Analysis Report fnp_my.dll

Overview

General Information

Sample Name: fnp_my.dll
Analysis ID: 345244
MD5: 9e7f0e102da06fea22b2f42c7023f4d0
SHA1: 18bf04d09683aa5c664e0ccf52ac205a974ed9cd
SHA256: 8126a938b442f7fb4d8a405efb6db33890c1b34f8a886bbf764bb618eafe392d

Most interesting Screenshot:

Detection

Score: 80
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Hides threads from debuggers
Machine Learning detection for sample
PE file contains section with special chars
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Abnormal high CPU Usage
Antivirus or Machine Learning detection for unpacked file
Checks for debuggers (devices)
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Entry point lies outside standard sections
PE file contains sections with non-standard names
Queries disk information (often used to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Uses 32bit PE files

Classification

AV Detection:

barindex
Antivirus / Scanner detection for submitted sample
Source: fnp_my.dll Avira: detected
Multi AV Scanner detection for submitted file
Source: fnp_my.dll Virustotal: Detection: 34% Perma Link
Source: fnp_my.dll ReversingLabs: Detection: 45%
Machine Learning detection for sample
Source: fnp_my.dll Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 0.1.loaddll32.exe.ea0000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen2
Source: 3.2.rundll32.exe.4a10000.1.unpack Avira: Label: TR/Crypt.TPM.Gen
Source: 0.1.loaddll32.exe.ea0000.2.unpack Avira: Label: TR/Crypt.ZPACK.Gen2
Source: 3.1.rundll32.exe.4a10000.1.unpack Avira: Label: TR/Crypt.ZPACK.Gen2
Source: 0.1.loaddll32.exe.ea0000.3.unpack Avira: Label: TR/Crypt.ZPACK.Gen2
Source: 2.1.rundll32.exe.4c90000.1.unpack Avira: Label: TR/Crypt.ZPACK.Gen2
Source: 4.1.rundll32.exe.4dd0000.1.unpack Avira: Label: TR/Crypt.ZPACK.Gen2
Source: 4.1.rundll32.exe.4dd0000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen2
Source: 0.1.loaddll32.exe.ea0000.1.unpack Avira: Label: TR/Crypt.ZPACK.Gen2
Source: 2.1.rundll32.exe.4c90000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen2
Source: 3.1.rundll32.exe.4a10000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen2

Compliance:

barindex
Uses 32bit PE files
Source: fnp_my.dll Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, BYTES_REVERSED_LO, EXECUTABLE_IMAGE, DLL, LINE_NUMS_STRIPPED, BYTES_REVERSED_HI

System Summary:

barindex
PE file contains section with special chars
Source: fnp_my.dll Static PE information: section name:
Source: fnp_my.dll Static PE information: section name: .idata
Source: fnp_my.dll Static PE information: section name:
Abnormal high CPU Usage
Source: C:\Windows\SysWOW64\rundll32.exe Process Stats: CPU usage > 98%
Uses 32bit PE files
Source: fnp_my.dll Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, BYTES_REVERSED_LO, EXECUTABLE_IMAGE, DLL, LINE_NUMS_STRIPPED, BYTES_REVERSED_HI
Source: fnp_my.dll Static PE information: Section: ZLIB complexity 0.998778400398
Source: fnp_my.dll Static PE information: Section: pdnzzolr ZLIB complexity 1.021484375
Source: classification engine Classification label: mal80.evad.winDLL@7/2@0/0
Source: C:\Windows\System32\loaddll32.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\fnp_my.dll,TMethodImplementationIntercept
Source: fnp_my.dll Virustotal: Detection: 34%
Source: fnp_my.dll ReversingLabs: Detection: 45%
Source: unknown Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe 'C:\Users\user\Desktop\fnp_my.dll'
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\fnp_my.dll,TMethodImplementationIntercept
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\fnp_my.dll,__dbk_fcall_wrapper
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\fnp_my.dll,dbkFCallWrapperAddr
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\fnp_my.dll,TMethodImplementationIntercept Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\fnp_my.dll,__dbk_fcall_wrapper Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\fnp_my.dll,dbkFCallWrapperAddr Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe Automated click: OK
Source: Window Recorder Window detected: More than 3 window changes detected
Source: fnp_my.dll Static file information: File size 5310464 > 1048576
Source: fnp_my.dll Static PE information: Raw size of ipjhmkim is bigger than: 0x100000 < 0x4a7800

Data Obfuscation:

barindex
Entry point lies outside standard sections
Source: initial sample Static PE information: section where entry point is pointing to: pdnzzolr
PE file contains sections with non-standard names
Source: fnp_my.dll Static PE information: section name:
Source: fnp_my.dll Static PE information: section name: .idata
Source: fnp_my.dll Static PE information: section name:
Source: fnp_my.dll Static PE information: section name: ipjhmkim
Source: fnp_my.dll Static PE information: section name: pdnzzolr
Source: initial sample Static PE information: section name: entropy: 7.98647327711
Source: initial sample Static PE information: section name: pdnzzolr entropy: 7.23203811633
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Source: C:\Windows\System32\loaddll32.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Windows\System32\loaddll32.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Tries to detect virtualization through RDTSC time measurements
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000010D3D21 second address: 00000000010D3D29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000010D3D29 second address: 00000000010D3D2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000010D3D2D second address: 00000000010D3D3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ecx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jnc 00007F20E4DE65B6h 0x00000012 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000010D3D3F second address: 00000000010D3D43 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000010D3D43 second address: 00000000010D3D51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jl 00007F20E4DE65B6h 0x0000000e rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000010D3D51 second address: 00000000010D3D55 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000010D3D55 second address: 00000000010D3D71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a jmp 00007F20E4DE65C2h 0x0000000f rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000010D31AE second address: 00000000010D31B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000010D31B6 second address: 00000000010D31C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 je 00007F20E4DE65B6h 0x0000000d rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000010D32DC second address: 00000000010D32E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000010D32E1 second address: 00000000010D32EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000010D32EA second address: 00000000010D3330 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F20E47CC1E6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jo 00007F20E47CC20Fh 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F20E47CC1E6h 0x00000019 jmp 00007F20E47CC1DBh 0x0000001e rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000010D6C09 second address: 00000000010D6C1C instructions: 0x00000000 rdtsc 0x00000002 jc 00007F20E4DE65B8h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e push esi 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000010D6C1C second address: 00000000010D6C70 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F20E47CC1D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f jmp 00007F20E47CC1DCh 0x00000014 pop eax 0x00000015 mov edx, 3A282E57h 0x0000001a push 00000003h 0x0000001c sub ch, FFFFFF8Eh 0x0000001f push 00000000h 0x00000021 or dword ptr [ebp+1D9A180Bh], ecx 0x00000027 add ecx, dword ptr [ebp+1D9A3695h] 0x0000002d push 00000003h 0x0000002f mov ecx, dword ptr [ebp+1D9A347Dh] 0x00000035 mov edi, 44465A1Ch 0x0000003a push ABAFC7FEh 0x0000003f push esi 0x00000040 push eax 0x00000041 push edx 0x00000042 jmp 00007F20E47CC1DBh 0x00000047 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000010D6C70 second address: 00000000010D6CE6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20E4DE65C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a add dword ptr [esp], 14503802h 0x00000011 call 00007F20E4DE65C0h 0x00000016 clc 0x00000017 pop edx 0x00000018 lea ebx, dword ptr [ebp+1DA91A6Eh] 0x0000001e and ecx, dword ptr [ebp+1D9A37E5h] 0x00000024 call 00007F20E4DE65BFh 0x00000029 pushad 0x0000002a mov di, BDA5h 0x0000002e mov ebx, dword ptr [ebp+1D9A2854h] 0x00000034 popad 0x00000035 pop ecx 0x00000036 xchg eax, ebx 0x00000037 push eax 0x00000038 push edx 0x00000039 pushad 0x0000003a push ecx 0x0000003b pop ecx 0x0000003c jmp 00007F20E4DE65C0h 0x00000041 popad 0x00000042 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000010D6D5B second address: 00000000010D6D78 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20E47CC1E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000010D6D78 second address: 00000000010D6E40 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 jmp 00007F20E4DE65C4h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esp], eax 0x00000010 movsx ecx, di 0x00000013 push 00000000h 0x00000015 mov dword ptr [ebp+1D9A269Fh], esi 0x0000001b mov di, si 0x0000001e push EFE87F46h 0x00000023 jc 00007F20E4DE65D1h 0x00000029 add dword ptr [esp], 1017813Ah 0x00000030 mov ecx, dword ptr [ebp+1D9A36A9h] 0x00000036 mov edx, dword ptr [ebp+1D9A3685h] 0x0000003c push 00000003h 0x0000003e jbe 00007F20E4DE65C3h 0x00000044 push 00000000h 0x00000046 mov cx, 8172h 0x0000004a push 00000003h 0x0000004c movzx edi, dx 0x0000004f call 00007F20E4DE65B9h 0x00000054 jmp 00007F20E4DE65C5h 0x00000059 push eax 0x0000005a ja 00007F20E4DE65C5h 0x00000060 push edx 0x00000061 jmp 00007F20E4DE65BDh 0x00000066 pop edx 0x00000067 mov eax, dword ptr [esp+04h] 0x0000006b jnc 00007F20E4DE65C4h 0x00000071 push eax 0x00000072 push edx 0x00000073 push eax 0x00000074 push edx 0x00000075 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000010D6E40 second address: 00000000010D6E44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000010D6E44 second address: 00000000010D6EA1 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [eax] 0x00000008 jmp 00007F20E4DE65BBh 0x0000000d mov dword ptr [esp+04h], eax 0x00000011 push ecx 0x00000012 push edi 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 pop edi 0x00000016 pop ecx 0x00000017 pop eax 0x00000018 mov si, 0CA2h 0x0000001c jg 00007F20E4DE65B6h 0x00000022 lea ebx, dword ptr [ebp+1DA91A77h] 0x00000028 sub dword ptr [ebp+1DA8DE52h], ecx 0x0000002e xchg eax, ebx 0x0000002f pushad 0x00000030 pushad 0x00000031 jmp 00007F20E4DE65C7h 0x00000036 je 00007F20E4DE65B6h 0x0000003c popad 0x0000003d jc 00007F20E4DE65BCh 0x00000043 push eax 0x00000044 push edx 0x00000045 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000010D6F49 second address: 00000000010D6FAF instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F20E47CC1D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b nop 0x0000000c xor dword ptr [ebp+1D9A1813h], esi 0x00000012 mov dx, si 0x00000015 push 00000000h 0x00000017 mov dword ptr [ebp+1D9A19A1h], edi 0x0000001d call 00007F20E47CC1D9h 0x00000022 push edi 0x00000023 push edx 0x00000024 pushad 0x00000025 popad 0x00000026 pop edx 0x00000027 pop edi 0x00000028 push eax 0x00000029 jmp 00007F20E47CC1E1h 0x0000002e mov eax, dword ptr [esp+04h] 0x00000032 jbe 00007F20E47CC1EEh 0x00000038 jc 00007F20E47CC1E8h 0x0000003e jmp 00007F20E47CC1E2h 0x00000043 mov eax, dword ptr [eax] 0x00000045 push esi 0x00000046 push ecx 0x00000047 push eax 0x00000048 push edx 0x00000049 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000010D7076 second address: 00000000010D707B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000010FA3F8 second address: 00000000010FA3FD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000010FA3FD second address: 00000000010FA403 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000010FA403 second address: 00000000010FA40C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000010FA40C second address: 00000000010FA410 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000010FA410 second address: 00000000010FA414 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000010F817F second address: 00000000010F8183 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000010F8183 second address: 00000000010F8199 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F20E47CC1D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 jnp 00007F20E47CC1D6h 0x00000016 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000010F8199 second address: 00000000010F819D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000010F819D second address: 00000000010F81A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000010F82FC second address: 00000000010F8301 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000010F8301 second address: 00000000010F8308 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000010F847B second address: 00000000010F8497 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007F20E4DE65C7h 0x0000000a rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000010F8497 second address: 00000000010F849D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000010F849D second address: 00000000010F84A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000010F8783 second address: 00000000010F8789 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000010F8789 second address: 00000000010F878F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000010F878F second address: 00000000010F87A4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20E47CC1DEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000010F87A4 second address: 00000000010F87CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F20E4DE65C5h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jbe 00007F20E4DE65DBh 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000010F87CA second address: 00000000010F87CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000010F8931 second address: 00000000010F8937 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000010F8937 second address: 00000000010F8963 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F20E47CC1DAh 0x00000009 jmp 00007F20E47CC1DDh 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F20E47CC1DCh 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000010F8AF2 second address: 00000000010F8B18 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F20E4DE65D1h 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000010F8B18 second address: 00000000010F8B1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000010F8CCA second address: 00000000010F8CCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000010F8CCE second address: 00000000010F8CF2 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 je 00007F20E47CC1D6h 0x0000000f pushad 0x00000010 popad 0x00000011 jl 00007F20E47CC1D6h 0x00000017 push edi 0x00000018 pop edi 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c ja 00007F20E47CC1D6h 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000010F8CF2 second address: 00000000010F8CF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000010F8CF6 second address: 00000000010F8CFA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000010F8CFA second address: 00000000010F8D1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F20E4DE65BAh 0x0000000d popad 0x0000000e push edi 0x0000000f pushad 0x00000010 push edx 0x00000011 pop edx 0x00000012 push esi 0x00000013 pop esi 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 jp 00007F20E4DE65B6h 0x0000001d rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000010F926E second address: 00000000010F92A2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20E47CC1DDh 0x00000007 jmp 00007F20E47CC1E7h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f pushad 0x00000010 jns 00007F20E47CC1D6h 0x00000016 push ecx 0x00000017 pop ecx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000010F92A2 second address: 00000000010F92B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jns 00007F20E4DE65B6h 0x0000000f rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000010F93BC second address: 00000000010F93D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007F20E47CC1E0h 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000010F93D4 second address: 00000000010F9408 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 pushad 0x00000007 pushad 0x00000008 jmp 00007F20E4DE65C9h 0x0000000d pushad 0x0000000e popad 0x0000000f push esi 0x00000010 pop esi 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F20E4DE65BCh 0x00000019 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000010BA995 second address: 00000000010BA99A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000010F9565 second address: 00000000010F959D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 jmp 00007F20E4DE65C6h 0x0000000a jmp 00007F20E4DE65C7h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000010F9CE2 second address: 00000000010F9CE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000010F9CE6 second address: 00000000010F9CEA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000010FA298 second address: 00000000010FA2A6 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007F20E47CC1E2h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000010FA2A6 second address: 00000000010FA2AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000010FF2B0 second address: 00000000010FF2C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007F20E47CC1D6h 0x00000009 jg 00007F20E47CC1D6h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000010FDCD2 second address: 00000000010FDCD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000010FDCD6 second address: 00000000010FDCDA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000110BE4C second address: 000000000110BE5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 js 00007F20E4DE65B6h 0x0000000f push edi 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001108E64 second address: 0000000001108E6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001108FEB second address: 000000000110900E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jne 00007F20E4DE65B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007F20E4DE65BBh 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 jnl 00007F20E4DE65B6h 0x0000001d rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000011092E0 second address: 00000000011092E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000011095B3 second address: 00000000011095DC instructions: 0x00000000 rdtsc 0x00000002 jg 00007F20E4DE65CBh 0x00000008 push edx 0x00000009 pop edx 0x0000000a jmp 00007F20E4DE65C3h 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F20E4DE65BAh 0x00000016 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000110998E second address: 0000000001109994 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001109C66 second address: 0000000001109C79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F20E4DE65BFh 0x00000009 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001109C79 second address: 0000000001109C7D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001109DC2 second address: 0000000001109DDB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20E4DE65C5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001109DDB second address: 0000000001109E5E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007F20E47CC1D6h 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e pushad 0x0000000f je 00007F20E47CC1D6h 0x00000015 jmp 00007F20E47CC1E9h 0x0000001a jns 00007F20E47CC1D6h 0x00000020 jne 00007F20E47CC1D6h 0x00000026 popad 0x00000027 pop edx 0x00000028 pop eax 0x00000029 push eax 0x0000002a push edx 0x0000002b je 00007F20E47CC1F3h 