 00007FF534D06A48h 0x00000044 push eax 0x00000045 push edx 0x00000046 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 50900EB second address: 509014A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 push dword ptr [ebp+04h] 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007FF534CC3C78h 0x00000012 and al, 00000058h 0x00000015 jmp 00007FF534CC3C6Bh 0x0000001a popfd 0x0000001b pushfd 0x0000001c jmp 00007FF534CC3C78h 0x00000021 xor ax, 34B8h 0x00000026 jmp 00007FF534CC3C6Bh 0x0000002b popfd 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 5090201 second address: 5090207 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 50D0BC7 second address: 50D0BCB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 50D0BCB second address: 50D0BD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 50D0BD1 second address: 50D0BD7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 50D0BD7 second address: 50D0C0C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF534D06A3Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007FF534D06A3Bh 0x00000011 xchg eax, ebp 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FF534D06A40h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 50D0C0C second address: 50D0C12 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 50D0C12 second address: 50D0C18 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 50D0C18 second address: 50D0C1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 50D0C1C second address: 50D0C2A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 5100B0B second address: 5100B1A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF534CC3C6Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 5100B1A second address: 5100B3F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF534D06A49h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov di, si 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 5100B3F second address: 5100B5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov cl, 58h 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 jmp 00007FF534CC3C6Eh 0x0000000e xchg eax, ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 5100B5D second address: 5100B7A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF534D06A49h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 5100B7A second address: 5100BB2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bl, 82h 0x00000005 mov edx, esi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov ebp, esp 0x0000000c jmp 00007FF534CC3C72h 0x00000011 pop ebp 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FF534CC3C77h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 5090744 second address: 509074A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 509074A second address: 509074E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 509074E second address: 5090787 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esp 0x00000009 jmp 00007FF534D06A44h 0x0000000e mov dword ptr [esp], ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FF534D06A47h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 5090787 second address: 50907BC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, CEEAh 0x00000007 mov edx, 7B0FEFB6h 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov ebp, esp 0x00000011 pushad 0x00000012 mov si, di 0x00000015 mov ah, dl 0x00000017 popad 0x00000018 pop ebp 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FF534CC3C78h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 50907BC second address: 50907C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 50907C0 second address: 50907C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 5100984 second address: 5100993 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF534D06A3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 5100993 second address: 51009DE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF534CC3C79h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FF534CC3C71h 0x0000000f xchg eax, ebp 0x00000010 jmp 00007FF534CC3C6Eh 0x00000015 mov ebp, esp 0x00000017 pushad 0x00000018 mov bx, ax 0x0000001b push eax 0x0000001c push edx 0x0000001d mov esi, 2B35B03Fh 0x00000022 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 5100C0E second address: 5100C3C instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FF534D06A40h 0x00000008 adc si, 7668h 0x0000000d jmp 00007FF534D06A3Bh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 popad 0x00000016 push eax 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 5100C3C second address: 5100C40 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 5100C40 second address: 5100C46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 5110AC8 second address: 5110B20 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF534CC3C6Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ecx 0x0000000a pushad 0x0000000b jmp 00007FF534CC3C6Ch 0x00000010 mov dh, cl 0x00000012 popad 0x00000013 push eax 0x00000014 pushad 0x00000015 movzx ecx, dx 0x00000018 call 00007FF534CC3C6Fh 0x0000001d mov ax, 274Fh 0x00000021 pop eax 0x00000022 popad 0x00000023 xchg eax, ecx 0x00000024 jmp 00007FF534CC3C6Bh 0x00000029 mov eax, dword ptr [775165FCh] 0x0000002e push eax 0x0000002f push edx 0x00000030 pushad 0x00000031 mov edi, 0ABA5B36h 0x00000036 mov eax, edi 0x00000038 popad 0x00000039 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 5110B20 second address: 5110B57 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF534D06A48h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test eax, eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FF534D06A47h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 5110B57 second address: 5110BCF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF534CC3C79h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007FF5A7046A58h 0x0000000f pushad 0x00000010 push eax 0x00000011 pushfd 0x00000012 jmp 00007FF534CC3C73h 0x00000017 sbb esi, 11AA832Eh 0x0000001d jmp 00007FF534CC3C79h 0x00000022 popfd 0x00000023 pop eax 0x00000024 mov ecx, edx 0x00000026 popad 0x00000027 mov ecx, eax 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007FF534CC3C75h 0x00000032 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 5110BCF second address: 5110BE4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF534D06A41h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 5110BE4 second address: 5110BF4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF534CC3C6Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 5110BF4 second address: 5110BF8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 5100E89 second address: 5100F0E instructions: 0x00000000 rdtsc 0x00000002 mov cx, 6949h 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushfd 0x00000009 jmp 00007FF534CC3C76h 0x0000000e add eax, 718B6F98h 0x00000014 jmp 00007FF534CC3C6Bh 0x00000019 popfd 0x0000001a popad 0x0000001b mov eax, dword ptr [ebp+08h] 0x0000001e jmp 00007FF534CC3C76h 0x00000023 and dword ptr [eax], 00000000h 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 pushad 0x0000002a popad 0x0000002b pushfd 0x0000002c jmp 00007FF534CC3C73h 0x00000031 xor ah, FFFFFFBEh 0x00000034 jmp 00007FF534CC3C79h 0x00000039 popfd 0x0000003a popad 0x0000003b rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 50D001B second address: 50D005A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FF534D06A3Bh 0x00000009 sub al, FFFFFFCEh 0x0000000c jmp 00007FF534D06A49h 0x00000011 popfd 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 xchg eax, ebp 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FF534D06A3Dh 0x0000001d rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 50D005A second address: 50D00E0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, bx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007FF534CC3C76h 0x00000011 xchg eax, ebp 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007FF534CC3C6Dh 0x00000019 adc si, 0016h 0x0000001e jmp 00007FF534CC3C71h 0x00000023 popfd 0x00000024 popad 0x00000025 mov ebp, esp 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a pushfd 0x0000002b jmp 00007FF534CC3C73h 0x00000030 or ax, 094Eh 0x00000035 jmp 00007FF534CC3C79h 0x0000003a popfd 0x0000003b movzx ecx, di 0x0000003e popad 0x0000003f rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 50D00E0 second address: 50D013B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF534D06A3Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and esp, FFFFFFF8h 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007FF534D06A3Dh 0x00000015 xor eax, 4C395436h 0x0000001b jmp 00007FF534D06A41h 0x00000020 popfd 0x00000021 pushfd 0x00000022 jmp 00007FF534D06A40h 0x00000027 add al, 00000058h 0x0000002a jmp 00007FF534D06A3Bh 0x0000002f popfd 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 50D013B second address: 50D0153 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF534CC3C74h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 50D0153 second address: 50D01A3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 pushad 0x0000000a movzx ecx, dx 0x0000000d mov si, di 0x00000010 popad 0x00000011 mov dword ptr [esp], ecx 0x00000014 jmp 00007FF534D06A41h 0x00000019 xchg eax, ebx 0x0000001a pushad 0x0000001b mov bx, ax 0x0000001e call 00007FF534D06A48h 0x00000023 mov ecx, 49EDFD51h 0x00000028 pop eax 0x00000029 popad 0x0000002a push eax 0x0000002b pushad 0x0000002c push eax 0x0000002d push edx 0x0000002e mov dx, ax 0x00000031 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 50D01A3 second address: 50D01A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 50D01A7 second address: 50D01BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FF534D06A40h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 50D01BF second address: 50D021C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF534CC3C72h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a xchg eax, ebx 0x0000000b jmp 00007FF534CC3C70h 0x00000010 mov ebx, dword ptr [ebp+10h] 0x00000013 jmp 00007FF534CC3C70h 0x00000018 xchg eax, esi 0x00000019 jmp 00007FF534CC3C70h 0x0000001e push eax 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007FF534CC3C6Eh 0x00000026 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 50D021C second address: 50D02E3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FF534D06A41h 0x00000009 add esi, 1ADD1F36h 0x0000000f jmp 00007FF534D06A41h 0x00000014 popfd 0x00000015 jmp 00007FF534D06A40h 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d xchg eax, esi 0x0000001e pushad 0x0000001f push esi 0x00000020 push edx 0x00000021 pop esi 0x00000022 pop edi 0x00000023 mov ecx, 252569A5h 0x00000028 popad 0x00000029 mov esi, dword ptr [ebp+08h] 0x0000002c jmp 00007FF534D06A40h 0x00000031 xchg eax, edi 0x00000032 jmp 00007FF534D06A40h 0x00000037 push eax 0x00000038 pushad 0x00000039 pushfd 0x0000003a jmp 00007FF534D06A41h 0x0000003f adc al, 00000056h 0x00000042 jmp 00007FF534D06A41h 0x00000047 popfd 0x00000048 pushad 0x00000049 jmp 00007FF534D06A3Eh 0x0000004e mov edi, esi 0x00000050 popad 0x00000051 popad 0x00000052 xchg eax, edi 0x00000053 push eax 0x00000054 push edx 0x00000055 push eax 0x00000056 push edx 0x00000057 jmp 00007FF534D06A46h 0x0000005c rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 50D02E3 second address: 50D02F2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF534CC3C6Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 50D02F2 second address: 50D032B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF534D06A49h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test esi, esi 0x0000000b jmp 00007FF534D06A3Eh 0x00000010 je 00007FF5A70C4D2Ch 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 50D032B second address: 50D032F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 50D032F second address: 50D034C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF534D06A49h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 50D034C second address: 50D0377 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF534CC3C71h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 cmp dword ptr [esi+08h], DDEEDDEEh 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FF534CC3C6Dh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 50D0377 second address: 50D03B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FF534D06A47h 0x00000009 sub ecx, 1CE8A76Eh 0x0000000f jmp 00007FF534D06A49h 0x00000014 popfd 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 50D03B4 second address: 50D03F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 je 00007FF5A7081ED6h 0x0000000d jmp 00007FF534CC3C6Ch 0x00000012 mov edx, dword ptr [esi+44h] 0x00000015 jmp 00007FF534CC3C70h 0x0000001a or edx, dword ptr [ebp+0Ch] 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007FF534CC3C6Ah 0x00000026 