0x00000031 jnc 00007F20E47CC1D6h 0x00000037 jmp 00007F20E47CC1E7h 0x0000003c jo 00007F20E47CC1F1h 0x00000042 jmp 00007F20E47CC1E9h 0x00000047 pushad 0x00000048 popad 0x00000049 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001109E5E second address: 0000000001109E63 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001109E63 second address: 0000000001109E72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jl 00007F20E47CC1D6h 0x0000000f rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001109E72 second address: 0000000001109E81 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20E4DE65BBh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001109FC7 second address: 0000000001109FCB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000110A100 second address: 000000000110A12E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F20E4DE65CEh 0x0000000a jmp 00007F20E4DE65C8h 0x0000000f jo 00007F20E4DE65F4h 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 pop eax 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000110A12E second address: 000000000110A13E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jg 00007F20E47CC1D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000110A13E second address: 000000000110A15A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F20E4DE65C8h 0x00000009 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000110A15A second address: 000000000110A160 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000110A2C9 second address: 000000000110A2F2 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F20E4DE65CCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jp 00007F20E4DE65B6h 0x00000013 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000110A2F2 second address: 000000000110A32B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jmp 00007F20E47CC1E7h 0x0000000c pushad 0x0000000d popad 0x0000000e pop edi 0x0000000f jmp 00007F20E47CC1E5h 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001108D2D second address: 0000000001108D41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007F20E4DE65BCh 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000110A5F7 second address: 000000000110A5FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000110A73C second address: 000000000110A740 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000110A740 second address: 000000000110A754 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jg 00007F20E47CC1D6h 0x0000000e jnl 00007F20E47CC1D6h 0x00000014 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000110AA27 second address: 000000000110AA31 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F20E4DE65B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000110AB85 second address: 000000000110ABB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F20E47CC1DCh 0x00000009 jmp 00007F20E47CC1E9h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000110ABB0 second address: 000000000110ABE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 push esi 0x00000007 pushad 0x00000008 jg 00007F20E4DE65B6h 0x0000000e jmp 00007F20E4DE65C9h 0x00000013 pushad 0x00000014 popad 0x00000015 jnc 00007F20E4DE65B6h 0x0000001b popad 0x0000001c pushad 0x0000001d jnc 00007F20E4DE65B6h 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000110AECC second address: 000000000110AEE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 jmp 00007F20E47CC1E0h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000110B085 second address: 000000000110B09D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 pop eax 0x00000008 popad 0x00000009 push edi 0x0000000a jbe 00007F20E4DE65B6h 0x00000010 pop edi 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000110B09D second address: 000000000110B0B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F20E47CC1E6h 0x00000009 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000110B0B7 second address: 000000000110B0C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 ja 00007F20E4DE65B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000110B39D second address: 000000000110B3A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000110B3A2 second address: 000000000110B3D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 jmp 00007F20E4DE65C4h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ebx 0x0000000f push edi 0x00000010 jmp 00007F20E4DE65C4h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000110B57A second address: 000000000110B57F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000110BCF2 second address: 000000000110BD09 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F20E4DE65B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F20E4DE65BDh 0x0000000f rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001111F56 second address: 0000000001111F5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001111F5A second address: 0000000001111F66 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001111F66 second address: 0000000001111F84 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007F20E47CC1DEh 0x0000000e jp 00007F20E47CC1DCh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000011112FB second address: 000000000111131B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F20E4DE65C4h 0x00000009 push edi 0x0000000a pop edi 0x0000000b popad 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000111131B second address: 0000000001111323 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001111323 second address: 0000000001111328 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001111328 second address: 000000000111132D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000111132D second address: 0000000001111361 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F20E4DE65BCh 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b ja 00007F20E4DE65B6h 0x00000011 popad 0x00000012 push ebx 0x00000013 jp 00007F20E4DE65B6h 0x00000019 jns 00007F20E4DE65B6h 0x0000001f pop ebx 0x00000020 pop edx 0x00000021 pop eax 0x00000022 push ecx 0x00000023 jo 00007F20E4DE65BEh 0x00000029 pushad 0x0000002a popad 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000011114AF second address: 00000000011114BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001111AAC second address: 0000000001111AB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001111AB0 second address: 0000000001111AD1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20E47CC1DCh 0x00000007 jmp 00007F20E47CC1DDh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push esi 0x00000011 pop esi 0x00000012 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001111AD1 second address: 0000000001111AD7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001111C27 second address: 0000000001111C4D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jng 00007F20E47CC1D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jp 00007F20E47CC1EEh 0x00000012 jmp 00007F20E47CC1E2h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001111C4D second address: 0000000001111C56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push edx 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000011125EB second address: 000000000111264A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push esi 0x00000007 jng 00007F20E47CC1E3h 0x0000000d jmp 00007F20E47CC1DDh 0x00000012 pop esi 0x00000013 mov eax, dword ptr [esp+04h] 0x00000017 jng 00007F20E47CC1DEh 0x0000001d jo 00007F20E47CC1D8h 0x00000023 pushad 0x00000024 popad 0x00000025 mov eax, dword ptr [eax] 0x00000027 pushad 0x00000028 push esi 0x00000029 pushad 0x0000002a popad 0x0000002b pop esi 0x0000002c pushad 0x0000002d push esi 0x0000002e pop esi 0x0000002f push ebx 0x00000030 pop ebx 0x00000031 popad 0x00000032 popad 0x00000033 mov dword ptr [esp+04h], eax 0x00000037 jmp 00007F20E47CC1DFh 0x0000003c pop eax 0x0000003d mov dword ptr [ebp+1D9A1AFDh], edi 0x00000043 push EC3FDB0Dh 0x00000048 push edi 0x00000049 push eax 0x0000004a push edx 0x0000004b push eax 0x0000004c push edx 0x0000004d rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000111264A second address: 000000000111264E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000011129FC second address: 0000000001112A00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001112D8D second address: 0000000001112D93 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001112D93 second address: 0000000001112D97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001112D97 second address: 0000000001112D9B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001112ED9 second address: 0000000001112EDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001112EDD second address: 0000000001112EF2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20E4DE65BEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000011133CC second address: 00000000011133E4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20E47CC1DDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000011135A6 second address: 00000000011135AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000011137F8 second address: 00000000011137FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000011137FD second address: 0000000001113825 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F20E4DE65C5h 0x00000008 jc 00007F20E4DE65B6h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001113825 second address: 000000000111382F instructions: 0x00000000 rdtsc 0x00000002 ja 00007F20E47CC1D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001113882 second address: 00000000011138C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 jng 00007F20E4DE65CFh 0x0000000d jg 00007F20E4DE65C9h 0x00000013 nop 0x00000014 mov edi, 0AD42FBAh 0x00000019 push edi 0x0000001a mov esi, dword ptr [ebp+1D9A361Dh] 0x00000020 pop edi 0x00000021 push eax 0x00000022 jbe 00007F20E4DE65BEh 0x00000028 push edi 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001113D5C second address: 0000000001113DC9 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push edx 0x0000000e call 00007F20E47CC1D8h 0x00000013 pop edx 0x00000014 mov dword ptr [esp+04h], edx 0x00000018 add dword ptr [esp+04h], 00000014h 0x00000020 inc edx 0x00000021 push edx 0x00000022 ret 0x00000023 pop edx 0x00000024 ret 0x00000025 mov dword ptr [ebp+1D9A2FF9h], ecx 0x0000002b push 00000000h 0x0000002d mov dword ptr [ebp+1D9A3021h], ebx 0x00000033 push 00000000h 0x00000035 push 00000000h 0x00000037 push ecx 0x00000038 call 00007F20E47CC1D8h 0x0000003d pop ecx 0x0000003e mov dword ptr [esp+04h], ecx 0x00000042 add dword ptr [esp+04h], 00000019h 0x0000004a inc ecx 0x0000004b push ecx 0x0000004c ret 0x0000004d pop ecx 0x0000004e ret 0x0000004f mov edi, dword ptr [ebp+1D9A3825h] 0x00000055 push eax 0x00000056 push eax 0x00000057 push edx 0x00000058 ja 00007F20E47CC1DCh 0x0000005e rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001113DC9 second address: 0000000001113DCF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001114664 second address: 000000000111466A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000111466A second address: 000000000111466E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000011155CE second address: 00000000011155D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000011155D2 second address: 0000000001115631 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push edx 0x0000000b call 00007F20E4DE65B8h 0x00000010 pop edx 0x00000011 mov dword ptr [esp+04h], edx 0x00000015 add dword ptr [esp+04h], 00000019h 0x0000001d inc edx 0x0000001e push edx 0x0000001f ret 0x00000020 pop edx 0x00000021 ret 0x00000022 push 00000000h 0x00000024 push 00000000h 0x00000026 push esi 0x00000027 call 00007F20E4DE65B8h 0x0000002c pop esi 0x0000002d mov dword ptr [esp+04h], esi 0x00000031 add dword ptr [esp+04h], 0000001Dh 0x00000039 inc esi 0x0000003a push esi 0x0000003b ret 0x0000003c pop esi 0x0000003d ret 0x0000003e push 00000000h 0x00000040 and di, C161h 0x00000045 push eax 0x00000046 push eax 0x00000047 push edx 0x00000048 pushad 0x00000049 pushad 0x0000004a popad 0x0000004b push eax 0x0000004c push edx 0x0000004d rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001115631 second address: 0000000001115636 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001115636 second address: 0000000001115641 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007F20E4DE65B6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000111600B second address: 0000000001116088 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jl 00007F20E47CC1DEh 0x0000000d jg 00007F20E47CC1D8h 0x00000013 nop 0x00000014 jmp 00007F20E47CC1E3h 0x00000019 push 00000000h 0x0000001b push 00000000h 0x0000001d push ebp 0x0000001e call 00007F20E47CC1D8h 0x00000023 pop ebp 0x00000024 mov dword ptr [esp+04h], ebp 0x00000028 add dword ptr [esp+04h], 00000019h 0x00000030 inc ebp 0x00000031 push ebp 0x00000032 ret 0x00000033 pop ebp 0x00000034 ret 0x00000035 push 00000000h 0x00000037 push 00000000h 0x00000039 push edx 0x0000003a call 00007F20E47CC1D8h 0x0000003f pop edx 0x00000040 mov dword ptr [esp+04h], edx 0x00000044 add dword ptr [esp+04h], 0000001Dh 0x0000004c inc edx 0x0000004d push edx 0x0000004e ret 0x0000004f pop edx 0x00000050 ret 0x00000051 push eax 0x00000052 jl 00007F20E47CC1E0h 0x00000058 pushad 0x00000059 push eax 0x0000005a push edx 0x0000005b rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001116BBF second address: 0000000001116BC9 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F20E4DE65B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001117570 second address: 0000000001117582 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F20E47CC1D6h 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001117582 second address: 0000000001117586 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001117586 second address: 00000000011175FA instructions: 0x00000000 rdtsc 0x00000002 je 00007F20E47CC1D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jl 00007F20E47CC1D6h 0x00000011 pop eax 0x00000012 popad 0x00000013 nop 0x00000014 sub dword ptr [ebp+1D9A20ABh], esi 0x0000001a add dword ptr [ebp+1D9A2F42h], edx 0x00000020 push 00000000h 0x00000022 push 00000000h 0x00000024 push ebx 0x00000025 call 00007F20E47CC1D8h 0x0000002a pop ebx 0x0000002b mov dword ptr [esp+04h], ebx 0x0000002f add dword ptr [esp+04h], 00000016h 0x00000037 inc ebx 0x00000038 push ebx 0x00000039 ret 0x0000003a pop ebx 0x0000003b ret 0x0000003c mov di, C1E3h 0x00000040 movsx esi, cx 0x00000043 push 00000000h 0x00000045 push 00000000h 0x00000047 push ebx 0x00000048 call 00007F20E47CC1D8h 0x0000004d pop ebx 0x0000004e mov dword ptr [esp+04h], ebx 0x00000052 add dword ptr [esp+04h], 00000015h 0x0000005a inc ebx 0x0000005b push ebx 0x0000005c ret 0x0000005d pop ebx 0x0000005e ret 0x0000005f mov si, 3DC5h 0x00000063 push eax 0x00000064 push edx 0x00000065 push eax 0x00000066 push edx 0x00000067 je 00007F20E47CC1D6h 0x0000006d rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001118191 second address: 0000000001118195 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001118195 second address: 0000000001118199 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001118199 second address: 00000000011181EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 mov dword ptr [esp], eax 0x0000000a add dword ptr [ebp+1D9A188Fh], edi 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push edi 0x00000015 call 00007F20E4DE65B8h 0x0000001a pop edi 0x0000001b mov dword ptr [esp+04h], edi 0x0000001f add dword ptr [esp+04h], 00000018h 0x00000027 inc edi 0x00000028 push edi 0x00000029 ret 