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 50D03F1 second address: 50D03F7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 50D03F7 second address: 50D03FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 50D03FD second address: 50D0401 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 50D0401 second address: 50D0463 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF534CC3C78h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test edx, 61000000h 0x00000011 jmp 00007FF534CC3C70h 0x00000016 jne 00007FF5A7081EB9h 0x0000001c pushad 0x0000001d mov si, 746Dh 0x00000021 mov esi, 3CABEA69h 0x00000026 popad 0x00000027 test byte ptr [esi+48h], 00000001h 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e call 00007FF534CC3C71h 0x00000033 pop ecx 0x00000034 movsx edi, cx 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 50D0463 second address: 50D04B2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF534D06A43h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007FF5A70C4C5Dh 0x0000000f jmp 00007FF534D06A46h 0x00000014 test bl, 00000007h 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FF534D06A47h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 50E005C second address: 50E0062 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 50E0062 second address: 50E0066 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 50E0066 second address: 50E00B5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF534CC3C73h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d jmp 00007FF534CC3C74h 0x00000012 call 00007FF534CC3C72h 0x00000017 mov dh, al 0x00000019 pop edx 0x0000001a popad 0x0000001b mov ebp, esp 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 mov esi, edi 0x00000022 pushad 0x00000023 popad 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 50E00B5 second address: 50E00BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 50E00BB second address: 50E00BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 50E00BF second address: 50E014F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 and esp, FFFFFFF8h 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007FF534D06A42h 0x00000012 jmp 00007FF534D06A45h 0x00000017 popfd 0x00000018 mov dx, ax 0x0000001b popad 0x0000001c xchg eax, ebx 0x0000001d pushad 0x0000001e push esi 0x0000001f mov bl, 49h 0x00000021 pop eax 0x00000022 mov di, 8D44h 0x00000026 popad 0x00000027 push eax 0x00000028 jmp 00007FF534D06A3Ah 0x0000002d xchg eax, ebx 0x0000002e pushad 0x0000002f call 00007FF534D06A3Eh 0x00000034 pushfd 0x00000035 jmp 00007FF534D06A42h 0x0000003a sub cx, 1128h 0x0000003f jmp 00007FF534D06A3Bh 0x00000044 popfd 0x00000045 pop ecx 0x00000046 mov esi, edi 0x00000048 popad 0x00000049 push ecx 0x0000004a push eax 0x0000004b push edx 0x0000004c pushad 0x0000004d mov cl, dh 0x0000004f pushad 0x00000050 popad 0x00000051 popad 0x00000052 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 50E014F second address: 50E0184 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF534CC3C75h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], esi 0x0000000c jmp 00007FF534CC3C6Eh 0x00000011 mov esi, dword ptr [ebp+08h] 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 mov si, dx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 50E0184 second address: 50E0189 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 50E0189 second address: 50E01E5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FF534CC3C72h 0x00000009 xor cl, 00000048h 0x0000000c jmp 00007FF534CC3C6Bh 0x00000011 popfd 0x00000012 call 00007FF534CC3C78h 0x00000017 pop esi 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b mov ebx, 00000000h 0x00000020 jmp 00007FF534CC3C6Eh 0x00000025 test esi, esi 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a mov ebx, ecx 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 50E01E5 second address: 50E01EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 50E01EB second address: 50E0222 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF534CC3C77h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b je 00007FF5A7069DECh 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FF534CC3C70h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 50E0222 second address: 50E0231 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF534D06A3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 50E0231 second address: 50E0237 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 50E0237 second address: 50E0304 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF534D06A3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b cmp dword ptr [esi+08h], DDEEDDEEh 0x00000012 jmp 00007FF534D06A46h 0x00000017 mov ecx, esi 0x00000019 jmp 00007FF534D06A40h 0x0000001e je 00007FF5A70ACB62h 0x00000024 jmp 00007FF534D06A40h 0x00000029 test byte ptr [77516968h], 00000002h 0x00000030 pushad 0x00000031 pushfd 0x00000032 jmp 00007FF534D06A3Eh 0x00000037 sbb si, B1B8h 0x0000003c jmp 00007FF534D06A3Bh 0x00000041 popfd 0x00000042 push esi 0x00000043 push edi 0x00000044 pop esi 0x00000045 pop edi 0x00000046 popad 0x00000047 jne 00007FF5A70ACB32h 0x0000004d jmp 00007FF534D06A3Eh 0x00000052 mov edx, dword ptr [ebp+0Ch] 0x00000055 pushad 0x00000056 pushfd 0x00000057 jmp 00007FF534D06A3Eh 0x0000005c add cl, 00000048h 0x0000005f jmp 00007FF534D06A3Bh 0x00000064 popfd 0x00000065 mov edx, eax 0x00000067 popad 0x00000068 xchg eax, ebx 0x00000069 push eax 0x0000006a push edx 0x0000006b push eax 0x0000006c push edx 0x0000006d jmp 00007FF534D06A3Ch 0x00000072 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 50E0304 second address: 50E030A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 50E030A second address: 50E033B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF534D06A3Ch 0x00000008 mov di, cx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 mov ebx, esi 0x00000014 call 00007FF534D06A44h 0x00000019 pop esi 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 50E033B second address: 50E0356 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF534CC3C77h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 50E0356 second address: 50E03F1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF534D06A49h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FF534D06A3Ch 0x00000013 adc ch, FFFFFFF8h 0x00000016 jmp 00007FF534D06A3Bh 0x0000001b popfd 0x0000001c mov ah, 21h 0x0000001e popad 0x0000001f push edx 0x00000020 jmp 00007FF534D06A40h 0x00000025 mov dword ptr [esp], ebx 0x00000028 pushad 0x00000029 pushfd 0x0000002a jmp 00007FF534D06A3Eh 0x0000002f add cx, E988h 0x00000034 jmp 00007FF534D06A3Bh 0x00000039 popfd 0x0000003a call 00007FF534D06A48h 0x0000003f movzx ecx, dx 0x00000042 pop edx 0x00000043 popad 0x00000044 push dword ptr [ebp+14h] 0x00000047 push eax 0x00000048 push edx 0x00000049 push eax 0x0000004a push edx 0x0000004b push eax 0x0000004c push edx 0x0000004d rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 50E03F1 second address: 50E03F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 50E03F5 second address: 50E03F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 50E03F9 second address: 50E03FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 50E03FF second address: 50E0405 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 50E0405 second address: 50E0446 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF534CC3C78h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push dword ptr [ebp+10h] 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007FF534CC3C6Dh 0x00000017 jmp 00007FF534CC3C6Bh 0x0000001c popfd 0x0000001d mov ch, 3Bh 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 50E045C second address: 50E0460 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 50E0460 second address: 50E0466 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 50E0466 second address: 50E0484 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 call 00007FF534D06A3Fh 0x0000000a pop esi 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop esi 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 50E0484 second address: 50E0488 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 50E0488 second address: 50E0491 instructions: 0x00000000 rdtsc 0x00000002 mov esi, ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 50E0491 second address: 50E04AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 pop ebx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a call 00007FF534CC3C71h 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 50E04AD second address: 50E04F4 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FF534D06A41h 0x00000008 jmp 00007FF534D06A3Bh 0x0000000d popfd 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov ch, 70h 0x00000012 popad 0x00000013 mov esp, ebp 0x00000015 jmp 00007FF534D06A3Bh 0x0000001a pop ebp 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007FF534D06A40h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 50E04F4 second address: 50E04F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 50E04F8 second address: 50E04FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 50E04FE second address: 50E0507 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, A9A3h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 513185F second address: 5131863 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 5131863 second address: 5131869 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 5131869 second address: 513191C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF534D06A3Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FF534D06A46h 0x0000000f mov ebp, esp 0x00000011 pushad 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007FF534D06A43h 0x00000019 sub ch, 0000004Eh 0x0000001c jmp 00007FF534D06A49h 0x00000021 popfd 0x00000022 mov si, 8F57h 0x00000026 popad 0x00000027 popad 0x00000028 push 0000007Fh 0x0000002a jmp 00007FF534D06A3Ah 0x0000002f push 00000001h 0x00000031 jmp 00007FF534D06A40h 0x00000036 push dword ptr [ebp+08h] 0x00000039 push eax 0x0000003a push edx 0x0000003b pushad 0x0000003c movsx edi, cx 0x0000003f pushfd 0x00000040 jmp 00007FF534D06A46h 0x00000045 sbb cl, 00000058h 0x00000048 jmp 00007FF534D06A3Bh 0x0000004d popfd 0x0000004e popad 0x0000004f rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 5131946 second address: 513194C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 513194C second address: 5131950 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 5131950 second address: 5131954 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 5131954 second address: 513185F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 jmp 00007FF534D06A3Fh 0x0000000e retn 0004h 0x00000011 lea eax, dword ptr [ebp-10h] 0x00000014 push eax 0x00000015 call ebx 0x00000017 mov edi, edi 0x00000019 jmp 00007FF534D06A40h 0x0000001e xchg eax, ebp 0x0000001f jmp 00007FF534D06A40h 0x00000024 push eax 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: A59C89 second address: A59C8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 5100708 second address: 510070C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 510070C second address: 5100712 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 5100712 second address: 51007C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FF534D06A3Ah 0x00000009 add ax, 0808h 0x0000000e jmp 00007FF534D06A3Bh 0x00000013 popfd 0x00000014 jmp 00007FF534D06A48h 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c xchg eax, ebp 0x0000001d jmp 00007FF534D06A40h 0x00000022 push eax 0x00000023 pushad 0x00000024 pushfd 0x00000025 jmp 00007FF534D06A41h 0x0000002a or esi, 06A11486h 0x00000030 jmp 00007FF534D06A41h 0x00000035 popfd 0x00000036 pushfd 0x00000037 jmp 00007FF534D06A40h 0x0000003c sub eax, 770F7F28h 0x00000042 jmp 00007FF534D06A3Bh 0x00000047 popfd 0x00000048 popad 0x00000049 xchg eax, ebp 0x0000004a push eax 0x0000004b push edx 0x0000004c jmp 00007FF534D06A45h 0x00000051 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 51007C5 second address: 51007EB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF534CC3C71h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FF534CC3C6Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 51007EB second address: 51007FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF534D06A3Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 50E067F second address: 50E0683 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 50E0683 second address: 50E0689 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 50E0689 second address: 50E069D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, 45C61D19h 0x00000008 mov bx, ax 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 50E069D second address: 50E06CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007FF534D06A43h 0x0000000a jmp 00007FF534D06A43h 