0x0000002a pop edi 0x0000002b ret 0x0000002c movsx esi, bx 0x0000002f xor dword ptr [ebp+1DA90974h], ebx 0x00000035 or edi, 4D0D2E37h 0x0000003b push 00000000h 0x0000003d mov esi, edi 0x0000003f mov si, di 0x00000042 push eax 0x00000043 push eax 0x00000044 push edx 0x00000045 jc 00007F20E4DE65B8h 0x0000004b pushad 0x0000004c popad 0x0000004d rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000011181EC second address: 00000000011181F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F20E47CC1D6h 0x0000000a rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000011181F6 second address: 00000000011181FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001118D33 second address: 0000000001118DAF instructions: 0x00000000 rdtsc 0x00000002 je 00007F20E47CC1DCh 0x00000008 jg 00007F20E47CC1D6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 jmp 00007F20E47CC1DEh 0x00000016 nop 0x00000017 push edx 0x00000018 mov dword ptr [ebp+1DAB4AF8h], eax 0x0000001e pop edi 0x0000001f push 00000000h 0x00000021 jmp 00007F20E47CC1DDh 0x00000026 push 00000000h 0x00000028 xor edi, 37E717B8h 0x0000002e call 00007F20E47CC1E1h 0x00000033 mov edi, eax 0x00000035 pop edi 0x00000036 xchg eax, ebx 0x00000037 js 00007F20E47CC1DCh 0x0000003d pushad 0x0000003e push edi 0x0000003f pop edi 0x00000040 pushad 0x00000041 popad 0x00000042 popad 0x00000043 push eax 0x00000044 push esi 0x00000045 push eax 0x00000046 push edx 0x00000047 jmp 00007F20E47CC1E8h 0x0000004c rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000111BD21 second address: 000000000111BD2E instructions: 0x00000000 rdtsc 0x00000002 jne 00007F20E4DE65B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000111CD5F second address: 000000000111CDE2 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b jmp 00007F20E47CC1DFh 0x00000010 mov dword ptr [ebp+1D9A3531h], edi 0x00000016 push 00000000h 0x00000018 push 00000000h 0x0000001a push ecx 0x0000001b call 00007F20E47CC1D8h 0x00000020 pop ecx 0x00000021 mov dword ptr [esp+04h], ecx 0x00000025 add dword ptr [esp+04h], 00000015h 0x0000002d inc ecx 0x0000002e push ecx 0x0000002f ret 0x00000030 pop ecx 0x00000031 ret 0x00000032 or dword ptr [ebp+1DAC4569h], edi 0x00000038 push 00000000h 0x0000003a push 00000000h 0x0000003c push edx 0x0000003d call 00007F20E47CC1D8h 0x00000042 pop edx 0x00000043 mov dword ptr [esp+04h], edx 0x00000047 add dword ptr [esp+04h], 00000018h 0x0000004f inc edx 0x00000050 push edx 0x00000051 ret 0x00000052 pop edx 0x00000053 ret 0x00000054 mov dword ptr [ebp+1D9A2593h], edi 0x0000005a mov bh, 10h 0x0000005c push eax 0x0000005d push eax 0x0000005e push edx 0x0000005f jmp 00007F20E47CC1E1h 0x00000064 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000111CDE2 second address: 000000000111CDFB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F20E4DE65C5h 0x00000009 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000111EEFB second address: 000000000111EF00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000111EF00 second address: 000000000111EF76 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F20E4DE65C2h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d nop 0x0000000e mov edi, dword ptr [ebp+1D9A3505h] 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push edi 0x00000019 call 00007F20E4DE65B8h 0x0000001e pop edi 0x0000001f mov dword ptr [esp+04h], edi 0x00000023 add dword ptr [esp+04h], 00000016h 0x0000002b inc edi 0x0000002c push edi 0x0000002d ret 0x0000002e pop edi 0x0000002f ret 0x00000030 mov dword ptr [ebp+1D9A25C8h], edx 0x00000036 mov bx, 2D8Dh 0x0000003a push 00000000h 0x0000003c push 00000000h 0x0000003e push ecx 0x0000003f call 00007F20E4DE65B8h 0x00000044 pop ecx 0x00000045 mov dword ptr [esp+04h], ecx 0x00000049 add dword ptr [esp+04h], 00000014h 0x00000051 inc ecx 0x00000052 push ecx 0x00000053 ret 0x00000054 pop ecx 0x00000055 ret 0x00000056 mov ebx, edi 0x00000058 mov ebx, dword ptr [ebp+1D9A25DAh] 0x0000005e push eax 0x0000005f pushad 0x00000060 push edx 0x00000061 push eax 0x00000062 push edx 0x00000063 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000111EF76 second address: 000000000111EF7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000011230BB second address: 00000000011230C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F20E4DE65B6h 0x0000000a rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001123164 second address: 0000000001123176 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20E47CC1DEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000011241A6 second address: 00000000011241AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000011241AA second address: 000000000112422B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F20E47CC1E5h 0x0000000b popad 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push edi 0x00000012 call 00007F20E47CC1D8h 0x00000017 pop edi 0x00000018 mov dword ptr [esp+04h], edi 0x0000001c add dword ptr [esp+04h], 00000017h 0x00000024 inc edi 0x00000025 push edi 0x00000026 ret 0x00000027 pop edi 0x00000028 ret 0x00000029 jmp 00007F20E47CC1E4h 0x0000002e push 00000000h 0x00000030 mov ebx, dword ptr [ebp+1D9A26CDh] 0x00000036 push 00000000h 0x00000038 mov dword ptr [ebp+1D9A26A9h], eax 0x0000003e mov edi, dword ptr [ebp+1D9A1A62h] 0x00000044 xchg eax, esi 0x00000045 jmp 00007F20E47CC1E3h 0x0000004a push eax 0x0000004b pushad 0x0000004c pushad 0x0000004d push eax 0x0000004e push edx 0x0000004f rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001127157 second address: 000000000112715B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000112715B second address: 0000000001127183 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F20E47CC1E7h 0x0000000b popad 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 jc 00007F20E47CC1D6h 0x00000016 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001127183 second address: 000000000112718C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000112823E second address: 0000000001128262 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F20E47CC1DCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jmp 00007F20E47CC1DDh 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 popad 0x00000016 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000010BC4A3 second address: 00000000010BC4A9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000112B941 second address: 000000000112B974 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop ebx 0x00000008 push eax 0x00000009 jmp 00007F20E47CC1E1h 0x0000000e nop 0x0000000f mov di, ADA1h 0x00000013 push 00000000h 0x00000015 mov di, dx 0x00000018 push 00000000h 0x0000001a mov bh, cl 0x0000001c xchg eax, esi 0x0000001d push eax 0x0000001e push edx 0x0000001f js 00007F20E47CC1DCh 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000112B974 second address: 000000000112B978 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000112B978 second address: 000000000112B995 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20E47CC1DFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jp 00007F20E47CC1DEh 0x00000010 push ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000112E078 second address: 000000000112E098 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jns 00007F20E4DE65B6h 0x0000000d jmp 00007F20E4DE65BBh 0x00000012 popad 0x00000013 popad 0x00000014 push eax 0x00000015 push edi 0x00000016 push eax 0x00000017 push edx 0x00000018 push ebx 0x00000019 pop ebx 0x0000001a rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000113162C second address: 0000000001131632 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001131632 second address: 0000000001131637 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001137BB6 second address: 0000000001137BC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 js 00007F20E4E5D346h 0x0000000d push esi 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001137BC5 second address: 0000000001137BF5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 jmp 00007F20E4B5093Fh 0x0000000e jne 00007F20E4B50936h 0x00000014 popad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 ja 00007F20E4B50942h 0x0000001e jbe 00007F20E4B50936h 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001137BF5 second address: 0000000001137C01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F20E4E5D34Eh 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001137C01 second address: 0000000001137C07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000010BFBB1 second address: 00000000010BFBCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F20E4E5D351h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000010BFBCD second address: 00000000010BFBD1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000010BFBD1 second address: 00000000010BFBD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001137516 second address: 000000000113751A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000113751A second address: 000000000113751E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000011434CD second address: 00000000011434D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000011434D6 second address: 00000000011434ED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jp 00007F20E4E5D346h 0x00000011 jne 00007F20E4E5D346h 0x00000017 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000011434ED second address: 000000000114350F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007F20E4B50944h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d js 00007F20E4B50936h 0x00000013 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000114350F second address: 0000000001143513 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001143513 second address: 0000000001143533 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jng 00007F20E4B50936h 0x0000000f jg 00007F20E4B50936h 0x00000015 jc 00007F20E4B50936h 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001143533 second address: 0000000001143537 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001143537 second address: 000000000114353B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001142A4A second address: 0000000001142A73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F20E4E5D351h 0x0000000a jmp 00007F20E4E5D34Fh 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001142A73 second address: 0000000001142A77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001142CF7 second address: 0000000001142D04 instructions: 0x00000000 rdtsc 0x00000002 js 00007F20E4E5D346h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001142E34 second address: 0000000001142E38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000011430E1 second address: 00000000011430E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000011430E5 second address: 00000000011430E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000011430E9 second address: 0000000001143103 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jng 00007F20E4E5D352h 0x0000000e rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001143103 second address: 0000000001143115 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007F20E4B50936h 0x00000009 pushad 0x0000000a popad 0x0000000b push esi 0x0000000c pop esi 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001149158 second address: 0000000001149170 instructions: 0x00000000 rdtsc 0x00000002 js 00007F20E4E5D346h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jno 00007F20E4E5D346h 0x00000012 jc 00007F20E4E5D346h 0x00000018 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001149170 second address: 0000000001149174 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001147F26 second address: 0000000001147F2A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001147F2A second address: 0000000001147F32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001147F32 second address: 0000000001147F6D instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F20E4E5D34Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F20E4E5D34Eh 0x00000011 jc 00007F20E4E5D35Bh 0x00000017 jmp 00007F20E4E5D34Fh 0x0000001c ja 00007F20E4E5D346h 0x00000022 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000111A070 second address: 000000000111A074 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000111A074 second address: 000000000111A07A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000111A33F second address: 000000000111A343 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000111A343 second address: 000000000111A34C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000111A4D9 second address: 000000000111A500 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F20E4B5094Bh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push edx 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000111A500 second address: 000000000111A506 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000111A506 second address: 000000000111A541 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F20E4B50938h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e push ecx 0x0000000f pushad 0x00000010 js 00007F20E4B50936h 0x00000016 jmp 00007F20E4B5093Eh 0x0000001b popad 0x0000001c pop ecx 0x0000001d pop eax 0x0000001e movsx edx, cx 0x00000021 mov edx, 7CEE3D61h 0x00000026 push 452DBB47h 0x0000002b push eax 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f pop eax 0x00000030 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000111A662 second address: 000000000111A680 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 mov dword ptr [esp], esi 0x00000009 pushad 0x0000000a jmp 00007F20E4E5D34Eh 0x0000000f popad 0x00000010 nop 0x00000011 push esi 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000111A680 second address: 000000000111A68D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pop esi 0x00000008 push eax 0x00000009 pushad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000111A68D second address: 000000000111A6B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F20E4E5D34Dh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F20E4E5D351h 0x00000011 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000111A760 second address: 000000000111A77D instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F20E4B50940h 0x00000008 jmp 00007F20E4B5093Ah 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 push edi 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000111A77D second address: 000000000111A781 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000111A781 second address: 000000000111A797 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 mov eax, dword ptr [eax] 0x00000009 pushad 0x0000000a push edx 0x0000000b jnl 00007F20E4B50936h 0x00000011 pop edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000111A797 second address: 000000000111A79B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000111A870 second address: 000000000111A881 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jp 00007F20E4B50944h 0x0000000d push eax 0x0000000e push edx 0x0000000f push esi 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001148207 second address: 0000000001148218 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push esi 0x00000004 pop esi 0x00000005 pushad 0x00000006 popad 0x00000007 pop edi 0x00000008 pushad 0x00000009 jbe 00007F20E4E5D346h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000114835A second address: 0000000001148360 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001148360 second address: 0000000001148364 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001148364 second address: 