0x0000000f popfd 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 50E06CA second address: 50E06F8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF534CC3C79h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FF534CC3C6Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 50E06F8 second address: 50E071D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF534D06A41h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FF534D06A3Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 50E071D second address: 50E072D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF534CC3C6Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 5140CC8 second address: 5140CCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 5140CCD second address: 5140CF8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF534CC3C6Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FF534CC3C75h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 5140CF8 second address: 5140CFE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 5140CFE second address: 5140D35 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF534CC3C73h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d mov ebx, 27FC07DAh 0x00000012 call 00007FF534CC3C6Bh 0x00000017 movzx ecx, dx 0x0000001a pop ebx 0x0000001b popad 0x0000001c xchg eax, ebp 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 5140D35 second address: 5140D39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 5140D39 second address: 5140D56 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF534CC3C79h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 5140D56 second address: 5140D8C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF534D06A41h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007FF534D06A3Eh 0x00000010 push dword ptr [ebp+0Ch] 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007FF534D06A3Ah 0x0000001c rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 5140D8C second address: 5140D90 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 5140D90 second address: 5140D96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 5140D96 second address: 5140DA7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF534CC3C6Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 5140DA7 second address: 5140DD0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF534D06A41h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push dword ptr [ebp+08h] 0x0000000e pushad 0x0000000f call 00007FF534D06A3Ch 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 5140DD0 second address: 5140E2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushfd 0x00000006 jmp 00007FF534CC3C71h 0x0000000b sbb si, 1686h 0x00000010 jmp 00007FF534CC3C71h 0x00000015 popfd 0x00000016 popad 0x00000017 call 00007FF534CC3C69h 0x0000001c jmp 00007FF534CC3C6Eh 0x00000021 push eax 0x00000022 pushad 0x00000023 mov edi, 748037D4h 0x00000028 mov si, dx 0x0000002b popad 0x0000002c mov eax, dword ptr [esp+04h] 0x00000030 push eax 0x00000031 push edx 0x00000032 pushad 0x00000033 mov ax, di 0x00000036 pushad 0x00000037 popad 0x00000038 popad 0x00000039 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 5140E2E second address: 5140E34 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 5140E34 second address: 5140E38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 5140E38 second address: 5140E52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FF534D06A3Eh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 5140E94 second address: 5140E99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 5140E99 second address: 5140E9F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 5140E9F second address: 5140EA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 5140EA3 second address: 5140EA7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 511048B second address: 51104E7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF534CC3C6Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FF534CC3C71h 0x0000000f xchg eax, ebp 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007FF534CC3C6Ch 0x00000017 adc eax, 241309D8h 0x0000001d jmp 00007FF534CC3C6Bh 0x00000022 popfd 0x00000023 mov esi, 4263C88Fh 0x00000028 popad 0x00000029 mov ebp, esp 0x0000002b push eax 0x0000002c push edx 0x0000002d push eax 0x0000002e push edx 0x0000002f jmp 00007FF534CC3C6Ch 0x00000034 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 51104E7 second address: 51104F6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF534D06A3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 51104F6 second address: 5110553 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF534CC3C79h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and esp, FFFFFFF0h 0x0000000c pushad 0x0000000d movzx eax, bx 0x00000010 jmp 00007FF534CC3C79h 0x00000015 popad 0x00000016 sub esp, 44h 0x00000019 pushad 0x0000001a mov edi, eax 0x0000001c push eax 0x0000001d push edx 0x0000001e call 00007FF534CC3C76h 0x00000023 pop eax 0x00000024 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 5110553 second address: 51105B5 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FF534D06A3Bh 0x00000008 adc cl, 0000006Eh 0x0000000b jmp 00007FF534D06A49h 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 popad 0x00000014 xchg eax, ebx 0x00000015 jmp 00007FF534D06A3Eh 0x0000001a push eax 0x0000001b pushad 0x0000001c movsx ebx, si 0x0000001f mov di, si 0x00000022 popad 0x00000023 xchg eax, ebx 0x00000024 jmp 00007FF534D06A44h 0x00000029 xchg eax, esi 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 51105B5 second address: 51105B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 51105B9 second address: 51105BF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 51105BF second address: 51105F8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF534CC3C74h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b mov di, 8854h 0x0000000f push edx 0x00000010 mov bx, ax 0x00000013 pop esi 0x00000014 popad 0x00000015 xchg eax, esi 0x00000016 jmp 00007FF534CC3C6Bh 0x0000001b xchg eax, edi 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f mov esi, edx 0x00000021 mov cl, bh 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 51105F8 second address: 51105FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 51105FE second address: 5110602 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 5110602 second address: 5110606 