000000000114836D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000114836D second address: 0000000001148379 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 pop edx 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001148379 second address: 000000000114839A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 pushad 0x00000007 pushad 0x00000008 push eax 0x00000009 pop eax 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c popad 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 jmp 00007F20E4B5093Dh 0x00000015 push ebx 0x00000016 pop ebx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000114839A second address: 00000000011483A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jns 00007F20E4E5D346h 0x0000000d rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001148840 second address: 000000000114884E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jc 00007F20E4B50936h 0x0000000e rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000114884E second address: 0000000001148854 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000011489C1 second address: 00000000011489C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000011489C5 second address: 00000000011489D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000011489D3 second address: 0000000001148A01 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20E4B50940h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F20E4B50946h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001148B4B second address: 0000000001148B62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 popad 0x00000009 ja 00007F20E4E5D34Eh 0x0000000f rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001148CC3 second address: 0000000001148CCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001148CCA second address: 0000000001148CD0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001148CD0 second address: 0000000001148CD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001148CD4 second address: 0000000001148D00 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F20E4E5D346h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push edi 0x0000000c pop edi 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F20E4E5D356h 0x0000001b rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000114AD22 second address: 000000000114AD28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000114AD28 second address: 000000000114AD2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001076098 second address: 00000000010760B1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20E4B5093Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b jno 00007F20E4B50936h 0x00000011 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000115109B second address: 00000000011510D8 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F20E4E5D346h 0x00000008 jp 00007F20E4E5D346h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jmp 00007F20E4E5D352h 0x00000015 jbe 00007F20E4E5D34Ch 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e jng 00007F20E4E5D34Ch 0x00000024 jne 00007F20E4E5D346h 0x0000002a rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000011510D8 second address: 00000000011510DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000011510DE second address: 00000000011510E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001151225 second address: 000000000115123C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20E4B5093Dh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000115123C second address: 0000000001151242 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001151242 second address: 0000000001151246 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001151646 second address: 0000000001151665 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F20E4E5D359h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001150CCC second address: 0000000001150CD1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001151A9D second address: 0000000001151AB8 instructions: 0x00000000 rdtsc 0x00000002 js 00007F20E4E5D346h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f je 00007F20E4E5D34Ch 0x00000015 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001151BFB second address: 0000000001151C24 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pushad 0x0000000a popad 0x0000000b push edi 0x0000000c pop edi 0x0000000d push edi 0x0000000e pop edi 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F20E4B50945h 0x00000017 push esi 0x00000018 pop esi 0x00000019 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001151C24 second address: 0000000001151C28 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001151C28 second address: 0000000001151C45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F20E4B50943h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001151C45 second address: 0000000001151C4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001151D93 second address: 0000000001151D97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001157E21 second address: 0000000001157E27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001157F7F second address: 0000000001157F91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F20E4B50936h 0x0000000a je 00007F20E4B50936h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001157F91 second address: 0000000001157F99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001158547 second address: 000000000115854B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000115883A second address: 0000000001158850 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20E4E5D34Ch 0x00000007 js 00007F20E4E5D34Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001158B1D second address: 0000000001158B33 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jng 00007F20E4B5093Ch 0x0000000c ja 00007F20E4B50936h 0x00000012 pushad 0x00000013 push ebx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001158B33 second address: 0000000001158B54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jne 00007F20E4E5D348h 0x0000000b jmp 00007F20E4E5D351h 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001158DFF second address: 0000000001158E21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F20E4B50947h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001158E21 second address: 0000000001158E25 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000011591EC second address: 00000000011591F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000115D186 second address: 000000000115D1A4 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jp 00007F20E4E5D346h 0x00000009 ja 00007F20E4E5D346h 0x0000000f pop ebx 0x00000010 jc 00007F20E4E5D348h 0x00000016 pop edx 0x00000017 pop eax 0x00000018 pushad 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000115D1A4 second address: 000000000115D1B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F20E4B50936h 0x0000000a popad 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000115D1B2 second address: 000000000115D1CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F20E4E5D34Ah 0x00000009 pop esi 0x0000000a jg 00007F20E4E5D348h 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000115D1CD second address: 000000000115D1D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F20E4B50936h 0x0000000a rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001167465 second address: 0000000001167469 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001167469 second address: 0000000001167475 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jc 00007F20E4B50936h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001166D23 second address: 0000000001166D3C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20E4E5D355h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001166D3C second address: 0000000001166D61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F20E4B50944h 0x0000000b pushad 0x0000000c jg 00007F20E4B50936h 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001166EB8 second address: 0000000001166EBE instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001166EBE second address: 0000000001166EC8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F20E4B50936h 0x0000000a rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001174408 second address: 0000000001174417 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 jg 00007F20E4E5D346h 0x0000000f rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001174417 second address: 000000000117442C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F20E4B5093Fh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000117442C second address: 000000000117444B instructions: 0x00000000 rdtsc 0x00000002 jno 00007F20E4E5D348h 0x00000008 pushad 0x00000009 jmp 00007F20E4E5D34Ch 0x0000000e jns 00007F20E4E5D346h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001173A06 second address: 0000000001173A19 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20E4B5093Fh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001173D36 second address: 0000000001173D3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001173D3E second address: 0000000001173D53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jc 00007F20E4B50938h 0x0000000b push eax 0x0000000c pop eax 0x0000000d je 00007F20E4B5094Bh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001179B75 second address: 0000000001179B9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F20E4E5D357h 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F20E4E5D34Dh 0x00000010 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001179B9F second address: 0000000001179BA5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000111AB89 second address: 000000000111AB9F instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F20E4E5D346h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f jp 00007F20E4E5D346h 0x00000015 pop ecx 0x00000016 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000111AB9F second address: 000000000111ABA5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000111AC4F second address: 000000000111AC53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000111AC53 second address: 000000000111AC59 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000117E26E second address: 000000000117E276 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000117E3AC second address: 000000000117E3B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000117E3B0 second address: 000000000117E3C3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20E4E5D34Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000117E3C3 second address: 000000000117E3CD instructions: 0x00000000 rdtsc 0x00000002 je 00007F20E4B5093Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000117E3CD second address: 000000000117E3D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000117E3D9 second address: 000000000117E3DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000117E3DD second address: 000000000117E3EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b jo 00007F20E4E5D346h 0x00000011 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000117E3EE second address: 000000000117E3FA instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000011878F5 second address: 0000000001187921 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F20E4E5D358h 0x0000000a pop esi 0x0000000b jc 00007F20E4E5D352h 0x00000011 jl 00007F20E4E5D346h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001185C36 second address: 0000000001185C3A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000118688E second address: 00000000011868B9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jo 00007F20E4E5D346h 0x00000012 jmp 00007F20E4E5D359h 0x00000017 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000011873A2 second address: 00000000011873BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jmp 00007F20E4B50943h 0x0000000b rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000118761C second address: 0000000001187630 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F20E4E5D346h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b push edx 0x0000000c pop edx 0x0000000d pop esi 0x0000000e push eax 0x0000000f push edx 0x00000010 push edi 0x00000011 pop edi 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001187630 second address: 0000000001187634 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001191C95 second address: 0000000001191CB5 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F20E4E5D346h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jno 00007F20E4E5D346h 0x00000012 jmp 00007F20E4E5D34Eh 0x00000017 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001191CB5 second address: 0000000001191CB9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001191E0E second address: 0000000001191E18 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F20E4E5D352h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001191E18 second address: 0000000001191E1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001191E1E second address: 0000000001191E42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F20E4E5D34Bh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F20E4E5D34Dh 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001191E42 second address: 0000000001191E46 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001191E46 second address: 0000000001191E5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F20E4E5D351h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001191E5D second address: 0000000001191E62 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000011924A4 second address: 00000000011924C1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20E4E5D359h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000011924C1 second address: 00000000011924D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 jns 00007F20E4B5095Eh 0x0000000d push eax 0x0000000e push edx 0x0000000f jng 00007F20E4B50936h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000011924D8 second address: 00000000011924DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000011924DC second address: 00000000011924E6 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F20E4B50936h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001192634 second address: 000000000119263A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000119263A second address: 000000000119265F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20E4B50947h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d jnl 00007F20E4B50936h 0x00000013 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000119265F second address: 0000000001192675 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20E4E5D352h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000011927F8 second address: 0000000001192822 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 jmp 00007F20E4B5093Ah 0x0000000c jl 00007F20E4B50938h 0x00000012 push esi 0x00000013 pop esi 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 push ebx 0x00000018 push eax 0x00000019 pop eax 0x0000001a pop ebx 0x0000001b jmp 00007F20E4B5093Ah 0x00000020 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001192822 second address: 0000000001192829 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000119E4E2 second address: 000000000119E4E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000119E4E8 second address: 000000000119E507 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push edx 0x00000008 jmp 00007F20E4E5D356h 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000119E507 second