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 5110606 second address: 5110647 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a jmp 00007FF534CC3C6Ch 0x0000000f movzx ecx, di 0x00000012 popad 0x00000013 xchg eax, edi 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 call 00007FF534CC3C76h 0x0000001c pop eax 0x0000001d jmp 00007FF534CC3C6Bh 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 5110647 second address: 51106F0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edi, si 0x00000006 pushfd 0x00000007 jmp 00007FF534D06A40h 0x0000000c or esi, 7CA16328h 0x00000012 jmp 00007FF534D06A3Bh 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b mov edi, dword ptr [ebp+08h] 0x0000001e jmp 00007FF534D06A46h 0x00000023 mov dword ptr [esp+24h], 00000000h 0x0000002b pushad 0x0000002c call 00007FF534D06A3Eh 0x00000031 mov di, cx 0x00000034 pop esi 0x00000035 pushfd 0x00000036 jmp 00007FF534D06A47h 0x0000003b jmp 00007FF534D06A43h 0x00000040 popfd 0x00000041 popad 0x00000042 lock bts dword ptr [edi], 00000000h 0x00000047 push eax 0x00000048 push edx 0x00000049 jmp 00007FF534D06A45h 0x0000004e rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 51106F0 second address: 511072E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF534CC3C77h 0x00000008 mov bx, si 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jc 00007FF5A6FE5989h 0x00000014 jmp 00007FF534CC3C72h 0x00000019 pop edi 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 511072E second address: 5110732 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 5110019 second address: 511006F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF534CC3C71h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FF534CC3C6Eh 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 mov dx, ax 0x00000016 pushfd 0x00000017 jmp 00007FF534CC3C78h 0x0000001c or cx, EF68h 0x00000021 jmp 00007FF534CC3C6Bh 0x00000026 popfd 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 511006F second address: 51100AC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF534D06A49h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007FF534D06A49h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 51100AC second address: 51100D2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF534CC3C71h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FF534CC3C6Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 51100D2 second address: 5110121 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF534D06A41h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FF534D06A43h 0x00000013 or si, 3B7Eh 0x00000018 jmp 00007FF534D06A49h 0x0000001d popfd 0x0000001e pushad 0x0000001f popad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 5110121 second address: 5110127 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 5110127 second address: 51101A1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF534D06A49h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d mov ax, dx 0x00000010 popad 0x00000011 xchg eax, ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 pushfd 0x00000016 jmp 00007FF534D06A41h 0x0000001b sbb si, 89C6h 0x00000020 jmp 00007FF534D06A41h 0x00000025 popfd 0x00000026 pushfd 0x00000027 jmp 00007FF534D06A40h 0x0000002c jmp 00007FF534D06A45h 0x00000031 popfd 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 51101A1 second address: 51101BB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, 52974562h 0x00000008 movsx ebx, si 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, esi 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 mov ecx, ebx 0x00000014 mov ebx, 69AB865Eh 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 51101BB second address: 51101DA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF534D06A44h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov dh, al 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 51101DA second address: 51101DF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 51101DF second address: 511021C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007FF534D06A3Eh 0x0000000a sbb al, FFFFFF88h 0x0000000d jmp 00007FF534D06A3Bh 0x00000012 popfd 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 xchg eax, esi 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FF534D06A45h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\MSBuild.exe	RDTSC instruction interceptor: First address: 511021C second address: 5110222 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\MSBuild.exe	Special instruction interceptor: First address: 8AFA36 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\MSBuild.exe	Special instruction interceptor: First address: A4CB7F instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\MSBuild.exe	Special instruction interceptor: First address: A7255E instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\MSBuild.exe	Special instruction interceptor: First address: A55869 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\MSBuild.exe	Special instruction interceptor: First address: ACF72D instructions caused by: Self-modifying code
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Special instruction interceptor: First address: 4BFA36 instructions caused by: Self-modifying code
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Special instruction interceptor: First address: 65CB7F instructions caused by: Self-modifying code
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Special instruction interceptor: First address: 68255E instructions caused by: Self-modifying code
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Special instruction interceptor: First address: 665869 instructions caused by: Self-modifying code
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Special instruction interceptor: First address: 6DF72D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Special instruction interceptor: First address: F5FA36 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Special instruction interceptor: First address: 10FCB7F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Special instruction interceptor: First address: 112255E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Special instruction interceptor: First address: 1105869 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Special instruction interceptor: First address: 117F72D instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\MSBuild.exe

Code function: 0_2_05140473 rdtsc

0_2_05140473

Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window / User API: threadDelayed 543	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window / User API: threadDelayed 378	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window / User API: threadDelayed 564	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window / User API: threadDelayed 388	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window / User API: threadDelayed 1140	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window / User API: threadDelayed 1119	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window / User API: threadDelayed 1135	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window / User API: threadDelayed 1164	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window / User API: threadDelayed 1177	Jump to behavior

Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_8-23211

Source: C:\Users\user\Desktop\MSBuild.exe TID: 7456	Thread sleep count: 54 > 30	Jump to behavior
Source: C:\Users\user\Desktop\MSBuild.exe TID: 7456	Thread sleep time: -108054s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MSBuild.exe TID: 7464	Thread sleep count: 47 > 30	Jump to behavior
Source: C:\Users\user\Desktop\MSBuild.exe TID: 7464	Thread sleep time: -94047s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MSBuild.exe TID: 7388	Thread sleep count: 91 > 30	Jump to behavior
Source: C:\Users\user\Desktop\MSBuild.exe TID: 7388	Thread sleep count: 240 > 30	Jump to behavior
Source: C:\Users\user\Desktop\MSBuild.exe TID: 7672	Thread sleep count: 237 > 30	Jump to behavior
Source: C:\Users\user\Desktop\MSBuild.exe TID: 7440	Thread sleep count: 74 > 30	Jump to behavior
Source: C:\Users\user\Desktop\MSBuild.exe TID: 7440	Thread sleep time: -148074s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MSBuild.exe TID: 7448	Thread sleep count: 133 > 30	Jump to behavior
Source: C:\Users\user\Desktop\MSBuild.exe TID: 7448	Thread sleep time: -266133s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7760	Thread sleep count: 55 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7760	Thread sleep time: -110055s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7736	Thread sleep count: 107 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7736	Thread sleep time: -214107s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7684	Thread sleep count: 543 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7684	Thread sleep time: -54843s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7984	Thread sleep count: 378 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7984	Thread sleep count: 88 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7740	Thread sleep count: 130 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7740	Thread sleep time: -260130s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7756	Thread sleep count: 65 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7756	Thread sleep time: -130065s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7744	Thread sleep count: 66 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7744	Thread sleep time: -132066s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7856	Thread sleep count: 55 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7856	Thread sleep time: -110055s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7832	Thread sleep count: 78 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7832	Thread sleep time: -156078s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7704	Thread sleep count: 564 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7704	Thread sleep time: -56964s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7988	Thread sleep count: 388 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7988	Thread sleep count: 92 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7836	Thread sleep count: 131 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7836	Thread sleep time: -262131s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7848	Thread sleep count: 70 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7848	Thread sleep time: -140070s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 8052	Thread sleep time: -36018s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 8048	Thread sleep count: 1140 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 8048	Thread sleep time: -2281140s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 8008	Thread sleep count: 52 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 8008	Thread sleep count: 248 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7184	Thread sleep count: 251 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 8028	Thread sleep count: 1119 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 8028	Thread sleep time: -2239119s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7236	Thread sleep time: -38019s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7232	Thread sleep count: 1135 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7232	Thread sleep time: -2271135s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 2844	Thread sleep count: 264 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 752	Thread sleep count: 252 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 6388	Thread sleep count: 1164 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 6388	Thread sleep time: -2329164s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 6988	Thread sleep count: 1177 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 6988	Thread sleep time: -2355177s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Last function: Thread delayed
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Last function: Thread delayed
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Last function: Thread delayed
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Last function: Thread delayed

Source: RageMP131.exe, RageMP131.exe, 0000000B.00000002.2600320247.00000000010DE000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: RageMP131.exe, 00000008.00000002.2599925937.0000000000D54000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9e146be9-c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_AD61C140
Source: MSBuild.exe, 00000000.00000002.2602987575.000000000129E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}H
Source: RageMP131.exe, 00000008.00000002.2599925937.0000000000D54000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9e146be9-c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_AD61C140G
Source: MPGPH131.exe, 00000006.00000002.2601680202.0000000000F20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&E5
Source: MPGPH131.exe, 00000006.00000002.2601680202.0000000000F32000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}g4
Source: MSBuild.exe, 00000000.00000002.2602987575.00000000012D2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000s\user\AppData\Local\Temp\hO#P
Source: RageMP131.exe, 0000000B.00000002.2599762375.0000000000CFD000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: MPGPH131.exe, 00000007.00000003.1461754743.0000000000F5E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0
Source: RageMP131.exe, 00000008.00000002.2599665716.0000000000B6D000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}<
Source: RageMP131.exe, 00000008.00000002.2599925937.0000000000D41000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}!
Source: MPGPH131.exe, 00000006.00000002.2601680202.0000000000F32000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: -c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_AD61C140(
Source: MSBuild.exe, 00000000.00000002.2602987575.0000000001290000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000ro#Q
Source: RageMP131.exe, 0000000B.00000002.2601566173.0000000001518000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: MSBuild.exe, 00000000.00000002.2601399812.0000000000DFC000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}t
Source: MPGPH131.exe, 00000006.00000002.2601680202.0000000000F20000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2601794950.0000000000F2A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2599925937.0000000000D41000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.2601566173.0000000001505000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: RageMP131.exe, 0000000B.00000002.2601566173.000000000151A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: -c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_AD61C140
Source: RageMP131.exe, 0000000B.00000002.2601566173.0000000001505000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&
Source: MPGPH131.exe, 00000006.00000002.2601680202.0000000000F32000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}&'
Source: RageMP131.exe, 00000008.00000002.2599925937.0000000000D41000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: MSBuild.exe, 00000000.00000002.2602987575.00000000012D9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: #disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: MPGPH131.exe, 00000007.00000002.2601794950.0000000000F2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}.]t
Source: RageMP131.exe, 00000008.00000002.2599925937.0000000000D0E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}"
Source: MPGPH131.exe, 00000006.00000002.2601680202.0000000000F03000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}\i
Source: MSBuild.exe, 00000000.00000002.2600112260.0000000000A2E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000006.00000002.2600102985.000000000063E000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000007.00000002.2600122789.000000000063E000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2600656810.00000000010DE000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 0000000B.00000002.2600320247.00000000010DE000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: RageMP131.exe, 00000008.00000002.2599925937.0000000000D00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: MPGPH131.exe, 00000006.00000002.2601459310.0000000000CFD000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}L
Source: MSBuild.exe, 00000000.00000002.2602987575.00000000012D2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllzz

Source: C:\Users\user\Desktop\MSBuild.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\MSBuild.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\MSBuild.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Thread information set: HideFromDebugger	Jump to behavior

Potentially malicious time measurement code found

Source: C:\Users\user\Desktop\MSBuild.exe	Code function: 0_2_0514073C Start: 0514085B End: 051407D7	0_2_0514073C
Source: C:\Users\user\Desktop\MSBuild.exe	Code function: 0_2_0514072A Start: 0514085B End: 051407D7	0_2_0514072A
Source: C:\Users\user\Desktop\MSBuild.exe	Code function: 0_2_0514075E Start: 0514085B End: 051407D7	0_2_0514075E
Source: C:\Users\user\Desktop\MSBuild.exe	Code function: 0_2_0514079D Start: 0514085B End: 051407D7	0_2_0514079D
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_04EE08ED Start: 04EE0AD9 End: 04EE08BC	6_2_04EE08ED

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\MSBuild.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\MSBuild.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\MSBuild.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\MSBuild.exe

Code function: 0_2_05140473 rdtsc

0_2_05140473

Source: C:\Users\user\Desktop\MSBuild.exe	Code function: 0_2_00784B40 mov eax, dword ptr fs:[00000030h]	0_2_00784B40
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00394B40 mov eax, dword ptr fs:[00000030h]	6_2_00394B40
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00394B40 mov eax, dword ptr fs:[00000030h]	7_2_00394B40
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_00E34B40 mov eax, dword ptr fs:[00000030h]	8_2_00E34B40
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 11_2_00E34B40 mov eax, dword ptr fs:[00000030h]	11_2_00E34B40

Source: MPGPH131.exe, MPGPH131.exe, 00000007.00000002.2600122789.000000000063E000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, RageMP131.exe, 0000000B.00000002.2600320247.00000000010DE000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: C FGProgram Manager
Source: MSBuild.exe, 00000000.00000002.2600112260.0000000000A2E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000006.00000002.2600102985.000000000063E000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000007.00000002.2600122789.000000000063E000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: oC FGProgram Manager

Source: C:\Users\user\Desktop\MSBuild.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\MSBuild.exe

Code function: 0_2_0084D58A GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

0_2_0084D58A

Source: C:\Users\user\Desktop\MSBuild.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected RisePro Stealer

Source: Yara match	File source: 00000008.00000003.1524499032.00000000050B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.1603725215.0000000005180000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.1445320950.0000000004C30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1378720423.0000000004EF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2599961844.0000000000E21000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2599669602.0000000000381000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2600321345.0000000000E21000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2599804514.0000000000771000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2599663751.0000000000381000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.1444596124.0000000004C50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 7384, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 7680, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 7700, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 8004, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 5700, type: MEMORYSTR

Remote Access Functionality

Yara detected RisePro Stealer

Source: Yara match	File source: 00000008.00000003.1524499032.00000000050B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.1603725215.0000000005180000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.1445320950.0000000004C30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1378720423.0000000004EF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2599961844.0000000000E21000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2599669602.0000000000381000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2600321345.0000000000E21000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2599804514.0000000000771000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2599663751.0000000000381000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.1444596124.0000000004C50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 7384, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 7680, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 7700, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 8004, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 5700, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	2 Process Injection	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	24 Virtualization/Sandbox Evasion	LSASS Memory	741 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	2 Process Injection	Security Account Manager	24 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	3 Obfuscated Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	12 Software Packing	Cached Domain Credentials	214 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report
MSBuild.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report MSBuild.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
MSBuild.exe