address: 000000000119E541 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20E4B50947h 0x00000007 jmp 00007F20E4B50949h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push ebx 0x00000011 push edi 0x00000012 pop edi 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000119D235 second address: 000000000119D24F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F20E4E5D356h 0x00000009 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000119D24F second address: 000000000119D259 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F20E4B50936h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000119DC68 second address: 000000000119DC82 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F20E4E5D346h 0x00000008 jns 00007F20E4E5D346h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push edi 0x00000013 pop edi 0x00000014 jbe 00007F20E4E5D346h 0x0000001a rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000119DC82 second address: 000000000119DC86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000119E386 second address: 000000000119E39E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F20E4E5D354h 0x00000009 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000119E39E second address: 000000000119E3A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000011B15D4 second address: 00000000011B15E5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jg 00007F20E4E5D346h 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000011B15E5 second address: 00000000011B15EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000011B843D second address: 00000000011B845F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20E4E5D34Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F20E4E5D34Dh 0x00000010 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000011B845F second address: 00000000011B8481 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F20E4B50948h 0x00000009 jl 00007F20E4B50936h 0x0000000f rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000011B7124 second address: 00000000011B7135 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F20E4E5D34Dh 0x00000009 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000011B7135 second address: 00000000011B7147 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20E4B5093Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000011B7147 second address: 00000000011B714B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000011B714B second address: 00000000011B7170 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F20E4B50936h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007F20E4B50948h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000011B7170 second address: 00000000011B7176 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000011B72ED second address: 00000000011B7303 instructions: 0x00000000 rdtsc 0x00000002 je 00007F20E4B5093Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000011B7303 second address: 00000000011B7307 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000011B7713 second address: 00000000011B7717 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000011B7717 second address: 00000000011B7730 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20E4E5D355h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000011BC37B second address: 00000000011BC381 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000011BBC39 second address: 00000000011BBC4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F20E4E5D350h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000011BBC4F second address: 00000000011BBC73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jno 00007F20E4B5094Fh 0x0000000b rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000011BBDE9 second address: 00000000011BBDFC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20E4E5D34Dh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000011BBDFC second address: 00000000011BBE15 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20E4B50944h 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000011BBFE2 second address: 00000000011BBFE6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000011BBFE6 second address: 00000000011BBFF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000011BBFF2 second address: 00000000011BC00A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F20E4E5D354h 0x00000009 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000011BC00A second address: 00000000011BC00E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000011BC00E second address: 00000000011BC017 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000120428E second address: 00000000012042B3 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007F20E4B5093Eh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jg 00007F20E4B5093Eh 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 jnc 00007F20E4B50936h 0x00000019 push ebx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000120453A second address: 000000000120454F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F20E4E5D34Bh 0x0000000b popad 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000120454F second address: 0000000001204554 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001204554 second address: 000000000120455B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001205414 second address: 000000000120541D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000120541D second address: 0000000001205422 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001205422 second address: 0000000001205427 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001205427 second address: 000000000120544E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 popad 0x00000008 jns 00007F20E4E5D346h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 ja 00007F20E4E5D346h 0x0000001a jmp 00007F20E4E5D34Dh 0x0000001f rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000011C1C47 second address: 00000000011C1C4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000011C1C4F second address: 00000000011C1C58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push esi 0x00000007 pop esi 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000011C1C58 second address: 00000000011C1C62 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F20E4B5093Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000011C1C62 second address: 00000000011C1C6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001205BC7 second address: 0000000001205BDA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20E4B5093Fh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000120B905 second address: 000000000120B911 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F20E4E5D346h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000120B911 second address: 000000000120B924 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F20E4B5093Eh 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001239924 second address: 000000000123992A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000123992A second address: 000000000123992F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000123992F second address: 0000000001239934 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001239A7C second address: 0000000001239A80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001239A80 second address: 0000000001239A8E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 jp 00007F20E4E5D346h 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001239BB2 second address: 0000000001239BD8 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F20E4B5093Ch 0x00000008 pushad 0x00000009 jmp 00007F20E4B50945h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000123A027 second address: 000000000123A047 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 pop eax 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F20E4E5D34Ah 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push ebx 0x00000014 jp 00007F20E4E5D346h 0x0000001a pop ebx 0x0000001b rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000123B0CB second address: 000000000123B0E3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F20E4B50942h 0x0000000b rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000123B0E3 second address: 000000000123B0ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F20E4E5D346h 0x0000000a rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001243042 second address: 000000000124304B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000124304B second address: 000000000124305A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jp 00007F20E4E5D346h 0x0000000d push edx 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000124305A second address: 0000000001243064 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001243064 second address: 000000000124306A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000124306A second address: 000000000124307F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 pushad 0x0000000a push ecx 0x0000000b jns 00007F20E4B50936h 0x00000011 pop ecx 0x00000012 push edi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000124307F second address: 000000000124308A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000124308A second address: 000000000124308E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001247CBD second address: 0000000001247CD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F20E4E5D357h 0x00000009 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001247CD8 second address: 0000000001247CDC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000124AA44 second address: 000000000124AA4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000126D7AC second address: 000000000126D7BE instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jnl 00007F20E4B50944h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000126D7BE second address: 000000000126D7C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000126D7C2 second address: 000000000126D7F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a pushad 0x0000000b push ecx 0x0000000c jmp 00007F20E4B5093Ah 0x00000011 pop ecx 0x00000012 jmp 00007F20E4B50942h 0x00000017 popad 0x00000018 mov eax, dword ptr [eax] 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d pushad 0x0000001e popad 0x0000001f pushad 0x00000020 popad 0x00000021 popad 0x00000022 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000126D7F6 second address: 000000000126D80F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F20E4E5D354h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000126EC48 second address: 000000000126EC61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F20E4B50936h 0x0000000a jnc 00007F20E4B50938h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000126EC61 second address: 000000000126EC65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000126EC65 second address: 000000000126EC73 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 push esi 0x0000000a pop esi 0x0000000b pushad 0x0000000c popad 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000126FF45 second address: 000000000126FF4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001286B38 second address: 0000000001286B67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F20E4B50940h 0x00000009 jmp 00007F20E4B50940h 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 jno 00007F20E4B50936h 0x00000019 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001289748 second address: 000000000128974D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001292038 second address: 0000000001292045 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 js 00007F20E4B5093Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000012915E1 second address: 00000000012915E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001291A3D second address: 0000000001291A46 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push esi 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001291B68 second address: 0000000001291B73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001291B73 second address: 0000000001291B7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F20E4B50936h 0x0000000a rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001291B7D second address: 0000000001291B99 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F20E4E5D354h 0x0000000d rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001291B99 second address: 0000000001291BBC instructions: 0x00000000 rdtsc 0x00000002 jno 00007F20E4B50936h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b pushad 0x0000000c jmp 00007F20E4B50944h 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000120DDDF second address: 000000000120DDE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000120DDE7 second address: 000000000120DDEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001291D1C second address: 0000000001291D42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F20E4E5D34Fh 0x00000009 push edx 0x0000000a pop edx 0x0000000b popad 0x0000000c ja 00007F20E4E5D34Ch 0x00000012 jnl 00007F20E4E5D346h 0x00000018 push eax 0x00000019 push edx 0x0000001a push ebx 0x0000001b pop ebx 0x0000001c rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001291D42 second address: 0000000001291D74 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20E4B5093Dh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c push edx 0x0000000d jmp 00007F20E4B50945h 0x00000012 jo 00007F20E4B5093Ch 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000129888D second address: 0000000001298892 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001298892 second address: 00000000012988A8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007F20E4B50936h 0x00000009 jnl 00007F20E4B50936h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push edi 0x00000013 push ebx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001299071 second address: 0000000001299077 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001299077 second address: 0000000001299080 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001299080 second address: 0000000001299086 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001299233 second address: 0000000001299239 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001299239 second address: 000000000129924B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jp 00007F20E4E5D346h 0x0000000c jnl 00007F20E4E5D346h 0x00000012 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000129924B second address: 000000000129924F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000129924F second address: 000000000129925B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000129925B second address: 000000000129925F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000129965F second address: 0000000001299663 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001299663 second address: 0000000001299669 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001299669 second address: 00000000012996BC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20E4E5D34Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b jmp 00007F20E4E5D34Eh 0x00000010 pushad 0x00000011 popad 0x00000012 pushad 0x00000013 popad 0x00000014 jmp 00007F20E4E5D358h 0x00000019 popad 0x0000001a pushad 0x0000001b pushad 0x0000001c popad 0x0000001d jns 00007F20E4E5D346h 0x00000023 popad 0x00000024 push eax 0x00000025 push edx 0x00000026 jne 00007F20E4E5D346h 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000012996BC second address: 00000000012996C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000012996C0 second address: 00000000012996C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000012996C4 second address: 00000000012996D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jng 00007F20E4B50936h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000129D9B2 second address: 000000000129D9B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000129D9B6 second address: 000000000129D9BF instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000129D9BF second address: 000000000129D9C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000129D9C5 second address: 000000000129D9D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F20E4B50936h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000129D9D0 second address: 000000000129D9D5 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000129DC68 second address: 000000000129DC6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000129DC6E second address: 000000000129DC8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 jmp 00007F20E4E5D34Ah 0x0000000c jg 00007F20E4E5D348h 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000129DC8D second address: 000000000129DC97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000129DC97 second address: 000000000129DC9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000129E200 second address: 000000000129E207 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000129E207 second address: 000000000129E211 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000129E64F second address: 000000000129E665 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F20E4B5093Dh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000012A4316 second address: 00000000012A431A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000012A431A second address: 00000000012A4339 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F20E4B50949h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000012A9264 second address: 00000000012A926B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000012A926B second address: 00000000012A927A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000012A927A second address: 00000000012A927E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000012A927E second address: 00000000012A9284 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000102CDD9 second address: 000000000102CDDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001311478 second address: 000000000131147C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000131147C second address: 0000000001311480 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001311480 second address: 0000000001311486 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001311486 second address: 00000000013114B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F20E4E5D354h 0x0000000e jp 00007F20E4E5D351h 0x00000014 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000013114B4 second address: 00000000013114D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jnc 00007F20E4B50936h 0x0000000b jnl 00007F20E4B50936h 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 pushad 0x00000015 jmp 00007F20E4B5093Bh 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000131CDDE second address: 000000000131CDF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F20E4E5D350h 0x00000009 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000131CDF2 second address: 000000000131CE2C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20E4B50943h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push edx 0x0000000b jng 00007F20E4B50955h 0x00000011 jmp 00007F20E4B50949h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000132C022 second address: 000000000132C028 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000132C028 second address: 000000000132C02C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000132C02C second address: 000000000132C032 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000132C032 second address: 000000000132C040 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F20E4B50938h 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000132C040 second address: 000000000132C044 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000132C044 second address: 000000000132C048 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001071075 second address: 0000000001071082 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jl 00007F20E4E5D346h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001071082 second address: 00000000010710B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F20E4B50946h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jbe 00007F20E4B50951h 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F20E4B5093Dh 0x00000019 push eax 0x0000001a pop eax 0x0000001b rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001335AD3 second address: 0000000001335AD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001335AD7 second address: 0000000001335ADD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001031E65 second address: 0000000001031E69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001031E69 second address: 0000000001031E7E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20E4B50941h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001031E7E second address: 0000000001031E84 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001031E84 second address: 0000000001031E88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001031E88 second address: 0000000001031EA4 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F20E4E5D346h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007F20E4E5D34Dh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001344196 second address: 000000000134419A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000134419A second address: 00000000013441C6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20E4E5D355h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a push edi 0x0000000b jne 00007F20E4E5D34Eh 0x00000011 push esi 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000013441C6 second address: 00000000013441CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000136221D second address: 0000000001362221 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001362221 second address: 000000000136222D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000136222D second address: 0000000001362231 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001362231 second address: 000000000136223C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push ebx 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000106F54B second address: 000000000106F550 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000136A4F0 second address: 000000000136A4F7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000136A4F7 second address: 000000000136A540 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b push edx 0x0000000c pop edx 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007F20E4E5D358h 0x00000014 popad 0x00000015 jno 00007F20E4E5D35Eh 0x0000001b push ebx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001372E62 second address: 0000000001372E96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 js 00007F20E4B5093Eh 0x0000000b jno 00007F20E4B50936h 0x00000011 pushad 0x00000012 popad 0x00000013 jc 00007F20E4B50942h 0x00000019 jns 00007F20E4B50936h 0x0000001f jnl 00007F20E4B50936h 0x00000025 popad 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007F20E4B5093Ch 0x0000002d rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001373140 second address: 0000000001373162 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F20E4E5D359h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001373162 second address: 0000000001373166 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001373166 second address: 0000000001373178 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F20E4E5D346h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jc 00007F20E4E5D346h 0x00000012 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001373178 second address: 000000000137317C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001373310 second address: 0000000001373329 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 js 00007F20E4E5D34Ch 0x0000000d jnc 00007F20E4E5D346h 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 pop eax 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001373329 second address: 000000000137332D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000137389F second address: 00000000013738C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F20E4E5D353h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F20E4E5D34Eh 0x00000012 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000013738C8 second address: 00000000013738CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000013738CC second address: 00000000013738F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jnc 00007F20E4E5D35Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000013738F5 second address: 00000000013738FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F20E4B50936h 0x0000000a rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001373A55 second address: 0000000001373A5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000013777F3 second address: 0000000001377806 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F20E4B5093Fh 0x00000009 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001377806 second address: 000000000137780C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000137D627 second address: 000000000137D62B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000137D62B second address: 000000000137D648 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F20E4E5D353h 0x0000000f rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000137D648 second address: 000000000137D662 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20E4B50943h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001391E03 second address: 0000000001391E13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F20E4E5D346h 0x0000000a pop ecx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001391E13 second address: 0000000001391E19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001391FBC second address: 0000000001391FC0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000139252E second address: 0000000001392533 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001392533 second address: 0000000001392539 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001392539 second address: 000000000139253D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000013926A1 second address: 00000000013926AC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007F20E4E5D346h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000013928E4 second address: 0000000001392931 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F20E4B50942h 0x00000008 jmp 00007F20E4B50946h 0x0000000d js 00007F20E4B50936h 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 jc 00007F20E4B50975h 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 jmp 00007F20E4B5093Fh 0x00000025 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001392931 second address: 0000000001392952 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20E4E5D358h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001392AA6 second address: 0000000001392AAB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000139749F second address: 00000000013974A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000010213AD second address: 00000000010213B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000010213B1 second address: 00000000010213DE instructions: 0x00000000 rdtsc 0x00000002 jp 00007F20E4E5D346h 0x00000008 jno 00007F20E4E5D346h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 jmp 00007F20E4E5D359h 0x00000019 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000010213DE second address: 0000000001021402 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F20E4B50936h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007F20E4B50945h 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001021402 second address: 000000000102140E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000102140E second address: 0000000001021414 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001021414 second address: 0000000001021436 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20E4E5D358h 0x00000007 je 00007F20E4E5D346h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000011AA696 second address: 00000000011AA69A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000011AA69A second address: 00000000011AA69E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000011AA69E second address: 00000000011AA6A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 00000000011AA6A6 second address: 00000000011AA6CB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20E4E5D357h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b jo 00007F20E4E5D346h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 000000000140344E second address: 0000000001403476 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 jo 00007F20E4B50936h 0x0000000d jmp 00007F20E4B50944h 0x00000012 jc 00007F20E4B50936h 0x00000018 popad 0x00000019 rdtsc
Source: C:\Windows\System32\loaddll32.exe RDTSC instruction interceptor: First address: 0000000001403476 second address: 0000000001403488 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F20E4E5D34Eh 0x00000009 rdtsc
Contains capabilities to detect virtual machines
Source: C:\Windows\SysWOW64\rundll32.exe Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion Jump to behavior
Queries disk information (often used to detect virtual machines)
Source: C:\Windows\System32\loaddll32.exe File opened: PhysicalDrive0 Jump to behavior
Source: rundll32.exe Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: rundll32.exe, 00000002.00000002.245875545.0000000004C90000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.259607750.0000000004DD0000.00000002.00000001.sdmp Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: rundll32.exe, 00000003.00000002.609898527.0000000002DB0000.00000004.00000020.sdmp Binary or memory string: Y\MACHINE\HARDWARE\ACPI\DSDT\VBOX__9-4053062332-1002\Software\WineblyStorageRootse\MicrosoftOleFeatureDevelopmentProperties
Source: rundll32.exe, 00000002.00000002.245875545.0000000004C90000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.259607750.0000000004DD0000.00000002.00000001.sdmp Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: rundll32.exe, 00000002.00000002.245875545.0000000004C90000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.259607750.0000000004DD0000.00000002.00000001.sdmp Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: rundll32.exe, 00000003.00000002.609898527.0000000002DB0000.00000004.00000020.sdmp Binary or memory string: \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__9-4053062332-1002\Software\WineblyStorageRootse\MicrosoftOleFeatureDevelopmentProperties
Source: rundll32.exe, 00000003.00000002.610715928.0000000004C4E000.00000040.00020000.sdmp Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: rundll32.exe, 00000002.00000002.245875545.0000000004C90000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.259607750.0000000004DD0000.00000002.00000001.sdmp Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
Source: C:\Windows\System32\loaddll32.exe System information queried: ModuleInformation Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging:

barindex
Hides threads from debuggers
Source: C:\Windows\System32\loaddll32.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Thread information set: HideFromDebugger Jump to behavior
Tries to detect sandboxes and other dynamic analysis tools (window names)
Source: C:\Windows\SysWOW64\rundll32.exe Open window title or class name: regmonclass
Source: C:\Windows\SysWOW64\rundll32.exe Open window title or class name: gbdyllo
Source: C:\Windows\SysWOW64\rundll32.exe Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Windows\SysWOW64\rundll32.exe Open window title or class name: procmon_window_class
Source: C:\Windows\SysWOW64\rundll32.exe Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Windows\SysWOW64\rundll32.exe Open window title or class name: ollydbg
Source: C:\Windows\SysWOW64\rundll32.exe Open window title or class name: filemonclass
Source: C:\Windows\SysWOW64\rundll32.exe Open window title or class name: file monitor - sysinternals: www.sysinternals.com
Checks for debuggers (devices)
Source: C:\Windows\SysWOW64\rundll32.exe File opened: NTICE
Source: C:\Windows\SysWOW64\rundll32.exe File opened: SICE
Source: C:\Windows\SysWOW64\rundll32.exe File opened: SIWVID
Checks if the current process is being debugged
Source: C:\Windows\System32\loaddll32.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process queried: DebugPort Jump to behavior
Source: rundll32.exe, 00000003.00000002.610226431.0000000003600000.00000002.00000001.sdmp Binary or memory string: Program Manager
Source: rundll32.exe, 00000003.00000002.610226431.0000000003600000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd
Source: rundll32.exe, 00000003.00000002.610226431.0000000003600000.00000002.00000001.sdmp Binary or memory string: Progman
Source: rundll32.exe, 00000003.00000002.610226431.0000000003600000.00000002.00000001.sdmp Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\System32\loaddll32.exe Queries volume information: C:\ProgramData\yysrkymy.zki VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Queries volume information: C:\ProgramData\yysrkymy.zki VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Queries volume information: C:\ProgramData\yysrkymy.zki VolumeInformation Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 345244 Sample: fnp_my.dll Startdate: 27/01/2021 Architecture: WINDOWS Score: 80 16 Antivirus / Scanner detection for submitted sample 2->16 18 Multi AV Scanner detection for submitted file 2->18 20 Machine Learning detection for sample 2->20 22 PE file contains section with special chars 2->22 6 loaddll32.exe 3 2->6         started        process3 signatures4 24 Tries to detect virtualization through RDTSC time measurements 6->24 26 Hides threads from debuggers 6->26 28 Tries to detect sandboxes / dynamic malware analysis system (registry check) 6->28 9 rundll32.exe 6->9         started        12 rundll32.exe 6->12         started        14 rundll32.exe 6->14         started        process5 signatures6 30 Tries to detect sandboxes and other dynamic analysis tools (window names) 9->30 32 Hides threads from debuggers 9->32 34 Tries to detect sandboxes / dynamic malware analysis system (registry check) 9->34
No contacted IP infos